diff --git a/.azure-pipelines/callGithubWorkflow.yaml b/.azure-pipelines/callGithubWorkflow.yaml index 75f957cb716..4187a447070 100644 --- a/.azure-pipelines/callGithubWorkflow.yaml +++ b/.azure-pipelines/callGithubWorkflow.yaml @@ -56,11 +56,11 @@ jobs: $branchName = "$(System.PullRequest.SourceBranch)" $targetBranch = "$(System.PullRequest.TargetBranch)" $pullRequestNumber = "$(System.PullRequest.PullRequestNumber)" - $isAutoGeneratedPR = [bool]($branchName -match "-automated-pr") - Write-Host "BranchName is $branchName, pullRequestNumber $pullRequestNumber, isAutoGeneratedPR $isAutoGeneratedPR" + $isAutoGeneratedOrDependabotPR = [bool]($branchName -match "dependabot/|-automated-pr") + Write-Host "BranchName is $branchName, pullRequestNumber $pullRequestNumber, isAutoGeneratedOrDependabotPR $isAutoGeneratedOrDependabotPR" # NOT MAIN/MASTER OR AUTOMATED BRANCH - if ($branchName -ne 'master' -and $isAutoGeneratedPR -eq $false -and $targetBranch -eq 'master') + if ($branchName -ne 'master' -and $isAutoGeneratedOrDependabotPR -eq $false -and $targetBranch -eq 'master') { # INVOKE GITHUB WORKFLOW $header = @{ @@ -98,7 +98,7 @@ jobs: } else { - Write-Host "Skipping Github Workflow from execution as current branch is a Master branch or is a automated PR or target branch is not master." + Write-Host "Skipping Github Workflow from execution as current branch is a Master branch/Automated PR/Dependabot or target branch is not master." } } catch diff --git a/.github/workflows/arm-ttk-validations.yaml b/.github/workflows/arm-ttk-validations.yaml index 8e245a37d6f..ec0a00b9d4e 100644 --- a/.github/workflows/arm-ttk-validations.yaml +++ b/.github/workflows/arm-ttk-validations.yaml @@ -17,54 +17,9 @@ jobs: id: step1 name: Identify Changes in PR run: | - $diff = git diff --diff-filter=d --name-only HEAD^ HEAD - Write-Host "List of files in PR: $diff" - - $hasmainTemplateChanged = $false - $hasCreateUiDefinitionTemplateChanged = $false - - $isChangeInSolutionsFolder = [bool]($diff | Where-Object {$_ -like 'Solutions/*'}) - if (!$isChangeInSolutionsFolder) - { - Write-Host "Skipping as change is not in Solutions folder!" - exit 0 - } - - $requiredFiles = @("mainTemplate.json", "createUiDefinition.json") - $filteredFiles = $diff | Where-Object {$_ -match ($requiredFiles -Join "|")} - Write-Host "Filtered Files $filteredFiles" - - if ($filteredFiles.Count -gt 0) - { - $mainTemplateValue = $filteredFiles -match "mainTemplate.json" - $createUiValue = $filteredFiles -match "createUiDefinition.json" - - if ($mainTemplateValue) - { - $hasmainTemplateChanged = $true - } - - if ($createUiValue) - { - $hasCreateUiDefinitionTemplateChanged = $true - } - - if ($filteredFiles.Count -eq 1) - { - $packageIndex = $filteredFiles.IndexOf("/Package") - $sName = $filteredFiles.SubString(10, $packageIndex - 10) - } - else - { - $packageIndex = $filteredFiles[0].IndexOf("/Package") - $sName = $filteredFiles[0].SubString(10, $packageIndex - 10) - } - Write-Host "SolutionName: $sName" - } - - Write-Output "::set-output name=solutionName::$sName" - Write-Output "::set-output name=mainTemplateChanged::$hasmainTemplateChanged" - Write-Output "::set-output name=createUiChanged::$hasCreateUiDefinitionTemplateChanged" + Set-PSRepository PSGallery -InstallationPolicy Trusted + Install-Module powershell-yaml + ./.script/package-automation/arm-ttk-tests.ps1 - uses: docker/build-push-action@v2 id: publishGithubPackage diff --git a/.github/workflows/checkAutomatedPR.yaml b/.github/workflows/checkAutomatedPR.yaml index 985be930309..c55d2d20f31 100644 --- a/.github/workflows/checkAutomatedPR.yaml +++ b/.github/workflows/checkAutomatedPR.yaml @@ -12,7 +12,7 @@ permissions: pull-requests: read env: - BRANCH_NAME: ${{ github.event.client_payload.pull_request.head.ref && github.event.client_payload.pull_request.head.ref || github.event.client_payload.pullRequestBranchName }} + BRANCH_NAME: ${{ github.event.client_payload.pull_request.head.ref || github.event.client_payload.pullRequestBranchName }} BODY: ${{ github.event.issue.body }} jobs: diff --git a/.github/workflows/checkPRContentChange.yaml b/.github/workflows/checkPRContentChange.yaml index f7f0bd77de6..bd531286ee2 100644 --- a/.github/workflows/checkPRContentChange.yaml +++ b/.github/workflows/checkPRContentChange.yaml @@ -8,7 +8,7 @@ on: - "Solutions/**" env: - BRANCH_NAME: ${{ github.event.client_payload.pull_request.head.ref && github.event.client_payload.pull_request.head.ref || github.event.client_payload.pullRequestBranchName }} + BRANCH_NAME: ${{ github.event.client_payload.pull_request.head.ref || github.event.client_payload.pullRequestBranchName }} jobs: solutionNameDetails: diff --git a/.github/workflows/checkSkipPackagingInfo.yaml b/.github/workflows/checkSkipPackagingInfo.yaml index 04c52087acc..5e759884a1a 100644 --- a/.github/workflows/checkSkipPackagingInfo.yaml +++ b/.github/workflows/checkSkipPackagingInfo.yaml @@ -13,7 +13,7 @@ on: value: ${{ jobs.checkPackagingInfoStatus.outputs.isPackagingRequired }} env: - BRANCH_NAME: ${{ github.event.client_payload.pull_request.head.ref && github.event.client_payload.pull_request.head.ref || github.event.client_payload.pullRequestBranchName }} + BRANCH_NAME: ${{ github.event.client_payload.pull_request.head.ref || github.event.client_payload.pullRequestBranchName }} jobs: checkPackagingInfoStatus: diff --git a/.github/workflows/getSolutionName.yaml b/.github/workflows/getSolutionName.yaml index d032f45fe72..0f1843d436e 100644 --- a/.github/workflows/getSolutionName.yaml +++ b/.github/workflows/getSolutionName.yaml @@ -8,7 +8,7 @@ on: value: ${{ jobs.currentPRSolutionName.outputs.sName }} env: - BRANCH_NAME: ${{ github.event.client_payload.pull_request.head.ref && github.event.client_payload.pull_request.head.ref || github.event.client_payload.pullRequestBranchName }} + BRANCH_NAME: ${{ github.event.client_payload.pull_request.head.ref || github.event.client_payload.pullRequestBranchName }} jobs: currentPRSolutionName: diff --git a/.github/workflows/neworexistingsolution.yaml b/.github/workflows/neworexistingsolution.yaml index 0417824ef0a..75992944384 100644 --- a/.github/workflows/neworexistingsolution.yaml +++ b/.github/workflows/neworexistingsolution.yaml @@ -17,7 +17,7 @@ on: value: ${{ jobs.masterDetails.outputs.solutionPublisherId }} env: - BRANCH_NAME: ${{ github.event.client_payload.pull_request.head.ref && github.event.client_payload.pull_request.head.ref || github.event.client_payload.pullRequestBranchName }} + BRANCH_NAME: ${{ github.event.client_payload.pull_request.head.ref || github.event.client_payload.pullRequestBranchName }} jobs: masterDetails: diff --git a/.github/workflows/package-command.yaml b/.github/workflows/package-command.yaml index a965591febc..0cd58b45b60 100644 --- a/.github/workflows/package-command.yaml +++ b/.github/workflows/package-command.yaml @@ -4,7 +4,7 @@ env: DEFAULTPACKAGEVERSION: "${{ vars.DEFAULTPACKAGEVERSION }}" BLOB_CONN_STRING: "${{ secrets.BLOB_CONN_STRING }}" BASE_FOLDER_PATH: "${{ vars.BASEFOLDERPATH }}" - BRANCH_NAME: "${{ github.event.client_payload.pull_request.head.ref && github.event.client_payload.pull_request.head.ref || github.event.client_payload.pullRequestBranchName }}" + BRANCH_NAME: "${{ github.event.client_payload.pull_request.head.ref || github.event.client_payload.pullRequestBranchName }}" ADO_TOKEN: "${{ secrets.ADO_TOKEN }}" ADO_BASE_URL: "${{ vars.ADO_BASE_URL }}" ADO_AREAPATH: "${{ vars.ADO_AREAPATH }}" @@ -18,13 +18,13 @@ on: types: [package-command, Package-command, PACKAGE-command] jobs: solutionNameDetails: - if: ${{ github.actor != 'dependabot[bot]' && !github.event.pull_request.head.repo.fork }} + if: ${{ !github.event.pull_request.head.repo.fork && !contains(github.event.client_payload.pull_request.head.ref , 'dependabot/') && !contains(github.event.client_payload.pullRequestBranchName , 'dependabot/') }} uses: ./.github/workflows/getSolutionName.yaml secrets: inherit # BELOW JOB WILL CHECK IF WE NEED TO SKIP PACKAGE CREATION OR NOT checkSkipPackagingDetails: - if: ${{ github.actor != 'dependabot[bot]' && needs.solutionNameDetails.outputs.solutionName != '' && !github.event.pull_request.head.repo.fork }} + if: ${{ needs.solutionNameDetails.outputs.solutionName != '' && !github.event.pull_request.head.repo.fork }} uses: ./.github/workflows/checkSkipPackagingInfo.yaml secrets: inherit needs: solutionNameDetails @@ -34,7 +34,7 @@ jobs: neworexistingsolution: needs: [solutionNameDetails, checkSkipPackagingDetails] uses: ./.github/workflows/neworexistingsolution.yaml - if: ${{ github.actor != 'dependabot[bot]' && needs.solutionNameDetails.outputs.solutionName != '' && needs.checkSkipPackagingDetails.outputs.isPackagingRequired == 'True' }} + if: ${{ needs.solutionNameDetails.outputs.solutionName != '' && needs.checkSkipPackagingDetails.outputs.isPackagingRequired == 'True' }} with: solutionName: "${{ needs.solutionNameDetails.outputs.solutionName }}" secrets: inherit diff --git a/.github/workflows/slash-command-armttk.yaml b/.github/workflows/slash-command-armttk.yaml new file mode 100644 index 00000000000..fa87530e825 --- /dev/null +++ b/.github/workflows/slash-command-armttk.yaml @@ -0,0 +1,44 @@ +# THIS WORKFLOW WILL RUN WHEN WE ADD SLASH COMMAND LIKE '/arm-ttk', '/ARM-TTK', '/Arm-Ttk', 'armttk' or 'ARMTTK' +name: Slash Command ARM-TTK Tests + +on: + issue_comment: + types: [created, edited] + +jobs: + run-arm-ttk: + runs-on: ubuntu-latest + if: ${{ github.actor != 'dependabot[bot]' && !github.event.pull_request.head.repo.fork && github.event.issue.pull_request && contains(fromJson('["/armttk", "/Armttk", "/ARM-TTK", "/ARMTTK", "/arm-ttk", "/ArmTtk"]'), github.event.comment.body) }} + outputs: + solutionName: ${{ steps.step1.outputs.solutionName }} + mainTemplateChanged: ${{ steps.step1.outputs.mainTemplateChanged }} + createUiChanged: ${{ steps.step1.outputs.createUiChanged }} + steps: + - uses: actions/checkout@v3 + with: + fetch-depth: 5 + ref: refs/pull/${{ github.event.issue.number }}/head + - shell: pwsh + id: step1 + name: Identify Changes in PR + run: | + Set-PSRepository PSGallery -InstallationPolicy Trusted + Install-Module powershell-yaml + ./.script/package-automation/arm-ttk-tests.ps1 + + - uses: docker/build-push-action@v2 + id: publishGithubPackage + name: Run ARM-TTK + if: ${{ success() && steps.step1.outcome == 'success' && steps.step1.outputs.solutionName != '' && (steps.step1.outputs.mainTemplateChanged == 'true' || steps.step1.outputs.createUiChanged == 'true') }} + env: + SolutionName: ${{ steps.step1.outputs.solutionName }} + mainTemplateChanged: ${{ steps.step1.outputs.mainTemplateChanged }} + createUiChanged: ${{ steps.step1.outputs.createUiChanged }} + with: + context: . + file: ./.github/actions/Dockerfile + push: false + build-args: | + SolutionName + mainTemplateChanged + createUiChanged diff --git a/.script/package-automation/arm-ttk-tests.ps1 b/.script/package-automation/arm-ttk-tests.ps1 new file mode 100644 index 00000000000..3d4654bf1ab --- /dev/null +++ b/.script/package-automation/arm-ttk-tests.ps1 @@ -0,0 +1,57 @@ + +try { + $diff = git diff --diff-filter=d --name-only HEAD^ HEAD + Write-Host "List of files in PR: $diff" + + $hasmainTemplateChanged = $false + $hasCreateUiDefinitionTemplateChanged = $false + + $isChangeInSolutionsFolder = [bool]($diff | Where-Object {$_ -like 'Solutions/*'}) + if (!$isChangeInSolutionsFolder) + { + Write-Host "Skipping as change is not in Solutions folder!" + exit 0 + } + + $requiredFiles = @("mainTemplate.json", "createUiDefinition.json") + $filteredFiles = $diff | Where-Object {$_ -match ($requiredFiles -Join "|")} + Write-Host "Filtered Files $filteredFiles" + + $sName = '' + $hasmainTemplateChanged = $false + $hasCreateUiDefinitionTemplateChanged = $false + + if ($filteredFiles.Count -gt 0) + { + $mainTemplateValue = $filteredFiles -match "mainTemplate.json" + $createUiValue = $filteredFiles -match "createUiDefinition.json" + + if ($mainTemplateValue -or $createUiValue) + { + $hasmainTemplateChanged = $true + $hasCreateUiDefinitionTemplateChanged = $true + } + + if ($filteredFiles.Count -eq 1) + { + $packageIndex = $filteredFiles.IndexOf("/Package") + $sName = $filteredFiles.SubString(10, $packageIndex - 10) + } + else + { + $packageIndex = $filteredFiles[0].IndexOf("/Package") + $sName = $filteredFiles[0].SubString(10, $packageIndex - 10) + } + } + + Write-Host "solutionName $sName, mainTemplateChanged $hasmainTemplateChanged, createUiChanged $hasCreateUiDefinitionTemplateChanged" + Write-Output "solutionName=$sName" >> $env:GITHUB_OUTPUT + Write-Output "mainTemplateChanged=$hasmainTemplateChanged" >> $env:GITHUB_OUTPUT + Write-Output "createUiChanged=$hasCreateUiDefinitionTemplateChanged" >> $env:GITHUB_OUTPUT +} +catch { + Write-Host "Skipping as exception has occured Error Details: $_" + Write-Output "solutionName=''" >> $env:GITHUB_OUTPUT + Write-Output "mainTemplateChanged=$false" >> $env:GITHUB_OUTPUT + Write-Output "createUiChanged=$false" >> $env:GITHUB_OUTPUT +} \ No newline at end of file diff --git a/.script/package-automation/getSolutionName.ps1 b/.script/package-automation/getSolutionName.ps1 index 92e58ff167a..2ddfb8cd964 100644 --- a/.script/package-automation/getSolutionName.ps1 +++ b/.script/package-automation/getSolutionName.ps1 @@ -17,6 +17,18 @@ try $filteredFiles = $diff | Where-Object {$_ -match "Solutions/"} | Where-Object {$_ -notlike "Solutions/Images/*"} | Where-Object {$_ -notlike "Solutions/*.md"} | Where-Object { $_ -notlike '*system_generated_metadata.json' } Write-Host "Filtered Files $filteredFiles" + # IDENTIFY EXCLUSIONS AND IF THERE ARE NO FILES AFTER EXCLUSION THEN SKIP WORKFLOW RUN + $exclusionList = @(".py$",".png$",".jpg$",".jpeg$",".conf$", ".svg$", ".html$", ".ps1$", ".psd1$", "requirements.txt$", "host.json$", "proxies.json$", "/function.json$", ".xml$", ".zip$", ".md$") + + $filterOutExclusionList = $filteredFiles | Where-Object { $_ -notmatch ($exclusionList -join '|') } + + if ($filterOutExclusionList.Count -le 0) + { + Write-Host "Skipping GitHub Action as changes in PR are not valid and contains only excluded files!" + Write-Output "solutionName=" >> $env:GITHUB_OUTPUT + exit 0 + } + if ($filteredFiles.Count -gt 0) { if ($instrumentationKey -ne '') diff --git a/.script/tests/KqlvalidationsTests/CustomTables/MimecastDLP_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/MimecastDLP_CL.json new file mode 100644 index 00000000000..9a1f4dc8e2a --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/MimecastDLP_CL.json @@ -0,0 +1,53 @@ +{ + "Name":"MimecastDLP_CL", + "Properties":[ + { + "Name":"senderAddress_s", + "Type":"String" + }, + { + "Name":"recipientAddress_s", + "Type":"String" + }, + { + "Name":"subject_s", + "Type":"String" + }, + { + "Name":"eventTime_d", + "Type":"DateTime" + }, + { + "Name":"route_s", + "Type":"String" + }, + { + "Name":"policy_s", + "Type":"String" + }, + { + "Name":"action_s", + "Type":"String" + }, + { + "Name":"messageId_s", + "Type":"String" + }, + { + "Name":"mimecastEventId_s", + "Type":"String" + }, + { + "Name":"mimecastEventCategory_s", + "Type":"String" + }, + { + "Name":"time_generated", + "Type":"DateTime" + }, + { + "Name":"TimeGenerated", + "Type":"DateTime" + } + ] +} \ No newline at end of file diff --git a/.script/tests/KqlvalidationsTests/CustomTables/MimecastSIEM_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/MimecastSIEM_CL.json new file mode 100644 index 00000000000..2e6e52d7a9a --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/MimecastSIEM_CL.json @@ -0,0 +1,77 @@ +{ + "Name":"MimecastSIEM_CL", + "Properties":[ + { + "Name":"datetime_d", + "Type":"DateTime" + }, + { + "Name":"aCode_s", + "Type":"String" + }, + { + "Name":"acc_s", + "Type":"String" + }, + { + "Name":"Sender_s", + "Type":"String" + }, + { + "Name":"Hld_s", + "Type":"String" + }, + { + "Name":"AttSize_s", + "Type":"String" + }, + { + "Name":"Act_s", + "Type":"String" + }, + { + "Name":"AttCnt_s", + "Type":"String" + }, + { + "Name":"AttNames_s", + "Type":"String" + }, + { + "Name":"MsgSize_s", + "Type":"String" + }, + { + "Name":"MsgId_s", + "Type":"String" + }, + { + "Name":"Subject_s", + "Type":"String" + }, + { + "Name":"logType_s", + "Type":"String" + }, + { + "Name":"reason_s", + "Type":"String" + }, + { + "Name":"mimecastEventId_s", + "Type":"String" + }, + { + "Name":"mimecastEventCategory_s", + "Type":"String" + }, + { + "Name":"time_generated", + "Type":"DateTime" + }, + { + "Name":"TimeGenerated", + "Type":"DateTime" + } + ] +} \ No newline at end of file diff --git a/.script/tests/KqlvalidationsTests/CustomTables/SentinelOne_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/SentinelOne_CL.json index c88a505bedd..18d68ce1869 100644 --- a/.script/tests/KqlvalidationsTests/CustomTables/SentinelOne_CL.json +++ b/.script/tests/KqlvalidationsTests/CustomTables/SentinelOne_CL.json @@ -388,6 +388,910 @@ { "Name": "_ResourceId", "Type": "string" + }, + { + "Name": "_ItemId", + "Type": "string" + }, + { + "Name": "alertInfo_indicatorDescription_s", + "Type": "string" + }, + { + "Name": "alertInfo_indicatorName_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtFileOldPath_s", + "Type": "string" + }, + { + "Name": "alertInfo_indicatorCategory_s", + "Type": "string" + }, + { + "Name": "alertInfo_registryOldValue_g", + "Type": "string" + }, + { + "Name": "alertInfo_dstIp_s", + "Type": "string" + }, + { + "Name": "alertInfo_dstPort_s", + "Type": "string" + }, + { + "Name": "alertInfo_netEventDirection_s", + "Type": "string" + }, + { + "Name": "alertInfo_srcIp_s", + "Type": "string" + }, + { + "Name": "alertInfo_srcPort_s", + "Type": "string" + }, + { + "Name": "containerInfo_id_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtFileId_g", + "Type": "string" + }, + { + "Name": "alertInfo_registryOldValue_s", + "Type": "string" + }, + { + "Name": "alertInfo_registryOldValueType_s", + "Type": "string" + }, + { + "Name": "alertInfo_dnsRequest_s", + "Type": "string" + }, + { + "Name": "alertInfo_dnsResponse_s", + "Type": "string" + }, + { + "Name": "alertInfo_registryKeyPath_s", + "Type": "string" + }, + { + "Name": "alertInfo_registryPath_s", + "Type": "string" + }, + { + "Name": "alertInfo_registryValue_g", + "Type": "string" + }, + { + "Name": "ruleInfo_description_s", + "Type": "string" + }, + { + "Name": "alertInfo_registryValue_s", + "Type": "string" + }, + { + "Name": "alertInfo_loginAccountDomain_s", + "Type": "string" + }, + { + "Name": "alertInfo_loginAccountSid_s", + "Type": "string" + }, + { + "Name": "alertInfo_loginIsAdministratorEquivalent_s", + "Type": "string" + }, + { + "Name": "alertInfo_loginIsSuccessful_s", + "Type": "string" + }, + { + "Name": "alertInfo_loginType_s", + "Type": "string" + }, + { + "Name": "alertInfo_loginsUserName_s", + "Type": "string" + }, + { + "Name": "alertInfo_srcMachineIp_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtProcCmdLine_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtProcImagePath_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtProcName_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtProcPid_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtProcSignedStatus_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtProcStorylineId_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtProcUid_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_storyline_g", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_uniqueId_g", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_storyline_g", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_uniqueId_g", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtProcStorylineId_g", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtProcUid_g", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_machineType_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_name_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_osFamily_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_osName_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_osRevision_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_uuid_g", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_version_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_id_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_infected_b", + "Type": "bool" + }, + { + "Name": "agentRealtimeInfo_isActive_b", + "Type": "bool" + }, + { + "Name": "agentRealtimeInfo_isDecommissioned_b", + "Type": "bool" + }, + { + "Name": "agentRealtimeInfo_machineType_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_name_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_os_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_uuid_g", + "Type": "string" + }, + { + "Name": "alertInfo_alertId_s", + "Type": "string" + }, + { + "Name": "alertInfo_analystVerdict_s", + "Type": "string" + }, + { + "Name": "alertInfo_createdAt_t", + "Type": "datetime" + }, + { + "Name": "alertInfo_dvEventId_s", + "Type": "string" + }, + { + "Name": "alertInfo_eventType_s", + "Type": "string" + }, + { + "Name": "alertInfo_hitType_s", + "Type": "string" + }, + { + "Name": "alertInfo_incidentStatus_s", + "Type": "string" + }, + { + "Name": "alertInfo_isEdr_b", + "Type": "bool" + }, + { + "Name": "alertInfo_reportedAt_t", + "Type": "datetime" + }, + { + "Name": "alertInfo_source_s", + "Type": "string" + }, + { + "Name": "alertInfo_updatedAt_t", + "Type": "datetime" + }, + { + "Name": "ruleInfo_id_s", + "Type": "string" + }, + { + "Name": "ruleInfo_name_s", + "Type": "string" + }, + { + "Name": "ruleInfo_queryLang_s", + "Type": "string" + }, + { + "Name": "ruleInfo_queryType_s", + "Type": "string" + }, + { + "Name": "ruleInfo_s1ql_s", + "Type": "string" + }, + { + "Name": "ruleInfo_scopeLevel_s", + "Type": "string" + }, + { + "Name": "ruleInfo_severity_s", + "Type": "string" + }, + { + "Name": "ruleInfo_treatAsThreat_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_commandline_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_fileHashMd5_g", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_fileHashSha1_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_fileHashSha256_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_filePath_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_fileSignerIdentity_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_integrityLevel_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_name_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_pid_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_pidStarttime_t", + "Type": "datetime" + }, + { + "Name": "sourceParentProcessInfo_storyline_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_subsystem_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_uniqueId_s", + "Type": "string" + }, + { + "Name": "sourceParentProcessInfo_user_s", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_commandline_s", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_fileHashMd5_g", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_fileHashSha1_s", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_fileHashSha256_s", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_filePath_s", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_fileSignerIdentity_s", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_integrityLevel_s", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_name_s", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_pid_s", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_pidStarttime_t", + "Type": "datetime" + }, + { + "Name": "sourceProcessInfo_storyline_s", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_subsystem_s", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_uniqueId_s", + "Type": "string" + }, + { + "Name": "sourceProcessInfo_user_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtFileCreatedAt_t", + "Type": "datetime" + }, + { + "Name": "targetProcessInfo_tgtFileHashSha1_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtFileHashSha256_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtFileId_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtFileIsSigned_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtFileModifiedAt_t", + "Type": "datetime" + }, + { + "Name": "targetProcessInfo_tgtFilePath_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtProcIntegrityLevel_s", + "Type": "string" + }, + { + "Name": "targetProcessInfo_tgtProcessStartTime_t", + "Type": "datetime" + }, + { + "Name": "agentUpdatedVersion_s", + "Type": "string" + }, + { + "Name": "agentId_s", + "Type": "string" + }, + { + "Name": "hash_s", + "Type": "string" + }, + { + "Name": "osFamily_s", + "Type": "string" + }, + { + "Name": "threatId_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_accountId_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_accountName_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_agentDetectionState_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_agentDomain_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_agentIpV4_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_agentIpV6_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_agentLastLoggedInUserName_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_agentMitigationMode_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_agentOsName_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_agentOsRevision_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_agentRegisteredAt_t", + "Type": "datetime" + }, + { + "Name": "agentDetectionInfo_agentUuid_g", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_agentVersion_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_externalIp_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_groupId_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_groupName_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_siteId_s", + "Type": "string" + }, + { + "Name": "agentDetectionInfo_siteName_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_accountId_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_accountName_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_activeThreats_d", + "Type": "real" + }, + { + "Name": "agentRealtimeInfo_agentComputerName_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_agentDomain_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_agentId_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_agentInfected_b", + "Type": "bool" + }, + { + "Name": "agentRealtimeInfo_agentIsActive_b", + "Type": "bool" + }, + { + "Name": "agentRealtimeInfo_agentIsDecommissioned_b", + "Type": "bool" + }, + { + "Name": "agentRealtimeInfo_agentMachineType_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_agentMitigationMode_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_agentNetworkStatus_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_agentOsName_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_agentOsRevision_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_agentOsType_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_agentUuid_g", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_agentVersion_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_groupId_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_groupName_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_networkInterfaces_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_operationalState_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_rebootRequired_b", + "Type": "bool" + }, + { + "Name": "agentRealtimeInfo_scanFinishedAt_t", + "Type": "datetime" + }, + { + "Name": "agentRealtimeInfo_scanStartedAt_t", + "Type": "datetime" + }, + { + "Name": "agentRealtimeInfo_scanStatus_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_siteId_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_siteName_s", + "Type": "string" + }, + { + "Name": "agentRealtimeInfo_userActionsNeeded_s", + "Type": "string" + }, + { + "Name": "indicators_s", + "Type": "string" + }, + { + "Name": "mitigationStatus_s", + "Type": "string" + }, + { + "Name": "threatInfo_analystVerdict_s", + "Type": "string" + }, + { + "Name": "threatInfo_analystVerdictDescription_s", + "Type": "string" + }, + { + "Name": "threatInfo_automaticallyResolved_b", + "Type": "bool" + }, + { + "Name": "threatInfo_certificateId_s", + "Type": "string" + }, + { + "Name": "threatInfo_classification_s", + "Type": "string" + }, + { + "Name": "threatInfo_classificationSource_s", + "Type": "string" + }, + { + "Name": "threatInfo_cloudFilesHashVerdict_s", + "Type": "string" + }, + { + "Name": "threatInfo_collectionId_s", + "Type": "string" + }, + { + "Name": "threatInfo_confidenceLevel_s", + "Type": "string" + }, + { + "Name": "threatInfo_createdAt_t", + "Type": "datetime" + }, + { + "Name": "threatInfo_detectionEngines_s", + "Type": "string" + }, + { + "Name": "threatInfo_detectionType_s", + "Type": "string" + }, + { + "Name": "threatInfo_engines_s", + "Type": "string" + }, + { + "Name": "threatInfo_externalTicketExists_b", + "Type": "bool" + }, + { + "Name": "threatInfo_failedActions_b", + "Type": "bool" + }, + { + "Name": "threatInfo_fileExtension_s", + "Type": "string" + }, + { + "Name": "threatInfo_fileExtensionType_s", + "Type": "string" + }, + { + "Name": "threatInfo_filePath_s", + "Type": "string" + }, + { + "Name": "threatInfo_fileSize_d", + "Type": "real" + }, + { + "Name": "threatInfo_fileVerificationType_s", + "Type": "string" + }, + { + "Name": "threatInfo_identifiedAt_t", + "Type": "datetime" + }, + { + "Name": "threatInfo_incidentStatus_s", + "Type": "string" + }, + { + "Name": "threatInfo_incidentStatusDescription_s", + "Type": "string" + }, + { + "Name": "threatInfo_initiatedBy_s", + "Type": "string" + }, + { + "Name": "threatInfo_initiatedByDescription_s", + "Type": "string" + }, + { + "Name": "threatInfo_isFileless_b", + "Type": "bool" + }, + { + "Name": "threatInfo_isValidCertificate_b", + "Type": "bool" + }, + { + "Name": "threatInfo_mitigatedPreemptively_b", + "Type": "bool" + }, + { + "Name": "threatInfo_mitigationStatus_s", + "Type": "string" + }, + { + "Name": "threatInfo_mitigationStatusDescription_s", + "Type": "string" + }, + { + "Name": "threatInfo_originatorProcess_s", + "Type": "string" + }, + { + "Name": "threatInfo_pendingActions_b", + "Type": "bool" + }, + { + "Name": "threatInfo_processUser_s", + "Type": "string" + }, + { + "Name": "threatInfo_publisherName_s", + "Type": "string" + }, + { + "Name": "threatInfo_reachedEventsLimit_b", + "Type": "bool" + }, + { + "Name": "threatInfo_rebootRequired_b", + "Type": "bool" + }, + { + "Name": "threatInfo_sha1_s", + "Type": "string" + }, + { + "Name": "threatInfo_storyline_s", + "Type": "string" + }, + { + "Name": "threatInfo_threatId_s", + "Type": "string" + }, + { + "Name": "threatInfo_threatName_s", + "Type": "string" + }, + { + "Name": "threatInfo_updatedAt_t", + "Type": "datetime" + }, + { + "Name": "whiteningOptions_s", + "Type": "string" + }, + { + "Name": "threatInfo_maliciousProcessArguments_s", + "Type": "string" + }, + { + "Name": "threatInfo_fileExtension_g", + "Type": "string" + }, + { + "Name": "threatInfo_threatName_g", + "Type": "string" + }, + { + "Name": "threatInfo_storyline_g", + "Type": "string" + }, + { + "Name": "activityUuid_g", + "Type": "string" + }, + { + "Name": "secondaryDescription_s", + "Type": "string" + }, + { + "Name": "DataFields_s", + "Type": "string" + }, + { + "Name": "description_s", + "Type": "string" + }, + { + "Name": "comments_s", + "Type": "string" + }, + { + "Name": "detectionState_s", + "Type": "string" + }, + { + "Name": "firstFullModeTime_t", + "Type": "datetime" + }, + { + "Name": "fullDiskScanLastUpdatedAt_t", + "Type": "datetime" + }, + { + "Name": "serialNumber_s", + "Type": "string" + }, + { + "Name": "showAlertIcon_b", + "Type": "bool" + }, + { + "Name": "tags_sentinelone_s", + "Type": "string" + }, + { + "Name": "osUsername_s", + "Type": "string" + }, + { + "Name": "scanAbortedAt_t", + "Type": "datetime" + }, + { + "Name": "_ItemId", + "Type": "string" } ] } \ No newline at end of file diff --git a/.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json b/.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json index ef7196154a0..59734b77952 100644 --- a/.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json +++ b/.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json @@ -79,11 +79,6 @@ "templateName": "vimNetworkSessionMicrosoftMD4IoT.yaml", "validationFailReason": "The name 'LocalPort' does not refer to any known column, table, variable or function." }, - { - "id": "29e99017-e28d-47be-8b9a-c8c711f8a903", - "templateName": "NRT_AuthenticationMethodsChangedforVIPUsers.yaml", - "validationFailReason": "The name 'User Principal Name' does not refer to any known column, table, variable or function" - }, { "id": "078a6526-e94e-4cf1-a08e-83bc0186479f", "templateName": "Anomalous AAD Account Manipulation.yaml", diff --git a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json index 86672f5347b..9302c890bf9 100644 --- a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json +++ b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json @@ -199,11 +199,14 @@ "MicrosoftDefenderThreatIntelligence", "ZeroFox_Alert_Polling", "CortexXDR", + "MimecastSIEMAPI", "MimecastTTPAPI", "MimecastAuditAPI", "PingFederateAma", "vArmourACAma", "ContrastProtectAma", "ClarotyAma", - "illusiveAttackManagementSystemAma" + "illusiveAttackManagementSystemAma", + "TrendMicroApexOneAma", + "PaloAltoCDLAma" ] diff --git a/ASIM/dev/ASimTester/ASimTester.csv b/ASIM/dev/ASimTester/ASimTester.csv index 6cae14e36dc..025e3b41eb5 100644 --- a/ASIM/dev/ASimTester/ASimTester.csv +++ b/ASIM/dev/ASimTester/ASimTester.csv @@ -535,15 +535,15 @@ EventOwner,string,Optional,RegistryEvent,,, EventOwner,string,Optional,UserManagement,,, EventOwner,string,Optional,WebSession,,, EventProduct,string,Mandatory,AuditEvent,Enumerated,Azure|Windows|Exchange 365|Dataminr Pulse|Vectra Cloud, -EventProduct,string,Mandatory,Authentication,Enumerated,Service Cloud|Auth0|CloudTrail|AAD|Azure Defender for IoT|M365 Defender for Endpoint|Security Events|Okta|PostgreSQL|OpenSSH|su|sudo|Vectra Cloud, +EventProduct,string,Mandatory,Authentication,Enumerated,Service Cloud|Auth0|CloudTrail|AAD|Azure Defender for IoT|M365 Defender for Endpoint|Security Events|Okta|PostgreSQL|OpenSSH|su|sudo|Vectra Cloud|SentinelOne, EventProduct,string,Mandatory,Common,,, EventProduct,string,Mandatory,Dhcp,,, -EventProduct,string,Mandatory,Dns,Enumerated,Umbrella|Azure Firewall|DNS Server|Sysmon|Sysmon for Linux|ZIA DNS|NIOS|Cloud DNS|Zeek|Vectra Stream, -EventProduct,string,Mandatory,FileEvent,Enumerated,Sysmon for Linux|Sysmon|M365 Defender for Endpoint|Azure File Storage|SharePoint|OneDrive, -EventProduct,string,Mandatory,NetworkSession,Enumerated,Fortigate|IOS|SDP|Vectra Stream|NSGFlow|Fireware|VPC|Azure Defender for IoT|Azure Firewall|M365 Defender for Endpoint|Sysmon|Sysmon for Linux|Windows Firewall|WireData|ZIA Firewall|CDL|PanOS|VMConnection|Meraki MX|Zeek|Firewall|ASA|Cynerio, +EventProduct,string,Mandatory,Dns,Enumerated,Umbrella|Azure Firewall|DNS Server|Sysmon|Sysmon for Linux|ZIA DNS|NIOS|Cloud DNS|Zeek|Vectra Stream|SentinelOne, +EventProduct,string,Mandatory,FileEvent,Enumerated,Sysmon for Linux|Sysmon|M365 Defender for Endpoint|Azure File Storage|SharePoint|OneDrive|SentinelOne, +EventProduct,string,Mandatory,NetworkSession,Enumerated,Fortigate|IOS|SDP|Vectra Stream|NSGFlow|Fireware|VPC|Azure Defender for IoT|Azure Firewall|M365 Defender for Endpoint|Sysmon|Sysmon for Linux|Windows Firewall|WireData|ZIA Firewall|CDL|PanOS|VMConnection|Meraki MX|Zeek|Firewall|ASA|Cynerio|SentinelOne, EventProduct,string,Mandatory,ProcessEvent,Enumerated,M365 Defender for Endpoint|Sysmon for Linux|Sysmon|Azure Defender for IoT|Security Events, -EventProduct,string,Mandatory,RegistryEvent,Enumerated,M365 Defender for Endpoint|Security Events|Sysmon|Windows Event, -EventProduct,string,Mandatory,UserManagement,,, +EventProduct,string,Mandatory,RegistryEvent,Enumerated,M365 Defender for Endpoint|Security Events|Sysmon|Windows Event|SentinelOne, +EventProduct,string,Mandatory,UserManagement,Enumerated,SentinelOne, EventProduct,string,Mandatory,WebSession,Enumerated,IIS|Squid Proxy|ZIA Proxy|Vectra Stream|PanOS|CDL|Fireware|Meraki MX|Web Security Gateway|Zeek|Dataminr Pulse, EventProductVersion,string,Optional,AuditEvent,,, EventProductVersion,string,Optional,Authentication,,, @@ -663,15 +663,19 @@ EventUid,string,Recommended,RegistryEvent,,, EventUid,string,Recommended,UserManagement,,, EventUid,string,Recommended,WebSession,,, EventVendor,string,Mandatory,AuditEvent,Enumerated,Microsoft|AWS|Dataminr|Vectra, -EventVendor,string,Mandatory,Authentication,Enumerated,Salesforce|AWS|Microsoft|Okta|PostgreSQL|OpenBSD|Linux|Vectra, +EventVendor,string,Mandatory,Authentication,Enumerated,Salesforce|AWS|Microsoft|Okta|PostgreSQL|OpenBSD|Linux|Vectra|SentinelOne, EventVendor,string,Mandatory,Common,,, EventVendor,string,Mandatory,Dhcp,,, -EventVendor,string,Mandatory,Dns,Enumerated,Cisco|Corelight|GCP|Infoblox|Microsoft|Zscaler|Vectra AI, +EventVendor,string,Mandatory,Dns,Enumerated,Cisco|Corelight|GCP|Infoblox|Microsoft|Zscaler|Vectra AI|SentinelOne, EventVendor,string,Mandatory,FileEvent,Enumerated,Microsoft, +EventVendor,string,Mandatory,NetworkSession,Enumerated,Fortinet|AppGate|Palo Alto|Microsoft|Zscaler|AWS|Vectra AI|WatchGuard|Cisco|Corelight|Check Point|Forcepoint|Cynerio|SentinelOne, +EventVendor,string,Mandatory,Dns,Enumerated,Cisco|Corelight|GCP|Infoblox|Microsoft|Zscaler|Vectra AI, +EventVendor,string,Mandatory,FileEvent,Enumerated,Microsoft|SentinelOne, EventVendor,string,Mandatory,NetworkSession,Enumerated,Fortinet|AppGate|Palo Alto|Microsoft|Zscaler|AWS|Vectra AI|WatchGuard|Cisco|Corelight|Check Point|Forcepoint|Cynerio, EventVendor,string,Mandatory,ProcessEvent,Enumerated,Microsoft, -EventVendor,string,Mandatory,UserManagement,,, +EventVendor,string,Mandatory,UserManagement,Enumerated,SentinelOne, EventVendor,string,Mandatory,WebSession,Enumerated,Microsoft|Squid|Zscaler|Vectra AI|Palo Alto|WatchGuard|Cisco|Forcepoint|Corelight|Dataminr, +EventVendor,string,Mandatory,RegistryEvent,Enumerated,SentinelOne, FileContentType,string,Optional,WebSession,Enumerated,, FileMD5,string,Optional,WebSession,MD5,, FileName,string,Alias,FileEvent,,,TargetFileName diff --git a/DataConnectors/AWS-SecurityHubFindings/AzFunAWSSecurityHubIngestion.zip b/DataConnectors/AWS-SecurityHubFindings/AzFunAWSSecurityHubIngestion.zip index bdccb8b6aee..06dae87c21b 100644 Binary files a/DataConnectors/AWS-SecurityHubFindings/AzFunAWSSecurityHubIngestion.zip and b/DataConnectors/AWS-SecurityHubFindings/AzFunAWSSecurityHubIngestion.zip differ diff --git a/DataConnectors/AWS-SecurityHubFindings/requirements.txt b/DataConnectors/AWS-SecurityHubFindings/requirements.txt index 9daa3937407..afca25e2e64 100644 --- a/DataConnectors/AWS-SecurityHubFindings/requirements.txt +++ b/DataConnectors/AWS-SecurityHubFindings/requirements.txt @@ -11,7 +11,7 @@ asn1crypto==0.24.0 azure-common==1.1.24 azure-core==1.21.0 botocore==1.12.10 -cryptography==41.0.3 +cryptography==41.0.4 pyasn1==0.4.2 pyasn1-modules==0.2.1 cffi==1.14.6 diff --git a/DataConnectors/Syslog/Forwarder_AMA_installer.py b/DataConnectors/Syslog/Forwarder_AMA_installer.py index 541e777f523..115449cc465 100644 --- a/DataConnectors/Syslog/Forwarder_AMA_installer.py +++ b/DataConnectors/Syslog/Forwarder_AMA_installer.py @@ -320,15 +320,24 @@ def main(): print("Located rsyslog daemon running on the machine") set_rsyslog_configuration() restart_rsyslog() + print_warning("Please note that the installation script opens port 514 to listen to incoming messages in both" + " UDP and TCP protocols. To change this setting, refer to the Rsyslog configuration file located at " + "'/etc/rsyslog.conf'.") elif is_syslog_ng(): print("Located syslog-ng daemon running on the machine") set_syslog_ng_configuration() restart_syslog_ng() + print_warning("Please note that the installation script opens port 514 to listen to incoming messages in both" + " UDP and TCP protocols. To change this setting, refer to the Syslog-ng configuration file located at" + " '/etc/syslog-ng/syslog-ng.conf'.") else: print_error( - "Could not detect a running Syslog daemon on the machine, aborting installation. Please make sure you have a running Syslog daemon and rerun this script.") + "Could not detect a running Syslog daemon on the machine, aborting installation. Please make sure you have " + "a running Syslog daemon and rerun this script.") + exit() print_full_disk_warning() - print_ok("Installation completed") + print_ok("Installation completed successfully") + main() diff --git a/Logos/ionix-logo.svg b/Logos/ionix-logo.svg new file mode 100644 index 00000000000..26f7d3cb422 --- /dev/null +++ b/Logos/ionix-logo.svg @@ -0,0 +1,14 @@ + + + + diff --git a/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml b/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml index e5180bdf6de..2b40efe91e5 100644 --- a/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml +++ b/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml @@ -42,7 +42,8 @@ ParserQuery: | ASimAuthenticationSigninLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSigninLogs' in (DisabledParsers) )), ASimAuthenticationSshd (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSshd' in (DisabledParsers) )), ASimAuthenticationSu (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSu' in (DisabledParsers) )), - ASimAuthenticationVectraXDRAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVectraXDRAudit' in (DisabledParsers) )) + ASimAuthenticationVectraXDRAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVectraXDRAudit' in (DisabledParsers) )), + ASimAuthenticationSentinelOne (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSentinelOne' in (DisabledParsers) )) Parsers: - _Im_Authentication_Empty @@ -63,4 +64,5 @@ Parsers: - _ASim_Authentication_Sshd - _ASim_Authentication_Su - _ASim_Authentication_VectraXDRAudit + - _ASim_Authentication_SentinelOne \ No newline at end of file diff --git a/Parsers/ASimAuthentication/Parsers/ASimAuthenticationSentinelOne.yaml b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationSentinelOne.yaml new file mode 100644 index 00000000000..29f94b7f697 --- /dev/null +++ b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationSentinelOne.yaml @@ -0,0 +1,232 @@ +Parser: + Title: ASIM Authentication parser for SentinelOne + Version: '0.1.0' + LastUpdated: Sep 18 2023 +Product: + Name: SentinelOne +Normalization: + Schema: Authentication + Version: '0.1.3' +References: +- Title: ASIM Authentication Schema + Link: https://aka.ms/ASimAuthenticationDoc +- Title: ASIM + Link: https:/aka.ms/AboutASIM +- Title: SentinelOne Documentation + Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM Authentication normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: ASimAuthenticationSentinelOne +EquivalentBuiltInParser: _ASim_Authentication_SentinelOne +ParserParams: + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let EventResultDetailsLookup = datatable (comments_s: string, EventResultDetails: string) + [ + "invalid 2FA code", "Incorrect password", + "IP/User mismatch", "No such user or password", + "invalid password", "Incorrect password", + "user temporarily locked 2FA attempt", "User locked", + "no active site", "Other" + ]; + let EventFieldsLookup = datatable ( + activityType_d: real, + EventType: string, + EventResult: string, + EventOriginalResultDetails: string + ) + [ + 27, "Logon", "Success", "User Logged In", + 33, "Logoff", "Success", "User Logged Out", + 133, "Logon", "Failure", "Existing User Login Failure", + 134, "Logon", "Failure", "Unknown User Login", + 139, "Logon", "Failure", "User Failed to Start an Unrestricted Session", + 3629, "Logon", "Success", "Login Using Saved 2FA Recovery Code" + ]; + let EventTypeLookup = datatable (alertInfo_eventType_s: string, EventType: string) + [ + "WINLOGONATTEMPT", "Logon", + "WINLOGOFFATTEMPT", "Logoff" + ]; + let EventSubTypeLookup = datatable (alertInfo_loginType_s: string, EventSubType: string) + [ + "BATCH", "System", + "CACHED_INTERACTIVE", "Interactive", + "CACHED_REMOTE_INTERACTIVE", "RemoteInteractive", + "CACHED_UNLOCK", "System", + "INTERACTIVE", "Interactive", + "NETWORK_CLEAR_TEXT", "Remote", + "NETWORK_CREDENTIALS", "Remote", + "NETWORK", "Remote", + "REMOTE_INTERACTIVE", "RemoteInteractive", + "SERVICE", "Service", + "SYSTEM", "System", + "UNLOCK", "System" + ]; + let DeviceTypeLookup = datatable ( + agentDetectionInfo_machineType_s: string, + SrcDeviceType: string + ) + [ + "desktop", "Computer", + "server", "Computer", + "laptop", "Computer", + "kubernetes node", "Other", + "unknown", "Other" + ]; + let ThreatConfidenceLookup_undefined = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_undefined: int + ) + [ + "FALSE_POSITIVE", 5, + "Undefined", 15, + "SUSPICIOUS", 25, + "TRUE_POSITIVE", 33 + ]; + let ThreatConfidenceLookup_suspicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_suspicious: int + ) + [ + "FALSE_POSITIVE", 40, + "Undefined", 50, + "SUSPICIOUS", 60, + "TRUE_POSITIVE", 67 + ]; + let ThreatConfidenceLookup_malicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_malicious: int + ) + [ + "FALSE_POSITIVE", 75, + "Undefined", 80, + "SUSPICIOUS", 90, + "TRUE_POSITIVE", 100 + ]; + let TargetUserTypesList = dynamic(["Regular", "Machine", "Admin", "System", "Application", "Service Principal", "Service", "Anonymous"]); + let parser = (disabled: bool=false) { + let alldata = SentinelOne_CL + | where not(disabled); + let activitydata = alldata + | where event_name_s == "Activities." + and activityType_d in (27, 33, 133, 134, 139, 3629) + | parse-kv DataFields_s as (ipAddress: string, username: string, userScope: string, accountName: string, fullScopeDetails: string, fullScopeDetailsPath: string, role: string, scopeLevel: string, source: string, sourceType: string) with (pair_delimiter=",", kv_delimiter=":", quote='"') + | lookup EventFieldsLookup on activityType_d + | lookup EventResultDetailsLookup on comments_s + | extend + SrcIpAddr = iff(ipAddress == "null", "", ipAddress), + EventOriginalType = tostring(toint(activityType_d)), + TargetUsername = username, + TargetUserScope = userScope, + AdditionalFields = bag_pack( + "accountName", accountName, + "fullScopeDetails", fullScopeDetails, + "fullScopeDetailsPath", fullScopeDetailsPath, + "scopeLevel", scopeLevel, + "source", source, + "sourceType", sourceType + ), + TargetOriginalUserType = role, + TargetUserType = case( + role in (TargetUserTypesList), role, + role == "null", "", + "Other" + ) + | project-rename + EventStartTime = createdAt_t, + TargetUserId = userId_s, + EventOriginalUid = activityUuid_g, + EventMessage = primaryDescription_s + | extend TargetUserIdType = iff(isnotempty(TargetUserId), "Other", ""); + let alertdata = alldata + | where event_name_s == "Alerts." + and alertInfo_eventType_s in ("WINLOGONATTEMPT", "WINLOGOFFATTEMPT") + | lookup EventTypeLookup on alertInfo_eventType_s + | lookup EventSubTypeLookup on alertInfo_loginType_s + | lookup DeviceTypeLookup on agentDetectionInfo_machineType_s; + let undefineddata = alertdata + | where ruleInfo_treatAsThreat_s == "UNDEFINED" + | lookup ThreatConfidenceLookup_undefined on alertInfo_analystVerdict_s; + let suspiciousdata = alertdata + | where ruleInfo_treatAsThreat_s == "Suspicious" + | lookup ThreatConfidenceLookup_suspicious on alertInfo_analystVerdict_s; + let maliciousdata = alertdata + | where ruleInfo_treatAsThreat_s == "Malicious" + | lookup ThreatConfidenceLookup_malicious on alertInfo_analystVerdict_s; + let alertdatawiththreatfield = union undefineddata, suspiciousdata, maliciousdata + | invoke _ASIM_ResolveDvcFQDN('agentDetectionInfo_name_s') + | invoke _ASIM_ResolveSrcFQDN('alertInfo_loginAccountDomain_s') + | extend + EventResult = iff(alertInfo_loginIsSuccessful_s == "true", "Success", "Failure"), + EventSeverity = iff(ruleInfo_severity_s == "Critical", "High", ruleInfo_severity_s), + ThreatConfidence = coalesce(ThreatConfidence_undefined, ThreatConfidence_suspicious, ThreatConfidence_malicious) + | project-rename + EventStartTime = alertInfo_createdAt_t, + SrcIpAddr = alertInfo_srcMachineIp_s, + ActingAppName = sourceProcessInfo_name_s, + DvcId = agentDetectionInfo_uuid_g, + DvcOs = agentDetectionInfo_osName_s, + DvcOsVersion = agentDetectionInfo_osRevision_s, + EventOriginalSeverity = ruleInfo_severity_s, + EventOriginalType = alertInfo_eventType_s, + EventOriginalSubType = alertInfo_loginType_s, + RuleName = ruleInfo_name_s, + TargetUserId = alertInfo_loginAccountSid_s, + TargetUsername = alertInfo_loginsUserName_s, + ThreatOriginalConfidence = ruleInfo_treatAsThreat_s + | extend + Rule = RuleName, + ActingAppType = iff(isnotempty(ActingAppName), "Process", ""), + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + TargetUserType = _ASIM_GetUserType(TargetUsername, TargetUserId), + TargetUserIdType = iff(isnotempty(TargetUserId), "SID", ""); + union activitydata, alertdatawiththreatfield + | extend + EventCount = int(1), + EventProduct = "SentinelOne", + EventSchemaVersion = "0.1.3", + EventVendor = "SentinelOne", + EventSchema = "Authentication" + | extend + Dvc = coalesce(DvcHostname, EventProduct), + EventEndTime = EventStartTime, + EventUid = _ItemId, + User = TargetUsername, + TargetHostname = SrcHostname, + TargetDomain = SrcDomain, + TargetDomainType = SrcDomainType, + TargetFQDN = SrcFQDN, + TargetUsernameType = _ASIM_GetUsernameType(TargetUsername) + | extend + IpAddr = SrcIpAddr, + Src = SrcIpAddr + | project-away + *_b, + *_d, + *_g, + *_s, + *_t, + ipAddress, + username, + accountName, + fullScopeDetails, + fullScopeDetailsPath, + role, + scopeLevel, + source, + sourceType, + userScope, + Computer, + MG, + ManagementGroupName, + RawData, + SourceSystem, + TenantId, + _ItemId, + _ResourceId, + ThreatConfidence_* + }; + parser(disabled=disabled) \ No newline at end of file diff --git a/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml b/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml index 33bc956d842..64c2480d0d8 100644 --- a/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml +++ b/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml @@ -49,6 +49,7 @@ ParserQuery: | , vimAuthenticationCiscoISE (starttime, endtime, targetusername_has, (imAuthenticationDisabled or('ExcludevimAuthenticationCiscoISE' in (DisabledParsers) ))) , vimAuthenticationBarracudaWAF (starttime, endtime, targetusername_has, (imAuthenticationDisabled or('ExcludevimAuthenticationBarracudaWAF' in (DisabledParsers) ))) , vimAuthenticationVectraXDRAudit (starttime, endtime, (imAuthenticationDisabled or('ExcludevimAuthenticationVectraXDRAudit' in (DisabledParsers) ))) + , vimAuthenticationSentinelOne (starttime, endtime, (imAuthenticationDisabled or('ExcludevimAuthenticationSentinelOne' in (DisabledParsers) ))) }; Generic(starttime, endtime, targetusername_has) @@ -71,4 +72,5 @@ Parsers: - _Im_Authentication_CiscoISE - _Im_Authentication_BarracudaWAF - _Im_Authentication_VectraXDRAudit + - _Im_Authentication_SentinelOne diff --git a/Parsers/ASimAuthentication/Parsers/vimAuthenticationSentinelOne.yaml b/Parsers/ASimAuthentication/Parsers/vimAuthenticationSentinelOne.yaml new file mode 100644 index 00000000000..af040d6c488 --- /dev/null +++ b/Parsers/ASimAuthentication/Parsers/vimAuthenticationSentinelOne.yaml @@ -0,0 +1,241 @@ +Parser: + Title: ASIM Authentication parser for SentinelOne + Version: '0.1.0' + LastUpdated: Jul 25 2023 +Product: + Name: SentinelOne +Normalization: + Schema: Authentication + Version: '0.1.3' +References: +- Title: ASIM Authentication Schema + Link: https://aka.ms/ASimAuthenticationDoc +- Title: ASIM + Link: https:/aka.ms/AboutASIM +- Title: SentinelOne Documentation + Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM Authentication normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: vimAuthenticationSentinelOne +EquivalentBuiltInParser: _Im_Authentication_SentinelOne +ParserParams: + - Name: disabled + Type: bool + Default: false + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: targetusername_has + Type: string + Default: '*' +ParserQuery: | + let EventResultDetailsLookup = datatable (comments_s: string, EventResultDetails: string) + [ + "invalid 2FA code", "Incorrect password", + "IP/User mismatch", "No such user or password", + "invalid password", "Incorrect password", + "user temporarily locked 2FA attempt", "User locked", + "no active site", "Other" + ]; + let EventFieldsLookup = datatable ( + activityType_d: real, + EventType: string, + EventResult: string, + EventOriginalResultDetails: string + ) + [ + 27, "Logon", "Success", "User Logged In", + 33, "Logoff", "Success", "User Logged Out", + 133, "Logon", "Failure", "Existing User Login Failure", + 134, "Logon", "Failure", "Unknown User Login", + 139, "Logon", "Failure", "User Failed to Start an Unrestricted Session", + 3629, "Logon", "Success", "Login Using Saved 2FA Recovery Code" + ]; + let EventTypeLookup = datatable (alertInfo_eventType_s: string, EventType: string) + [ + "WINLOGONATTEMPT", "Logon", + "WINLOGOFFATTEMPT", "Logoff" + ]; + let EventSubTypeLookup = datatable (alertInfo_loginType_s: string, EventSubType: string) + [ + "BATCH","System", + "CACHED_INTERACTIVE", "Interactive", + "CACHED_REMOTE_INTERACTIVE", "RemoteInteractive", + "CACHED_UNLOCK", "System", + "INTERACTIVE", "Interactive", + "NETWORK_CLEAR_TEXT", "Remote", + "NETWORK_CREDENTIALS", "Remote", + "NETWORK", "Remote", + "REMOTE_INTERACTIVE", "RemoteInteractive", + "SERVICE", "Service", + "SYSTEM", "System", + "UNLOCK", "System" + ]; + let DeviceTypeLookup = datatable (agentDetectionInfo_machineType_s: string, SrcDeviceType: string) + [ + "desktop", "Computer", + "server", "Computer", + "laptop", "Computer", + "kubernetes node", "Other", + "unknown", "Other" + ]; + let ThreatConfidenceLookup_undefined = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_undefined: int + ) + [ + "FALSE_POSITIVE", 5, + "Undefined", 15, + "SUSPICIOUS", 25, + "TRUE_POSITIVE", 33 + ]; + let ThreatConfidenceLookup_suspicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_suspicious: int + ) + [ + "FALSE_POSITIVE", 40, + "Undefined", 50, + "SUSPICIOUS", 60, + "TRUE_POSITIVE", 67 + ]; + let ThreatConfidenceLookup_malicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_malicious: int + ) + [ + "FALSE_POSITIVE", 75, + "Undefined", 80, + "SUSPICIOUS", 90, + "TRUE_POSITIVE", 100 + ]; + let TargetUserTypesList = dynamic(["Regular", "Machine", "Admin", "System", "Application", "Service Principal", "Service", "Anonymous"]); + let parser = (disabled: bool = false, starttime: datetime=datetime(null), endtime: datetime=datetime(null), targetusername_has: string='*') { + let alldata = SentinelOne_CL + | where not(disabled) + and (isnull(starttime) or TimeGenerated >= starttime) and (isnull(endtime) or TimeGenerated <= endtime); + let activitydata = alldata + | where event_name_s == "Activities." + and activityType_d in (27, 33, 133, 134, 139, 3629) + | parse-kv DataFields_s as (ipAddress: string, username: string, userScope: string, accountName: string, fullScopeDetails: string, fullScopeDetailsPath: string, role: string, scopeLevel: string, source: string, sourceType: string) with (pair_delimiter=",", kv_delimiter=":", quote='"') + | where targetusername_has == "*" or username has targetusername_has + | lookup EventFieldsLookup on activityType_d + | lookup EventResultDetailsLookup on comments_s + | extend + SrcIpAddr = iff(ipAddress == "null", "", ipAddress), + EventOriginalType = tostring(toint(activityType_d)), + TargetUsername = username, + TargetUserScope = userScope, + AdditionalFields = bag_pack( + "accountName", accountName, + "fullScopeDetails", fullScopeDetails, + "fullScopeDetailsPath", fullScopeDetailsPath, + "scopeLevel", scopeLevel, + "source", source, + "sourceType", sourceType + ), + TargetOriginalUserType = role, + TargetUserType = case( + role in (TargetUserTypesList), role, + role == "null", "", + "Other" + ) + | project-rename + EventStartTime = createdAt_t, + TargetUserId = userId_s, + EventOriginalUid = activityUuid_g, + EventMessage = primaryDescription_s + | extend TargetUserIdType = iff(isnotempty(TargetUserId), "Other", ""); + let alertdata = alldata + | where event_name_s == "Alerts." + and alertInfo_eventType_s in ("WINLOGONATTEMPT", "WINLOGOFFATTEMPT") + and (targetusername_has == "*" or alertInfo_loginsUserName_s has targetusername_has) + | lookup EventTypeLookup on alertInfo_eventType_s + | lookup EventSubTypeLookup on alertInfo_loginType_s + | lookup DeviceTypeLookup on agentDetectionInfo_machineType_s; + let undefineddata = alertdata + | where ruleInfo_treatAsThreat_s == "UNDEFINED" + | lookup ThreatConfidenceLookup_undefined on alertInfo_analystVerdict_s; + let suspiciousdata = alertdata + | where ruleInfo_treatAsThreat_s == "Suspicious" + | lookup ThreatConfidenceLookup_suspicious on alertInfo_analystVerdict_s; + let maliciousdata = alertdata + | where ruleInfo_treatAsThreat_s == "Malicious" + | lookup ThreatConfidenceLookup_malicious on alertInfo_analystVerdict_s; + let alertdatawiththreatfield = union undefineddata, suspiciousdata, maliciousdata + | invoke _ASIM_ResolveDvcFQDN('agentDetectionInfo_name_s') + | invoke _ASIM_ResolveSrcFQDN('alertInfo_loginAccountDomain_s') + | extend + EventResult = iff(alertInfo_loginIsSuccessful_s == "true", "Success", "Failure"), + EventSeverity = iff(ruleInfo_severity_s == "Critical", "High", ruleInfo_severity_s), + ThreatConfidence = coalesce(ThreatConfidence_undefined, ThreatConfidence_suspicious, ThreatConfidence_malicious) + | project-rename + EventStartTime = alertInfo_createdAt_t, + SrcIpAddr = alertInfo_srcMachineIp_s, + ActingAppName = sourceProcessInfo_name_s, + DvcId = agentDetectionInfo_uuid_g, + DvcOs = agentDetectionInfo_osName_s, + DvcOsVersion = agentDetectionInfo_osRevision_s, + EventOriginalSeverity = ruleInfo_severity_s, + EventOriginalType = alertInfo_eventType_s, + EventOriginalSubType = alertInfo_loginType_s, + RuleName = ruleInfo_name_s, + TargetUserId = alertInfo_loginAccountSid_s, + TargetUsername = alertInfo_loginsUserName_s, + ThreatOriginalConfidence = ruleInfo_treatAsThreat_s + | extend + Rule = RuleName, + ActingAppType = iff(isnotempty(ActingAppName), "Process", ""), + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + TargetUserType = _ASIM_GetUserType(TargetUsername, TargetUserId), + TargetUserIdType = iff(isnotempty(TargetUserId), "SID", ""); + union activitydata, alertdatawiththreatfield + | extend + EventCount = int(1), + EventProduct = "SentinelOne", + EventSchemaVersion = "0.1.3", + EventVendor = "SentinelOne", + EventSchema = "Authentication" + | extend + Dvc = coalesce(DvcHostname, EventProduct), + EventEndTime = EventStartTime, + EventUid = _ItemId, + User = TargetUsername, + TargetHostname = SrcHostname, + TargetDomain = SrcDomain, + TargetDomainType = SrcDomainType, + TargetFQDN = SrcFQDN, + TargetUsernameType = _ASIM_GetUsernameType(TargetUsername) + | extend + IpAddr = SrcIpAddr, + Src = SrcIpAddr + | project-away + *_b, + *_d, + *_g, + *_s, + *_t, + ipAddress, + username, + accountName, + fullScopeDetails, + fullScopeDetailsPath, + role, + scopeLevel, + source, + sourceType, + userScope, + Computer, + MG, + ManagementGroupName, + RawData, + SourceSystem, + TenantId, + _ItemId, + _ResourceId, + ThreatConfidence_* + }; + parser(disabled=disabled, starttime=starttime, endtime=endtime, targetusername_has=targetusername_has) \ No newline at end of file diff --git a/Parsers/ASimAuthentication/Tests/SentinelOne_ASimAuthentication_DataTest.csv b/Parsers/ASimAuthentication/Tests/SentinelOne_ASimAuthentication_DataTest.csv new file mode 100644 index 00000000000..3a3a353abf7 --- /dev/null +++ b/Parsers/ASimAuthentication/Tests/SentinelOne_ASimAuthentication_DataTest.csv @@ -0,0 +1,37 @@ +Result +"(0) Error: 1 invalid value(s) (up to 10 listed) in 1263 records (100.0%) for field [EventProduct] of type [Enumerated]: [""SentinelOne""] (Schema:Authentication)" +"(0) Error: 1 invalid value(s) (up to 10 listed) in 1263 records (100.0%) for field [EventVendor] of type [Enumerated]: [""SentinelOne""] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [ActingAppName] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [ActingAppType] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [DvcId] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [DvcOsVersion] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [DvcOs] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [EventOriginalSeverity] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [EventOriginalSubType] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [EventSubType] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [RuleName] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [Rule] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [SrcDeviceType] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [ThreatConfidence] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [ThreatOriginalConfidence] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in recommended field [DvcHostname] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in recommended field [EventSeverity] (Schema:Authentication)" +"(2) Info: Empty value in 1257 records (99.52%) in optional field [SrcHostname] (Schema:Authentication)" +"(2) Info: Empty value in 1257 records (99.52%) in recommended field [TargetHostname] (Schema:Authentication)" +"(2) Info: Empty value in 1261 records (99.84%) in optional field [DvcFQDN] (Schema:Authentication)" +"(2) Info: Empty value in 1261 records (99.84%) in recommended field [DvcDomain] (Schema:Authentication)" +"(2) Info: Empty value in 1263 records (100.0%) in optional field [SrcDomain] (Schema:Authentication)" +"(2) Info: Empty value in 1263 records (100.0%) in optional field [SrcFQDN] (Schema:Authentication)" +"(2) Info: Empty value in 1263 records (100.0%) in optional field [TargetFQDN] (Schema:Authentication)" +"(2) Info: Empty value in 1263 records (100.0%) in recommended field [TargetDomain] (Schema:Authentication)" +"(2) Info: Empty value in 14 records (1.11%) in optional field [AdditionalFields] (Schema:Authentication)" +"(2) Info: Empty value in 14 records (1.11%) in optional field [EventMessage] (Schema:Authentication)" +"(2) Info: Empty value in 14 records (1.11%) in optional field [EventOriginalResultDetails] (Schema:Authentication)" +"(2) Info: Empty value in 14 records (1.11%) in optional field [EventOriginalUid] (Schema:Authentication)" +"(2) Info: Empty value in 14 records (1.11%) in optional field [TargetOriginalUserType] (Schema:Authentication)" +"(2) Info: Empty value in 14 records (1.11%) in optional field [TargetUserScope] (Schema:Authentication)" +"(2) Info: Empty value in 239 records (18.92%) in recommended field [EventResultDetails] (Schema:Authentication)" +"(2) Info: Empty value in 8 records (0.63%) in optional field [TargetUserId] (Schema:Authentication)" +"(2) Info: Empty value in 912 records (72.21%) in optional field [TargetUserType] (Schema:Authentication)" +"(2) Info: Empty value in 954 records (75.53%) in recommended field [SrcIpAddr] (Schema:Authentication)" +"(2) Info: Empty value in 954 records (75.53%) in recommended field [Src] (Schema:Authentication)" diff --git a/Parsers/ASimAuthentication/Tests/SentinelOne_ASimAuthentication_SchemaTest.csv b/Parsers/ASimAuthentication/Tests/SentinelOne_ASimAuthentication_SchemaTest.csv new file mode 100644 index 00000000000..90448bc26c0 --- /dev/null +++ b/Parsers/ASimAuthentication/Tests/SentinelOne_ASimAuthentication_SchemaTest.csv @@ -0,0 +1,72 @@ +Result +"(1) Warning: Missing recommended field [Dst]" +"(1) Warning: Missing recommended field [DvcAction]" +"(1) Warning: Missing recommended field [DvcIpAddr]" +"(2) Info: Missing optional alias [Application] aliasing non-existent column [TargetAppName]" +"(2) Info: Missing optional field [ActingAppId]" +"(2) Info: Missing optional field [ActorOriginalUserType]" +"(2) Info: Missing optional field [ActorScopeId]" +"(2) Info: Missing optional field [ActorScope]" +"(2) Info: Missing optional field [ActorSessionId]" +"(2) Info: Missing optional field [ActorUserId]" +"(2) Info: Missing optional field [ActorUserType]" +"(2) Info: Missing optional field [ActorUsername]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [HttpUserAgent]" +"(2) Info: Missing optional field [LogonMethod]" +"(2) Info: Missing optional field [LogonProtocol]" +"(2) Info: Missing optional field [LogonTarget]" +"(2) Info: Missing optional field [RuleNumber]" +"(2) Info: Missing optional field [SrcDescription]" +"(2) Info: Missing optional field [SrcDvcId]" +"(2) Info: Missing optional field [SrcDvcOs]" +"(2) Info: Missing optional field [SrcDvcScopeId]" +"(2) Info: Missing optional field [SrcDvcScope]" +"(2) Info: Missing optional field [SrcGeoCity]" +"(2) Info: Missing optional field [SrcGeoCountry]" +"(2) Info: Missing optional field [SrcGeoLatitude]" +"(2) Info: Missing optional field [SrcGeoLongitude]" +"(2) Info: Missing optional field [SrcGeoRegion]" +"(2) Info: Missing optional field [SrcIsp]" +"(2) Info: Missing optional field [SrcOriginalRiskLevel]" +"(2) Info: Missing optional field [SrcPortNumber]" +"(2) Info: Missing optional field [SrcRiskLevel]" +"(2) Info: Missing optional field [TargetAppId]" +"(2) Info: Missing optional field [TargetAppName]" +"(2) Info: Missing optional field [TargetDescription]" +"(2) Info: Missing optional field [TargetDeviceType]" +"(2) Info: Missing optional field [TargetDvcId]" +"(2) Info: Missing optional field [TargetDvcOs]" +"(2) Info: Missing optional field [TargetDvcScopeId]" +"(2) Info: Missing optional field [TargetDvcScope]" +"(2) Info: Missing optional field [TargetGeoCity]" +"(2) Info: Missing optional field [TargetGeoCountry]" +"(2) Info: Missing optional field [TargetGeoLatitude]" +"(2) Info: Missing optional field [TargetGeoLongitude]" +"(2) Info: Missing optional field [TargetGeoRegion]" +"(2) Info: Missing optional field [TargetIpAddr]" +"(2) Info: Missing optional field [TargetOriginalRiskLevel]" +"(2) Info: Missing optional field [TargetPortNumber]" +"(2) Info: Missing optional field [TargetRiskLevel]" +"(2) Info: Missing optional field [TargetSessionId]" +"(2) Info: Missing optional field [TargetUrl]" +"(2) Info: Missing optional field [TargetUserScopeId]" +"(2) Info: Missing optional field [ThreatCategory]" +"(2) Info: Missing optional field [ThreatField]" +"(2) Info: Missing optional field [ThreatFirstReportedTime]" +"(2) Info: Missing optional field [ThreatId]" +"(2) Info: Missing optional field [ThreatIpAddr]" +"(2) Info: Missing optional field [ThreatIsActive]" +"(2) Info: Missing optional field [ThreatLastReportedTime]" +"(2) Info: Missing optional field [ThreatName]" +"(2) Info: Missing optional field [ThreatOriginalRiskLevel]" +"(2) Info: Missing optional field [ThreatRiskLevel]" diff --git a/Parsers/ASimAuthentication/Tests/SentinelOne_vimAuthentication_DataTest.csv b/Parsers/ASimAuthentication/Tests/SentinelOne_vimAuthentication_DataTest.csv new file mode 100644 index 00000000000..3a3a353abf7 --- /dev/null +++ b/Parsers/ASimAuthentication/Tests/SentinelOne_vimAuthentication_DataTest.csv @@ -0,0 +1,37 @@ +Result +"(0) Error: 1 invalid value(s) (up to 10 listed) in 1263 records (100.0%) for field [EventProduct] of type [Enumerated]: [""SentinelOne""] (Schema:Authentication)" +"(0) Error: 1 invalid value(s) (up to 10 listed) in 1263 records (100.0%) for field [EventVendor] of type [Enumerated]: [""SentinelOne""] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [ActingAppName] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [ActingAppType] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [DvcId] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [DvcOsVersion] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [DvcOs] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [EventOriginalSeverity] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [EventOriginalSubType] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [EventSubType] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [RuleName] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [Rule] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [SrcDeviceType] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [ThreatConfidence] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in optional field [ThreatOriginalConfidence] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in recommended field [DvcHostname] (Schema:Authentication)" +"(2) Info: Empty value in 1249 records (98.89%) in recommended field [EventSeverity] (Schema:Authentication)" +"(2) Info: Empty value in 1257 records (99.52%) in optional field [SrcHostname] (Schema:Authentication)" +"(2) Info: Empty value in 1257 records (99.52%) in recommended field [TargetHostname] (Schema:Authentication)" +"(2) Info: Empty value in 1261 records (99.84%) in optional field [DvcFQDN] (Schema:Authentication)" +"(2) Info: Empty value in 1261 records (99.84%) in recommended field [DvcDomain] (Schema:Authentication)" +"(2) Info: Empty value in 1263 records (100.0%) in optional field [SrcDomain] (Schema:Authentication)" +"(2) Info: Empty value in 1263 records (100.0%) in optional field [SrcFQDN] (Schema:Authentication)" +"(2) Info: Empty value in 1263 records (100.0%) in optional field [TargetFQDN] (Schema:Authentication)" +"(2) Info: Empty value in 1263 records (100.0%) in recommended field [TargetDomain] (Schema:Authentication)" +"(2) Info: Empty value in 14 records (1.11%) in optional field [AdditionalFields] (Schema:Authentication)" +"(2) Info: Empty value in 14 records (1.11%) in optional field [EventMessage] (Schema:Authentication)" +"(2) Info: Empty value in 14 records (1.11%) in optional field [EventOriginalResultDetails] (Schema:Authentication)" +"(2) Info: Empty value in 14 records (1.11%) in optional field [EventOriginalUid] (Schema:Authentication)" +"(2) Info: Empty value in 14 records (1.11%) in optional field [TargetOriginalUserType] (Schema:Authentication)" +"(2) Info: Empty value in 14 records (1.11%) in optional field [TargetUserScope] (Schema:Authentication)" +"(2) Info: Empty value in 239 records (18.92%) in recommended field [EventResultDetails] (Schema:Authentication)" +"(2) Info: Empty value in 8 records (0.63%) in optional field [TargetUserId] (Schema:Authentication)" +"(2) Info: Empty value in 912 records (72.21%) in optional field [TargetUserType] (Schema:Authentication)" +"(2) Info: Empty value in 954 records (75.53%) in recommended field [SrcIpAddr] (Schema:Authentication)" +"(2) Info: Empty value in 954 records (75.53%) in recommended field [Src] (Schema:Authentication)" diff --git a/Parsers/ASimAuthentication/Tests/SentinelOne_vimAuthentication_SchemaTest.csv b/Parsers/ASimAuthentication/Tests/SentinelOne_vimAuthentication_SchemaTest.csv new file mode 100644 index 00000000000..90448bc26c0 --- /dev/null +++ b/Parsers/ASimAuthentication/Tests/SentinelOne_vimAuthentication_SchemaTest.csv @@ -0,0 +1,72 @@ +Result +"(1) Warning: Missing recommended field [Dst]" +"(1) Warning: Missing recommended field [DvcAction]" +"(1) Warning: Missing recommended field [DvcIpAddr]" +"(2) Info: Missing optional alias [Application] aliasing non-existent column [TargetAppName]" +"(2) Info: Missing optional field [ActingAppId]" +"(2) Info: Missing optional field [ActorOriginalUserType]" +"(2) Info: Missing optional field [ActorScopeId]" +"(2) Info: Missing optional field [ActorScope]" +"(2) Info: Missing optional field [ActorSessionId]" +"(2) Info: Missing optional field [ActorUserId]" +"(2) Info: Missing optional field [ActorUserType]" +"(2) Info: Missing optional field [ActorUsername]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [HttpUserAgent]" +"(2) Info: Missing optional field [LogonMethod]" +"(2) Info: Missing optional field [LogonProtocol]" +"(2) Info: Missing optional field [LogonTarget]" +"(2) Info: Missing optional field [RuleNumber]" +"(2) Info: Missing optional field [SrcDescription]" +"(2) Info: Missing optional field [SrcDvcId]" +"(2) Info: Missing optional field [SrcDvcOs]" +"(2) Info: Missing optional field [SrcDvcScopeId]" +"(2) Info: Missing optional field [SrcDvcScope]" +"(2) Info: Missing optional field [SrcGeoCity]" +"(2) Info: Missing optional field [SrcGeoCountry]" +"(2) Info: Missing optional field [SrcGeoLatitude]" +"(2) Info: Missing optional field [SrcGeoLongitude]" +"(2) Info: Missing optional field [SrcGeoRegion]" +"(2) Info: Missing optional field [SrcIsp]" +"(2) Info: Missing optional field [SrcOriginalRiskLevel]" +"(2) Info: Missing optional field [SrcPortNumber]" +"(2) Info: Missing optional field [SrcRiskLevel]" +"(2) Info: Missing optional field [TargetAppId]" +"(2) Info: Missing optional field [TargetAppName]" +"(2) Info: Missing optional field [TargetDescription]" +"(2) Info: Missing optional field [TargetDeviceType]" +"(2) Info: Missing optional field [TargetDvcId]" +"(2) Info: Missing optional field [TargetDvcOs]" +"(2) Info: Missing optional field [TargetDvcScopeId]" +"(2) Info: Missing optional field [TargetDvcScope]" +"(2) Info: Missing optional field [TargetGeoCity]" +"(2) Info: Missing optional field [TargetGeoCountry]" +"(2) Info: Missing optional field [TargetGeoLatitude]" +"(2) Info: Missing optional field [TargetGeoLongitude]" +"(2) Info: Missing optional field [TargetGeoRegion]" +"(2) Info: Missing optional field [TargetIpAddr]" +"(2) Info: Missing optional field [TargetOriginalRiskLevel]" +"(2) Info: Missing optional field [TargetPortNumber]" +"(2) Info: Missing optional field [TargetRiskLevel]" +"(2) Info: Missing optional field [TargetSessionId]" +"(2) Info: Missing optional field [TargetUrl]" +"(2) Info: Missing optional field [TargetUserScopeId]" +"(2) Info: Missing optional field [ThreatCategory]" +"(2) Info: Missing optional field [ThreatField]" +"(2) Info: Missing optional field [ThreatFirstReportedTime]" +"(2) Info: Missing optional field [ThreatId]" +"(2) Info: Missing optional field [ThreatIpAddr]" +"(2) Info: Missing optional field [ThreatIsActive]" +"(2) Info: Missing optional field [ThreatLastReportedTime]" +"(2) Info: Missing optional field [ThreatName]" +"(2) Info: Missing optional field [ThreatOriginalRiskLevel]" +"(2) Info: Missing optional field [ThreatRiskLevel]" diff --git a/Parsers/ASimDns/Parsers/ASimDns.yaml b/Parsers/ASimDns/Parsers/ASimDns.yaml index 9c46821e444..446c8ed231b 100644 --- a/Parsers/ASimDns/Parsers/ASimDns.yaml +++ b/Parsers/ASimDns/Parsers/ASimDns.yaml @@ -30,6 +30,7 @@ Parsers: - _ASim_Dns_ZscalerZIA - _ASim_Dns_Native - _ASim_Dns_VectraAI + - _ASim_Dns_SentinelOne ParserParams: - Name: pack @@ -51,4 +52,5 @@ ParserQuery: | , ASimDnsMicrosoftNXlog (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftNXlog' in (DisabledParsers) )) , ASimDnsZscalerZIA (imDnsBuiltInDisabled or ('ExcludeASimDnsZscalerZIA' in (DisabledParsers) )) , ASimDnsNative (imDnsBuiltInDisabled or ('ExcludeASimDnsNative' in (DisabledParsers) )) - , ASimDnsVectraAI (imDnsBuiltInDisabled or ('ExcludeASimDnsVectraAI' in (DisabledParsers))) \ No newline at end of file + , ASimDnsVectraAI (imDnsBuiltInDisabled or ('ExcludeASimDnsVectraAI' in (DisabledParsers))) + , ASimDnsSentinelOne (imDnsBuiltInDisabled or ('ExcludeASimDnsSentinelOne' in (DisabledParsers))) \ No newline at end of file diff --git a/Parsers/ASimDns/Parsers/ASimDnsSentinelOne.yaml b/Parsers/ASimDns/Parsers/ASimDnsSentinelOne.yaml new file mode 100644 index 00000000000..e10ed176c74 --- /dev/null +++ b/Parsers/ASimDns/Parsers/ASimDnsSentinelOne.yaml @@ -0,0 +1,196 @@ +Parser: + Title: DNS activity ASIM parser for SentinelOne + Version: '0.1.0' + LastUpdated: Jun 28 2023 +Product: + Name: SentinelOne +Normalization: + Schema: Dns + Version: '0.1.7' +References: +- Title: ASIM DNS Schema + Link: https://aka.ms/ASimDnsDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: SentinelOne Documentation + Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM DNS normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: ASimDnsSentinelOne +EquivalentBuiltInParser: _ASim_Dns_SentinelOne +ParserParams: + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let ThreatConfidenceLookup_undefined = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_undefined: int + ) + [ + "FALSE_POSITIVE", 5, + "Undefined", 15, + "SUSPICIOUS", 25, + "TRUE_POSITIVE", 33 + ]; + let ThreatConfidenceLookup_suspicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_suspicious: int + ) + [ + "FALSE_POSITIVE", 40, + "Undefined", 50, + "SUSPICIOUS", 60, + "TRUE_POSITIVE", 67 + ]; + let ThreatConfidenceLookup_malicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_malicious: int + ) + [ + "FALSE_POSITIVE", 75, + "Undefined", 80, + "SUSPICIOUS", 90, + "TRUE_POSITIVE", 100 + ]; + let parser = (disabled: bool=false) { + let alldata = SentinelOne_CL + | where not(disabled) + and event_name_s == "Alerts." + and alertInfo_eventType_s == "DNS" + | parse alertInfo_dnsResponse_s with * "type: " DnsQueryType: int " " RestMessage; + let undefineddata = alldata + | where ruleInfo_treatAsThreat_s == "UNDEFINED" + | lookup ThreatConfidenceLookup_undefined on alertInfo_analystVerdict_s; + let suspiciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Suspicious" + | lookup ThreatConfidenceLookup_suspicious on alertInfo_analystVerdict_s; + let maaliciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Malicious" + | lookup ThreatConfidenceLookup_malicious on alertInfo_analystVerdict_s; + union undefineddata, suspiciousdata, maaliciousdata + | extend + DnsResponseCode = case( + alertInfo_dnsResponse_s has "NoError" or alertInfo_dnsResponse_s has "No Error", + int(0), + alertInfo_dnsResponse_s has "FormErr" or alertInfo_dnsResponse_s has "Format Error", + int(1), + alertInfo_dnsResponse_s has "ServFail" or alertInfo_dnsResponse_s has "Server Failure", + int(2), + alertInfo_dnsResponse_s has "NXDomain" or alertInfo_dnsResponse_s has "Non-Existent Domain", + int(3), + alertInfo_dnsResponse_s has "NotImp" or alertInfo_dnsResponse_s has "Not Implemented", + int(4), + alertInfo_dnsResponse_s has "Refused" or alertInfo_dnsResponse_s has "Query Refused", + int(5), + alertInfo_dnsResponse_s has "YXDomain" or alertInfo_dnsResponse_s has "Name Exists when it should not", + int(6), + alertInfo_dnsResponse_s has "YXRRSet" or alertInfo_dnsResponse_s has "RR Set Exists when it should not", + int(7), + alertInfo_dnsResponse_s has "NXRRSet" or alertInfo_dnsResponse_s has "RR Set that should exist does not", + int(8), + alertInfo_dnsResponse_s has "NotAuth" or alertInfo_dnsResponse_s has "Server Not Authoritative for zone", + int(9), + alertInfo_dnsResponse_s has "NotAuth" or alertInfo_dnsResponse_s has "Not Authorized", + int(9), + alertInfo_dnsResponse_s has "NotZone" or alertInfo_dnsResponse_s has "Name not contained in zone", + int(10), + alertInfo_dnsResponse_s has "DSOTYPENI" or alertInfo_dnsResponse_s has "DSO-TYPE Not Implemented", + int(11), + alertInfo_dnsResponse_s has "Unassigned", + int(12), + alertInfo_dnsResponse_s has "BADVERS" or alertInfo_dnsResponse_s has "Bad OPT Version", + int(16), + alertInfo_dnsResponse_s has "BADSIG" or alertInfo_dnsResponse_s has "TSIG Signature Failure", + int(16), + alertInfo_dnsResponse_s has "BADKEY" or alertInfo_dnsResponse_s has "Key not recognized", + int(17), + alertInfo_dnsResponse_s has "BADTIME" or alertInfo_dnsResponse_s has "Signature out of time window", + int(18), + alertInfo_dnsResponse_s has "BADMODE" or alertInfo_dnsResponse_s has "Bad TKEY Mode", + int(19), + alertInfo_dnsResponse_s has "BADNAME" or alertInfo_dnsResponse_s has "Duplicate key name", + int(20), + alertInfo_dnsResponse_s has "BADALG" or alertInfo_dnsResponse_s has "Algorithm not supported", + int(21), + alertInfo_dnsResponse_s has "BADTRUNC" or alertInfo_dnsResponse_s has "Bad Truncation", + int(22), + alertInfo_dnsResponse_s has "BADCOOKIE" or alertInfo_dnsResponse_s has "Bad/missing Server Cookie", + int(23), + int(0) + ), + AdditionalFields = bag_pack( + "MachineType", + agentDetectionInfo_machineType_s, + "OsRevision", + agentDetectionInfo_osRevision_s + ) + | extend + DnsQueryType = iff(isempty(DnsQueryType) and DnsResponseCode == 0, int(1), DnsQueryType), + ThreatConfidence = coalesce(ThreatConfidence_undefined, ThreatConfidence_suspicious, ThreatConfidence_malicious) + | project-rename + EventStartTime = sourceProcessInfo_pidStarttime_t, + DnsQuery = alertInfo_dnsRequest_s, + EventUid = _ItemId, + DnsResponseName = alertInfo_dnsResponse_s, + DvcId = agentDetectionInfo_uuid_g, + DvcOs = agentDetectionInfo_osName_s, + DvcOsVersion = agentDetectionInfo_osRevision_s, + EventOriginalType = alertInfo_eventType_s, + EventOriginalSeverity = ruleInfo_severity_s, + EventOriginalUid = alertInfo_dvEventId_s, + RuleName = ruleInfo_name_s, + SrcProcessId = sourceProcessInfo_pid_s, + SrcProcessName = sourceProcessInfo_name_s, + SrcUsername = sourceProcessInfo_user_s, + ThreatOriginalConfidence = ruleInfo_treatAsThreat_s + | invoke _ASIM_ResolveDvcFQDN('agentDetectionInfo_name_s') + | extend + Dvc = DvcId, + EventEndTime = EventStartTime, + EventResult = iff(DnsResponseCode == 0, "Success", "Failure"), + EventResultDetails = _ASIM_LookupDnsResponseCode(DnsResponseCode), + EventSubType = iff(isnotempty(DnsResponseName), "Response", "Request"), + EventOriginalResultDetails = DnsResponseCode, + DnsQueryTypeName = _ASIM_LookupDnsQueryType(DnsQueryType), + Rule = RuleName, + SrcDvcId = DvcId, + SrcHostname = DvcHostname, + EventSeverity = iff(EventOriginalSeverity == "Critical", "High", EventOriginalSeverity), + Domain = DnsQuery, + Process = SrcProcessName, + User = SrcUsername, + SrcUsernameType = _ASIM_GetUsernameType(SrcUsername), + SrcUserType = _ASIM_GetUserType(SrcUsername, "") + | extend + Src = SrcHostname, + Hostname = SrcHostname, + DnsResponseCodeName = EventResultDetails, + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + SrcDvcIdType = iff(isnotempty(SrcDvcId), "Other", "") + | extend + EventCount = int(1), + EventProduct = "SentinelOne", + EventSchema = "Dns", + EventSchemaVersion = "0.1.7", + EventType = "Query", + EventVendor = "SentinelOne", + DnsQueryClassName = "IN", + DnsQueryClass = int(1) + | project-away + *_d, + *_s, + *_g, + *_t, + *_b, + RestMessage, + _ResourceId, + TenantId, + RawData, + Computer, + MG, + ManagementGroupName, + SourceSystem, + ThreatConfidence_* + }; + parser(disabled = disabled) \ No newline at end of file diff --git a/Parsers/ASimDns/Parsers/imDns.yaml b/Parsers/ASimDns/Parsers/imDns.yaml index d6e5f45d26d..ad93f755ed2 100644 --- a/Parsers/ASimDns/Parsers/imDns.yaml +++ b/Parsers/ASimDns/Parsers/imDns.yaml @@ -61,6 +61,7 @@ ParserQuery: | , vimDnsZscalerZIA ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsZscalerZIA' in (DisabledParsers) ))) , vimDnsNative ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsNative' in (DisabledParsers) ))) , vimDnsVectraAI ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsVectraAI' in (DisabledParsers) ))) + , vimDnsSentinelOne ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsSentinelOne' in (DisabledParsers) ))) }; Generic( starttime=starttime, endtime=endtime, srcipaddr=srcipaddr, domain_has_any=domain_has_any, responsecodename=responsecodename, response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix, eventtype=eventtype, pack=pack) @@ -78,3 +79,4 @@ Parsers: - _Im_Dns_ZscalerZIA - _Im_Dns_Native - _Im_Dns_VectraAI + - _Im_Dns_SentinelOne diff --git a/Parsers/ASimDns/Parsers/vimDnsSentinelOne.yaml b/Parsers/ASimDns/Parsers/vimDnsSentinelOne.yaml new file mode 100644 index 00000000000..fd5c3af9159 --- /dev/null +++ b/Parsers/ASimDns/Parsers/vimDnsSentinelOne.yaml @@ -0,0 +1,248 @@ +Parser: + Title: DNS activity ASIM parser for SentinelOne + Version: '0.1.0' + LastUpdated: Jun 28 2023 +Product: + Name: SentinelOne +Normalization: + Schema: Dns + Version: '0.1.7' +References: +- Title: ASIM DNS Schema + Link: https://aka.ms/ASimDnsDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: SentinelOne Documentation + Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM DNS normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: vimDnsSentinelOne +EquivalentBuiltInParser: _Im_Dns_SentinelOne +ParserParams: + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: srcipaddr + Type: string + Default: '*' + - Name: domain_has_any + Type: dynamic + Default: dynamic([]) + - Name: responsecodename + Type: string + Default: '*' + - Name: response_has_ipv4 + Type: string + Default: '*' + - Name: response_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: eventtype + Type: string + Default: 'Query' + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let ThreatConfidenceLookup_undefined = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_undefined: int + ) + [ + "FALSE_POSITIVE", 5, + "Undefined", 15, + "SUSPICIOUS", 25, + "TRUE_POSITIVE", 33 + ]; + let ThreatConfidenceLookup_suspicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_suspicious: int + ) + [ + "FALSE_POSITIVE", 40, + "Undefined", 50, + "SUSPICIOUS", 60, + "TRUE_POSITIVE", 67 + ]; + let ThreatConfidenceLookup_malicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_malicious: int + ) + [ + "FALSE_POSITIVE", 75, + "Undefined", 80, + "SUSPICIOUS", 90, + "TRUE_POSITIVE", 100 + ]; + let parser = ( + starttime: datetime=datetime(null), + endtime: datetime=datetime(null), + srcipaddr: string='*', + domain_has_any: dynamic=dynamic([]), + responsecodename: string='*', + response_has_ipv4: string='*', + response_has_any_prefix: dynamic=dynamic([]), + eventtype: string='Query', + disabled: bool=false + ) { + let alldata = SentinelOne_CL + | where not(disabled) + and (eventtype == '*' or eventtype == "Query") + and (isnull(starttime) or TimeGenerated >= starttime) + and (isnull(endtime) or TimeGenerated <= endtime) + and event_name_s == "Alerts." + and alertInfo_eventType_s == "DNS" + and srcipaddr == '*' + and (array_length(domain_has_any) == 0 or alertInfo_dnsRequest_s has_any (domain_has_any)) + and (response_has_ipv4 == '*' or has_ipv4(alertInfo_dnsResponse_s, response_has_ipv4)) + and (array_length(response_has_any_prefix) == 0 or has_any_ipv4_prefix(alertInfo_dnsResponse_s, response_has_any_prefix)) + | parse alertInfo_dnsResponse_s with * "type: " DnsQueryType: int " " RestMessage; + let undefineddata = alldata + | where ruleInfo_treatAsThreat_s == "UNDEFINED" + | lookup ThreatConfidenceLookup_undefined on alertInfo_analystVerdict_s; + let suspiciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Suspicious" + | lookup ThreatConfidenceLookup_suspicious on alertInfo_analystVerdict_s; + let maaliciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Malicious" + | lookup ThreatConfidenceLookup_malicious on alertInfo_analystVerdict_s; + union undefineddata, suspiciousdata, maaliciousdata + | extend + DnsResponseCode = case( + alertInfo_dnsResponse_s has "NoError" or alertInfo_dnsResponse_s has "No Error", + int(0), + alertInfo_dnsResponse_s has "FormErr" or alertInfo_dnsResponse_s has "Format Error", + int(1), + alertInfo_dnsResponse_s has "ServFail" or alertInfo_dnsResponse_s has "Server Failure", + int(2), + alertInfo_dnsResponse_s has "NXDomain" or alertInfo_dnsResponse_s has "Non-Existent Domain", + int(3), + alertInfo_dnsResponse_s has "NotImp" or alertInfo_dnsResponse_s has "Not Implemented", + int(4), + alertInfo_dnsResponse_s has "Refused" or alertInfo_dnsResponse_s has "Query Refused", + int(5), + alertInfo_dnsResponse_s has "YXDomain" or alertInfo_dnsResponse_s has "Name Exists when it should not", + int(6), + alertInfo_dnsResponse_s has "YXRRSet" or alertInfo_dnsResponse_s has "RR Set Exists when it should not", + int(7), + alertInfo_dnsResponse_s has "NXRRSet" or alertInfo_dnsResponse_s has "RR Set that should exist does not", + int(8), + alertInfo_dnsResponse_s has "NotAuth" or alertInfo_dnsResponse_s has "Server Not Authoritative for zone", + int(9), + alertInfo_dnsResponse_s has "NotAuth" or alertInfo_dnsResponse_s has "Not Authorized", + int(9), + alertInfo_dnsResponse_s has "NotZone" or alertInfo_dnsResponse_s has "Name not contained in zone", + int(10), + alertInfo_dnsResponse_s has "DSOTYPENI" or alertInfo_dnsResponse_s has "DSO-TYPE Not Implemented", + int(11), + alertInfo_dnsResponse_s has "Unassigned", + int(12), + alertInfo_dnsResponse_s has "BADVERS" or alertInfo_dnsResponse_s has "Bad OPT Version", + int(16), + alertInfo_dnsResponse_s has "BADSIG" or alertInfo_dnsResponse_s has "TSIG Signature Failure", + int(16), + alertInfo_dnsResponse_s has "BADKEY" or alertInfo_dnsResponse_s has "Key not recognized", + int(17), + alertInfo_dnsResponse_s has "BADTIME" or alertInfo_dnsResponse_s has "Signature out of time window", + int(18), + alertInfo_dnsResponse_s has "BADMODE" or alertInfo_dnsResponse_s has "Bad TKEY Mode", + int(19), + alertInfo_dnsResponse_s has "BADNAME" or alertInfo_dnsResponse_s has "Duplicate key name", + int(20), + alertInfo_dnsResponse_s has "BADALG" or alertInfo_dnsResponse_s has "Algorithm not supported", + int(21), + alertInfo_dnsResponse_s has "BADTRUNC" or alertInfo_dnsResponse_s has "Bad Truncation", + int(22), + alertInfo_dnsResponse_s has "BADCOOKIE" or alertInfo_dnsResponse_s has "Bad/missing Server Cookie", + int(23), + int(0) + ), + AdditionalFields = bag_pack( + "MachineType", + agentDetectionInfo_machineType_s, + "OsRevision", + agentDetectionInfo_osRevision_s + ) + | extend EventResultDetails = _ASIM_LookupDnsResponseCode(DnsResponseCode) + | where (responsecodename == '*' or EventResultDetails =~ responsecodename) + | extend + DnsQueryType = iff(isempty(DnsQueryType) and DnsResponseCode == 0, int(1), DnsQueryType), + ThreatConfidence = coalesce(ThreatConfidence_undefined, ThreatConfidence_suspicious, ThreatConfidence_malicious) + | project-rename + EventStartTime = sourceProcessInfo_pidStarttime_t, + DnsQuery = alertInfo_dnsRequest_s, + EventUid = _ItemId, + DnsResponseName = alertInfo_dnsResponse_s, + DvcId = agentDetectionInfo_uuid_g, + DvcOs = agentDetectionInfo_osName_s, + DvcOsVersion = agentDetectionInfo_osRevision_s, + EventOriginalType = alertInfo_eventType_s, + EventOriginalSeverity = ruleInfo_severity_s, + EventOriginalUid = alertInfo_dvEventId_s, + RuleName = ruleInfo_name_s, + SrcProcessId = sourceProcessInfo_pid_s, + SrcProcessName = sourceProcessInfo_name_s, + SrcUsername = sourceProcessInfo_user_s, + ThreatOriginalConfidence = ruleInfo_treatAsThreat_s + | invoke _ASIM_ResolveDvcFQDN('agentDetectionInfo_name_s') + | extend + Dvc = DvcId, + EventEndTime = EventStartTime, + EventResult = iff(DnsResponseCode == 0, "Success", "Failure"), + EventSubType = iff(isnotempty(DnsResponseName), "Response", "Request"), + EventOriginalResultDetails = DnsResponseCode, + DnsQueryTypeName = _ASIM_LookupDnsQueryType(DnsQueryType), + Rule = RuleName, + SrcDvcId = DvcId, + SrcHostname = DvcHostname, + EventSeverity = iff(EventOriginalSeverity == "Critical", "High", EventOriginalSeverity), + Domain = DnsQuery, + Process = SrcProcessName, + User = SrcUsername, + SrcUsernameType = _ASIM_GetUsernameType(SrcUsername), + SrcUserType = _ASIM_GetUserType(SrcUsername, "") + | extend + Src = SrcHostname, + Hostname = SrcHostname, + DnsResponseCodeName = EventResultDetails, + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + SrcDvcIdType = iff(isnotempty(SrcDvcId), "Other", "") + | extend + EventCount = int(1), + EventProduct = "SentinelOne", + EventSchema = "Dns", + EventSchemaVersion = "0.1.7", + EventType = "Query", + EventVendor = "SentinelOne", + DnsQueryClassName = "IN", + DnsQueryClass = int(1) + | project-away + *_d, + *_s, + *_g, + *_t, + *_b, + RestMessage, + _ResourceId, + TenantId, + RawData, + Computer, + MG, + ManagementGroupName, + SourceSystem, + ThreatConfidence_* + }; + parser( + starttime=starttime, + endtime=endtime, + srcipaddr=srcipaddr, + domain_has_any=domain_has_any, + responsecodename=responsecodename, + response_has_ipv4=response_has_ipv4, + response_has_any_prefix=response_has_any_prefix, + eventtype=eventtype, + disabled=disabled + ) \ No newline at end of file diff --git a/Parsers/ASimDns/Tests/SentinelOne_ASimDns_DataTest.csv b/Parsers/ASimDns/Tests/SentinelOne_ASimDns_DataTest.csv new file mode 100644 index 00000000000..631e29bb892 --- /dev/null +++ b/Parsers/ASimDns/Tests/SentinelOne_ASimDns_DataTest.csv @@ -0,0 +1,5 @@ +Result +"(0) Error: 1 invalid value(s) (up to 10 listed) in 692 records (100.0%) for field [EventProduct] of type [Enumerated]: [""SentinelOne""] (Schema:Dns)" +"(0) Error: 1 invalid value(s) (up to 10 listed) in 692 records (100.0%) for field [EventVendor] of type [Enumerated]: [""SentinelOne""] (Schema:Dns)" +"(2) Info: Empty value in 692 records (100.0%) in optional field [DvcFQDN] (Schema:Dns)" +"(2) Info: Empty value in 692 records (100.0%) in recommended field [DvcDomain] (Schema:Dns)" diff --git a/Parsers/ASimDns/Tests/SentinelOne_ASimDns_SchemaTest.csv b/Parsers/ASimDns/Tests/SentinelOne_ASimDns_SchemaTest.csv new file mode 100644 index 00000000000..71eb261f19b --- /dev/null +++ b/Parsers/ASimDns/Tests/SentinelOne_ASimDns_SchemaTest.csv @@ -0,0 +1,95 @@ +Result +"(1) Warning: Missing recommended field [Dst]" +"(1) Warning: Missing recommended field [DvcIpAddr]" +"(1) Warning: Missing recommended field [SrcDomain]" +"(1) Warning: Missing recommended field [SrcIpAddr]" +"(1) Warning: Missing recommended field [TransactionIdHex]" +"(2) Info: Missing optional alias [DomainCategory] aliasing non-existent column [UrlCategory]" +"(2) Info: Missing optional alias [Duration] aliasing non-existent column [DnsNetworkDuration]" +"(2) Info: Missing optional alias [SessionId] aliasing non-existent column [DnsSessionId]" +"(2) Info: Missing optional field [DnsFlagsAuthenticated]" +"(2) Info: Missing optional field [DnsFlagsAuthoritative]" +"(2) Info: Missing optional field [DnsFlagsCheckingDisabled]" +"(2) Info: Missing optional field [DnsFlagsRecursionAvailable]" +"(2) Info: Missing optional field [DnsFlagsRecursionDesired]" +"(2) Info: Missing optional field [DnsFlagsTruncated]" +"(2) Info: Missing optional field [DnsFlagsZ]" +"(2) Info: Missing optional field [DnsFlags]" +"(2) Info: Missing optional field [DnsNetworkDuration]" +"(2) Info: Missing optional field [DnsResponseIpCity]" +"(2) Info: Missing optional field [DnsResponseIpCountry]" +"(2) Info: Missing optional field [DnsResponseIpLatitude]" +"(2) Info: Missing optional field [DnsResponseIpLongitude]" +"(2) Info: Missing optional field [DnsResponseIpRegion]" +"(2) Info: Missing optional field [DnsSessionId]" +"(2) Info: Missing optional field [DstDescription]" +"(2) Info: Missing optional field [DstDeviceType]" +"(2) Info: Missing optional field [DstDomain]" +"(2) Info: Missing optional field [DstDvcId]" +"(2) Info: Missing optional field [DstDvcScopeId]" +"(2) Info: Missing optional field [DstDvcScope]" +"(2) Info: Missing optional field [DstFQDN]" +"(2) Info: Missing optional field [DstGeoCity]" +"(2) Info: Missing optional field [DstGeoCountry]" +"(2) Info: Missing optional field [DstGeoLatitude]" +"(2) Info: Missing optional field [DstGeoLongitude]" +"(2) Info: Missing optional field [DstGeoRegion]" +"(2) Info: Missing optional field [DstHostname]" +"(2) Info: Missing optional field [DstIpAddr]" +"(2) Info: Missing optional field [DstOriginalRiskLevel]" +"(2) Info: Missing optional field [DstPortNumber]" +"(2) Info: Missing optional field [DstRiskLevel]" +"(2) Info: Missing optional field [DvcAction]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EventMessage]" +"(2) Info: Missing optional field [EventOriginalSubType]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [NetworkProtocolVersion]" +"(2) Info: Missing optional field [NetworkProtocol]" +"(2) Info: Missing optional field [RuleNumber]" +"(2) Info: Missing optional field [SrcDescription]" +"(2) Info: Missing optional field [SrcDeviceType]" +"(2) Info: Missing optional field [SrcDvcScopeId]" +"(2) Info: Missing optional field [SrcDvcScope]" +"(2) Info: Missing optional field [SrcFQDN]" +"(2) Info: Missing optional field [SrcGeoCity]" +"(2) Info: Missing optional field [SrcGeoCountry]" +"(2) Info: Missing optional field [SrcGeoLatitude]" +"(2) Info: Missing optional field [SrcGeoLongitude]" +"(2) Info: Missing optional field [SrcGeoRegion]" +"(2) Info: Missing optional field [SrcOriginalRiskLevel]" +"(2) Info: Missing optional field [SrcOriginalUserType]" +"(2) Info: Missing optional field [SrcPortNumber]" +"(2) Info: Missing optional field [SrcProcessGuid]" +"(2) Info: Missing optional field [SrcRiskLevel]" +"(2) Info: Missing optional field [SrcUserAWSId]" +"(2) Info: Missing optional field [SrcUserAadId]" +"(2) Info: Missing optional field [SrcUserId]" +"(2) Info: Missing optional field [SrcUserOktaId]" +"(2) Info: Missing optional field [SrcUserScopeId]" +"(2) Info: Missing optional field [SrcUserScope]" +"(2) Info: Missing optional field [SrcUserSessionId]" +"(2) Info: Missing optional field [SrcUserSid]" +"(2) Info: Missing optional field [SrcUserUid]" +"(2) Info: Missing optional field [TenantId]" +"(2) Info: Missing optional field [ThreatCategory]" +"(2) Info: Missing optional field [ThreatField]" +"(2) Info: Missing optional field [ThreatFirstReportedTime]" +"(2) Info: Missing optional field [ThreatId]" +"(2) Info: Missing optional field [ThreatIpAddr]" +"(2) Info: Missing optional field [ThreatIsActive]" +"(2) Info: Missing optional field [ThreatLastReportedTime]" +"(2) Info: Missing optional field [ThreatName]" +"(2) Info: Missing optional field [ThreatOriginalRiskLevel]" +"(2) Info: Missing optional field [ThreatRiskLevel]" +"(2) Info: Missing optional field [UrlCategory]" +"(2) Info: Missing recommended alias [IpAddr] aliasing non-existent column [SrcIpAddr]" +"(2) Info: extra unnormalized column [EventOriginalResultDetails]" diff --git a/Parsers/ASimDns/Tests/SentinelOne_vimDns_DataTest.csv b/Parsers/ASimDns/Tests/SentinelOne_vimDns_DataTest.csv new file mode 100644 index 00000000000..631e29bb892 --- /dev/null +++ b/Parsers/ASimDns/Tests/SentinelOne_vimDns_DataTest.csv @@ -0,0 +1,5 @@ +Result +"(0) Error: 1 invalid value(s) (up to 10 listed) in 692 records (100.0%) for field [EventProduct] of type [Enumerated]: [""SentinelOne""] (Schema:Dns)" +"(0) Error: 1 invalid value(s) (up to 10 listed) in 692 records (100.0%) for field [EventVendor] of type [Enumerated]: [""SentinelOne""] (Schema:Dns)" +"(2) Info: Empty value in 692 records (100.0%) in optional field [DvcFQDN] (Schema:Dns)" +"(2) Info: Empty value in 692 records (100.0%) in recommended field [DvcDomain] (Schema:Dns)" diff --git a/Parsers/ASimDns/Tests/SentinelOne_vimDns_SchemaTest.csv b/Parsers/ASimDns/Tests/SentinelOne_vimDns_SchemaTest.csv new file mode 100644 index 00000000000..71eb261f19b --- /dev/null +++ b/Parsers/ASimDns/Tests/SentinelOne_vimDns_SchemaTest.csv @@ -0,0 +1,95 @@ +Result +"(1) Warning: Missing recommended field [Dst]" +"(1) Warning: Missing recommended field [DvcIpAddr]" +"(1) Warning: Missing recommended field [SrcDomain]" +"(1) Warning: Missing recommended field [SrcIpAddr]" +"(1) Warning: Missing recommended field [TransactionIdHex]" +"(2) Info: Missing optional alias [DomainCategory] aliasing non-existent column [UrlCategory]" +"(2) Info: Missing optional alias [Duration] aliasing non-existent column [DnsNetworkDuration]" +"(2) Info: Missing optional alias [SessionId] aliasing non-existent column [DnsSessionId]" +"(2) Info: Missing optional field [DnsFlagsAuthenticated]" +"(2) Info: Missing optional field [DnsFlagsAuthoritative]" +"(2) Info: Missing optional field [DnsFlagsCheckingDisabled]" +"(2) Info: Missing optional field [DnsFlagsRecursionAvailable]" +"(2) Info: Missing optional field [DnsFlagsRecursionDesired]" +"(2) Info: Missing optional field [DnsFlagsTruncated]" +"(2) Info: Missing optional field [DnsFlagsZ]" +"(2) Info: Missing optional field [DnsFlags]" +"(2) Info: Missing optional field [DnsNetworkDuration]" +"(2) Info: Missing optional field [DnsResponseIpCity]" +"(2) Info: Missing optional field [DnsResponseIpCountry]" +"(2) Info: Missing optional field [DnsResponseIpLatitude]" +"(2) Info: Missing optional field [DnsResponseIpLongitude]" +"(2) Info: Missing optional field [DnsResponseIpRegion]" +"(2) Info: Missing optional field [DnsSessionId]" +"(2) Info: Missing optional field [DstDescription]" +"(2) Info: Missing optional field [DstDeviceType]" +"(2) Info: Missing optional field [DstDomain]" +"(2) Info: Missing optional field [DstDvcId]" +"(2) Info: Missing optional field [DstDvcScopeId]" +"(2) Info: Missing optional field [DstDvcScope]" +"(2) Info: Missing optional field [DstFQDN]" +"(2) Info: Missing optional field [DstGeoCity]" +"(2) Info: Missing optional field [DstGeoCountry]" +"(2) Info: Missing optional field [DstGeoLatitude]" +"(2) Info: Missing optional field [DstGeoLongitude]" +"(2) Info: Missing optional field [DstGeoRegion]" +"(2) Info: Missing optional field [DstHostname]" +"(2) Info: Missing optional field [DstIpAddr]" +"(2) Info: Missing optional field [DstOriginalRiskLevel]" +"(2) Info: Missing optional field [DstPortNumber]" +"(2) Info: Missing optional field [DstRiskLevel]" +"(2) Info: Missing optional field [DvcAction]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EventMessage]" +"(2) Info: Missing optional field [EventOriginalSubType]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [NetworkProtocolVersion]" +"(2) Info: Missing optional field [NetworkProtocol]" +"(2) Info: Missing optional field [RuleNumber]" +"(2) Info: Missing optional field [SrcDescription]" +"(2) Info: Missing optional field [SrcDeviceType]" +"(2) Info: Missing optional field [SrcDvcScopeId]" +"(2) Info: Missing optional field [SrcDvcScope]" +"(2) Info: Missing optional field [SrcFQDN]" +"(2) Info: Missing optional field [SrcGeoCity]" +"(2) Info: Missing optional field [SrcGeoCountry]" +"(2) Info: Missing optional field [SrcGeoLatitude]" +"(2) Info: Missing optional field [SrcGeoLongitude]" +"(2) Info: Missing optional field [SrcGeoRegion]" +"(2) Info: Missing optional field [SrcOriginalRiskLevel]" +"(2) Info: Missing optional field [SrcOriginalUserType]" +"(2) Info: Missing optional field [SrcPortNumber]" +"(2) Info: Missing optional field [SrcProcessGuid]" +"(2) Info: Missing optional field [SrcRiskLevel]" +"(2) Info: Missing optional field [SrcUserAWSId]" +"(2) Info: Missing optional field [SrcUserAadId]" +"(2) Info: Missing optional field [SrcUserId]" +"(2) Info: Missing optional field [SrcUserOktaId]" +"(2) Info: Missing optional field [SrcUserScopeId]" +"(2) Info: Missing optional field [SrcUserScope]" +"(2) Info: Missing optional field [SrcUserSessionId]" +"(2) Info: Missing optional field [SrcUserSid]" +"(2) Info: Missing optional field [SrcUserUid]" +"(2) Info: Missing optional field [TenantId]" +"(2) Info: Missing optional field [ThreatCategory]" +"(2) Info: Missing optional field [ThreatField]" +"(2) Info: Missing optional field [ThreatFirstReportedTime]" +"(2) Info: Missing optional field [ThreatId]" +"(2) Info: Missing optional field [ThreatIpAddr]" +"(2) Info: Missing optional field [ThreatIsActive]" +"(2) Info: Missing optional field [ThreatLastReportedTime]" +"(2) Info: Missing optional field [ThreatName]" +"(2) Info: Missing optional field [ThreatOriginalRiskLevel]" +"(2) Info: Missing optional field [ThreatRiskLevel]" +"(2) Info: Missing optional field [UrlCategory]" +"(2) Info: Missing recommended alias [IpAddr] aliasing non-existent column [SrcIpAddr]" +"(2) Info: extra unnormalized column [EventOriginalResultDetails]" diff --git a/Parsers/ASimFileEvent/Parsers/ASimFileEvent.yaml b/Parsers/ASimFileEvent/Parsers/ASimFileEvent.yaml new file mode 100644 index 00000000000..442b1aa5fe2 --- /dev/null +++ b/Parsers/ASimFileEvent/Parsers/ASimFileEvent.yaml @@ -0,0 +1,37 @@ +Parser: + Title: File event ASIM parser + Version: '0.1.0' + LastUpdated: Sep 20, 2023 +Product: + Name: Source agnostic +Normalization: + Schema: FileEvent + Version: '0.1.0' +References: +- Title: ASIM File Event Schema + Link: https://aka.ms/ASimFileEventDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +Description: | + This ASIM parser supports normalizing File activity logs from all supported sources to the ASIM File Event normalized schema. +ParserName: ASimFileEvent +EquivalentBuiltInParser: _ASim_FileEvent +Parsers: + - _Im_FileEvent_Empty + - _ASim_FileEvent_LinuxSysmonFileCreated + - _ASim_FileEvent_LinuxSysmonFileDeleted + - _ASim_FileEvent_AzureBlobStorage + - _ASim_FileEvent_M365D + - _ASim_FileEvent_AzureFileStorage + - _ASim_FileEvent_AzureQueueStorage + - _ASim_FileEvent_MicrosoftSharePoint + - _ASim_FileEvent_MicrosoftSysmon + - _ASim_FileEvent_AzureTableStorage + - _ASim_FileEvent_MicrosoftWindowsEvent + - _ASim_FileEvent_Native + - _ASim_FileEvent_SentinelOne +ParserQuery: | + union isfuzzy=true + vimFileEventEmpty, + ASimFileEventSentinelOne + diff --git a/Parsers/ASimFileEvent/Parsers/ASimFileEventSentinelOne.yaml b/Parsers/ASimFileEvent/Parsers/ASimFileEventSentinelOne.yaml new file mode 100644 index 00000000000..c8cdb6822fa --- /dev/null +++ b/Parsers/ASimFileEvent/Parsers/ASimFileEventSentinelOne.yaml @@ -0,0 +1,161 @@ +Parser: + Title: File Event Parser for SentinelOne + Version: '0.1.0' + LastUpdated: Sep 20, 2023 +Product: + Name: SentinelOne +Normalization: + Schema: FileEvent + Version: '0.2.1' +References: +- Title: ASIM File Event Schema + Link: https://aka.ms/ASimFileEventDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: SentinelOne Documentation +- Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM File Event normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: ASimFileEventSentinelOne +EquivalentBuiltInParser: _ASim_FileEvent_SentinelOne +ParserParams: + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let GetWindowsFilenamePart = (path: string) { tostring(split(path, @'\')[-1]) }; + let GetLinuxFilenamePart = (path: string) { tostring(split(path, @'/')[-1]) }; + let EventTypeLookup = datatable (alertInfo_eventType_s: string, EventType: string) + [ + "FILECREATION", "FileCreated", + "FILEMODIFICATION", "FileModified", + "FILEDELETION", "FileDeleted", + "FILERENAME", "FileRenamed" + ]; + let ThreatConfidenceLookup_undefined = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_undefined: int + ) + [ + "FALSE_POSITIVE", 5, + "Undefined", 15, + "SUSPICIOUS", 25, + "TRUE_POSITIVE", 33 + ]; + let ThreatConfidenceLookup_suspicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_suspicious: int + ) + [ + "FALSE_POSITIVE", 40, + "Undefined", 50, + "SUSPICIOUS", 60, + "TRUE_POSITIVE", 67 + ]; + let ThreatConfidenceLookup_malicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_malicious: int + ) + [ + "FALSE_POSITIVE", 75, + "Undefined", 80, + "SUSPICIOUS", 90, + "TRUE_POSITIVE", 100 + ]; + let parser = (disabled: bool=false) { + let allFileData = SentinelOne_CL + | where not(disabled) + and event_name_s == "Alerts." + and alertInfo_eventType_s in ('FILECREATION', 'FILEMODIFICATION', 'FILEDELETION', 'FILERENAME'); + let windowsFileData = allFileData + | where agentDetectionInfo_osFamily_s == "windows" + | extend + TargetFilePathType = "Windows Local", + TargetFileName = GetWindowsFilenamePart(targetProcessInfo_tgtFilePath_s), + SrcFileName = GetWindowsFilenamePart(targetProcessInfo_tgtFileOldPath_s); + let otherFileData = allFileData + | where agentDetectionInfo_osFamily_s != "windows" + | extend + TargetFilePathType = "Unix", + TargetFileName = GetLinuxFilenamePart(targetProcessInfo_tgtFilePath_s), + SrcFileName = GetLinuxFilenamePart(targetProcessInfo_tgtFileOldPath_s); + let parseddata = union windowsFileData, otherFileData + | lookup EventTypeLookup on alertInfo_eventType_s; + let undefineddata = parseddata + | where ruleInfo_treatAsThreat_s == "UNDEFINED" + | lookup ThreatConfidenceLookup_undefined on alertInfo_analystVerdict_s; + let suspiciousdata = parseddata + | where ruleInfo_treatAsThreat_s == "Suspicious" + | lookup ThreatConfidenceLookup_suspicious on alertInfo_analystVerdict_s; + let maaliciousdata = parseddata + | where ruleInfo_treatAsThreat_s == "Malicious" + | lookup ThreatConfidenceLookup_malicious on alertInfo_analystVerdict_s; + union undefineddata, suspiciousdata, maaliciousdata + | extend + ThreatConfidence = coalesce(ThreatConfidence_undefined, ThreatConfidence_suspicious, ThreatConfidence_malicious), + EventSeverity = iff(ruleInfo_severity_s == "Critical", "High", ruleInfo_severity_s), + EventVendor = "SentinelOne", + EventProduct = "SentinelOne", + EventResult = "Success", + EventSchema = "FileEvent", + EventSchemaVersion = "0.2.1", + EventCount = toint(1), + DvcAction = "Allowed", + ActorUsername = sourceProcessInfo_user_s + | project-rename + EventStartTime = sourceProcessInfo_pidStarttime_t, + EventOriginalSeverity = ruleInfo_severity_s, + EventUid = _ItemId, + ActingProcessCommandLine = sourceProcessInfo_commandline_s, + ActingProcessGuid = sourceProcessInfo_uniqueId_g, + ActingProcessId = sourceProcessInfo_pid_s, + ActingProcessName = sourceProcessInfo_name_s, + DvcId = agentDetectionInfo_uuid_g, + DvcOs = agentDetectionInfo_osName_s, + DvcOsVersion = agentDetectionInfo_osRevision_s, + EventOriginalType = alertInfo_eventType_s, + EventOriginalUid = alertInfo_dvEventId_s, + RuleName = ruleInfo_name_s, + TargetFileCreationTime = targetProcessInfo_tgtFileCreatedAt_t, + SrcFilePath = targetProcessInfo_tgtFileOldPath_s, + TargetFilePath = targetProcessInfo_tgtFilePath_s, + TargetFileSHA1 = targetProcessInfo_tgtFileHashSha1_s, + TargetFileSHA256 = targetProcessInfo_tgtFileHashSha256_s, + ThreatOriginalConfidence = ruleInfo_treatAsThreat_s + | invoke _ASIM_ResolveDvcFQDN('agentDetectionInfo_name_s') + | extend + Dvc = coalesce(DvcHostname, DvcId, EventProduct), + EventEndTime = EventStartTime, + Rule = RuleName, + FileName = TargetFileName, + FilePath = TargetFilePath, + Process = ActingProcessName, + User = ActorUsername, + Hash = coalesce(TargetFileSHA256, TargetFileSHA1) + | extend + ActorUsernameType = _ASIM_GetUsernameType(ActorUsername), + ActorUserType = _ASIM_GetUserType(ActorUsername, ""), + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + HashType = case( + isnotempty(Hash) and isnotempty(TargetFileSHA256), + "TargetFileSHA256", + isnotempty(Hash) and isnotempty(TargetFileSHA1), + "TargetFileSHA1", + "" + ) + | project-away + *_d, + *_s, + *_g, + *_t, + *_b, + _ResourceId, + Computer, + MG, + ManagementGroupName, + RawData, + SourceSystem, + TenantId, + ThreatConfidence_* + }; + parser(disabled = disabled) \ No newline at end of file diff --git a/Parsers/ASimFileEvent/Parsers/imFileEvent.yaml b/Parsers/ASimFileEvent/Parsers/imFileEvent.yaml index 95cc0aa7e7c..e8ee4a3d2f8 100644 --- a/Parsers/ASimFileEvent/Parsers/imFileEvent.yaml +++ b/Parsers/ASimFileEvent/Parsers/imFileEvent.yaml @@ -1,7 +1,7 @@ Parser: Title: ASIM Source Agnostic File Events Parser - Version: '0.1.1' + Version: '0.1.2' LastUpdated: October 26, 2022 Product: Name: Source Agnostic @@ -16,6 +16,21 @@ References: Description: | This ASIM parser supports normalizing File activity logs from all supported sources to the ASIM File Event normalized schema. ParserName: imFileEvent +EquivalentBuiltInParser: _Im_FileEvent +Parsers: + - _Im_FileEvent_Empty + - _Im_FileEvent_LinuxSysmonFileCreated + - _Im_FileEvent_LinuxSysmonFileDeleted + - _Im_FileEvent_AzureBlobStorage + - _Im_FileEvent_M365D + - _Im_FileEvent_AzureFileStorage + - _Im_FileEvent_AzureQueueStorage + - _Im_FileEvent_MicrosoftSharePoint + - _Im_FileEvent_MicrosoftSysmon + - _Im_FileEvent_AzureTableStorage + - _Im_FileEvent_MicrosoftWindowsEvent + - _Im_FileEvent_Native + - _Im_FileEvent_SentinelOne ParserQuery: | union isfuzzy=true vimFileEventEmpty, @@ -29,4 +44,5 @@ ParserQuery: | vimFileEventMicrosoftSysmon, vimFileEventAzureTableStorage, vimFileEventMicrosoftWindowsEvents, - vimFileEventNative \ No newline at end of file + vimFileEventNative, + vimFileEventSentinelOne \ No newline at end of file diff --git a/Parsers/ASimFileEvent/Parsers/vimFileEventSentinelOne.yaml b/Parsers/ASimFileEvent/Parsers/vimFileEventSentinelOne.yaml new file mode 100644 index 00000000000..defec9137fe --- /dev/null +++ b/Parsers/ASimFileEvent/Parsers/vimFileEventSentinelOne.yaml @@ -0,0 +1,161 @@ +Parser: + Title: File Event Parser for SentinelOne + Version: '0.1.0' + LastUpdated: Sep 18, 2023 +Product: + Name: SentinelOne +Normalization: + Schema: FileEvent + Version: '0.2.1' +References: +- Title: ASIM File Event Schema + Link: https://aka.ms/ASimFileEventDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: SentinelOne Documentation +- Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM File Event normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: vimFileEventSentinelOne +EquivalentBuiltInParser: _Im_FileEvent_SentinelOne +ParserParams: + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let GetWindowsFilenamePart = (path: string) { tostring(split(path, @'\')[-1]) }; + let GetLinuxFilenamePart = (path: string) { tostring(split(path, @'/')[-1]) }; + let EventTypeLookup = datatable (alertInfo_eventType_s: string, EventType: string) + [ + "FILECREATION", "FileCreated", + "FILEMODIFICATION", "FileModified", + "FILEDELETION", "FileDeleted", + "FILERENAME", "FileRenamed" + ]; + let ThreatConfidenceLookup_undefined = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_undefined: int + ) + [ + "FALSE_POSITIVE", 5, + "Undefined", 15, + "SUSPICIOUS", 25, + "TRUE_POSITIVE", 33 + ]; + let ThreatConfidenceLookup_suspicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_suspicious: int + ) + [ + "FALSE_POSITIVE", 40, + "Undefined", 50, + "SUSPICIOUS", 60, + "TRUE_POSITIVE", 67 + ]; + let ThreatConfidenceLookup_malicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_malicious: int + ) + [ + "FALSE_POSITIVE", 75, + "Undefined", 80, + "SUSPICIOUS", 90, + "TRUE_POSITIVE", 100 + ]; + let parser = (disabled: bool=false) { + let allFileData = SentinelOne_CL + | where not(disabled) + and event_name_s == "Alerts." + and alertInfo_eventType_s in ('FILECREATION', 'FILEMODIFICATION', 'FILEDELETION', 'FILERENAME'); + let windowsFileData = allFileData + | where agentDetectionInfo_osFamily_s == "windows" + | extend + TargetFilePathType = "Windows Local", + TargetFileName = GetWindowsFilenamePart(targetProcessInfo_tgtFilePath_s), + SrcFileName = GetWindowsFilenamePart(targetProcessInfo_tgtFileOldPath_s); + let otherFileData = allFileData + | where agentDetectionInfo_osFamily_s != "windows" + | extend + TargetFilePathType = "Unix", + TargetFileName = GetLinuxFilenamePart(targetProcessInfo_tgtFilePath_s), + SrcFileName = GetLinuxFilenamePart(targetProcessInfo_tgtFileOldPath_s); + let parseddata = union windowsFileData, otherFileData + | lookup EventTypeLookup on alertInfo_eventType_s; + let undefineddata = parseddata + | where ruleInfo_treatAsThreat_s == "UNDEFINED" + | lookup ThreatConfidenceLookup_undefined on alertInfo_analystVerdict_s; + let suspiciousdata = parseddata + | where ruleInfo_treatAsThreat_s == "Suspicious" + | lookup ThreatConfidenceLookup_suspicious on alertInfo_analystVerdict_s; + let maaliciousdata = parseddata + | where ruleInfo_treatAsThreat_s == "Malicious" + | lookup ThreatConfidenceLookup_malicious on alertInfo_analystVerdict_s; + union undefineddata, suspiciousdata, maaliciousdata + | extend + ThreatConfidence = coalesce(ThreatConfidence_undefined, ThreatConfidence_suspicious, ThreatConfidence_malicious), + EventSeverity = iff(ruleInfo_severity_s == "Critical", "High", ruleInfo_severity_s), + EventVendor = "SentinelOne", + EventProduct = "SentinelOne", + EventResult = "Success", + EventSchema = "FileEvent", + EventSchemaVersion = "0.2.1", + EventCount = toint(1), + DvcAction = "Allowed", + ActorUsername = sourceProcessInfo_user_s + | project-rename + EventStartTime = sourceProcessInfo_pidStarttime_t, + EventOriginalSeverity = ruleInfo_severity_s, + EventUid = _ItemId, + ActingProcessCommandLine = sourceProcessInfo_commandline_s, + ActingProcessGuid = sourceProcessInfo_uniqueId_g, + ActingProcessId = sourceProcessInfo_pid_s, + ActingProcessName = sourceProcessInfo_name_s, + DvcId = agentDetectionInfo_uuid_g, + DvcOs = agentDetectionInfo_osName_s, + DvcOsVersion = agentDetectionInfo_osRevision_s, + EventOriginalType = alertInfo_eventType_s, + EventOriginalUid = alertInfo_dvEventId_s, + RuleName = ruleInfo_name_s, + TargetFileCreationTime = targetProcessInfo_tgtFileCreatedAt_t, + SrcFilePath = targetProcessInfo_tgtFileOldPath_s, + TargetFilePath = targetProcessInfo_tgtFilePath_s, + TargetFileSHA1 = targetProcessInfo_tgtFileHashSha1_s, + TargetFileSHA256 = targetProcessInfo_tgtFileHashSha256_s, + ThreatOriginalConfidence = ruleInfo_treatAsThreat_s + | invoke _ASIM_ResolveDvcFQDN('agentDetectionInfo_name_s') + | extend + Dvc = coalesce(DvcHostname, DvcId, EventProduct), + EventEndTime = EventStartTime, + Rule = RuleName, + FileName = TargetFileName, + FilePath = TargetFilePath, + Process = ActingProcessName, + User = ActorUsername, + Hash = coalesce(TargetFileSHA256, TargetFileSHA1) + | extend + ActorUsernameType = _ASIM_GetUsernameType(ActorUsername), + ActorUserType = _ASIM_GetUserType(ActorUsername, ""), + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + HashType = case( + isnotempty(Hash) and isnotempty(TargetFileSHA256), + "TargetFileSHA256", + isnotempty(Hash) and isnotempty(TargetFileSHA1), + "TargetFileSHA1", + "" + ) + | project-away + *_d, + *_s, + *_g, + *_t, + *_b, + _ResourceId, + Computer, + MG, + ManagementGroupName, + RawData, + SourceSystem, + TenantId, + ThreatConfidence_* + }; + parser(disabled = disabled) \ No newline at end of file diff --git a/Parsers/ASimFileEvent/test/SentinelOne_ASimFileEvent_DataTest.csv b/Parsers/ASimFileEvent/test/SentinelOne_ASimFileEvent_DataTest.csv new file mode 100644 index 00000000000..07732e61062 --- /dev/null +++ b/Parsers/ASimFileEvent/test/SentinelOne_ASimFileEvent_DataTest.csv @@ -0,0 +1,13 @@ +Result +"(0) Error: 1 invalid value(s) (up to 10 listed) in 10004 records (100.0%) for field [EventProduct] of type [Enumerated]: [""SentinelOne""] (Schema:FileEvent)" +"(0) Error: 1 invalid value(s) (up to 10 listed) in 10004 records (100.0%) for field [EventVendor] of type [Enumerated]: [""SentinelOne""] (Schema:FileEvent)" +"(1) Warning: Empty value in 9932 records (99.28%) in mandatory field [ActorUsername] (Schema:FileEvent)" +"(2) Info: Empty value in 2048 records (20.47%) in optional field [TargetFileSHA1] (Schema:FileEvent)" +"(2) Info: Empty value in 24 records (0.24%) in optional field [ActingProcessName] (Schema:FileEvent)" +"(2) Info: Empty value in 6012 records (60.1%) in optional field [DvcFQDN] (Schema:FileEvent)" +"(2) Info: Empty value in 6012 records (60.1%) in recommended field [DvcDomain] (Schema:FileEvent)" +"(2) Info: Empty value in 72 records (0.72%) in optional field [ActingProcessGuid] (Schema:FileEvent)" +"(2) Info: Empty value in 9932 records (99.28%) in optional field [ActorUserType] (Schema:FileEvent)" +"(2) Info: Empty value in 9944 records (99.4%) in optional field [TargetFileSHA256] (Schema:FileEvent)" +"(2) Info: Empty value in 9999 records (99.95%) in optional field [SrcFileName] (Schema:FileEvent)" +"(2) Info: Empty value in 9999 records (99.95%) in recommended field [SrcFilePath] (Schema:FileEvent)" diff --git a/Parsers/ASimFileEvent/test/SentinelOne_ASimFileEvent_SchemaTest.csv b/Parsers/ASimFileEvent/test/SentinelOne_ASimFileEvent_SchemaTest.csv new file mode 100644 index 00000000000..b96414c0fc1 --- /dev/null +++ b/Parsers/ASimFileEvent/test/SentinelOne_ASimFileEvent_SchemaTest.csv @@ -0,0 +1,81 @@ +Result +"(1) Warning: Missing recommended field [ActorUserId]" +"(1) Warning: Missing recommended field [DvcIpAddr]" +"(1) Warning: Missing recommended field [SrcFilePathType]" +"(1) Warning: Missing recommended field [SrcIpAddr]" +"(2) Info: Missing optional alias [Application] aliasing non-existent column [TargetAppName]" +"(2) Info: Missing optional alias [Url] aliasing non-existent column [TargetUrl]" +"(2) Info: Missing optional field [ActingAppId]" +"(2) Info: Missing optional field [ActingAppName]" +"(2) Info: Missing optional field [ActingAppType]" +"(2) Info: Missing optional field [ActorOriginalUserType]" +"(2) Info: Missing optional field [ActorScopeId]" +"(2) Info: Missing optional field [ActorScope]" +"(2) Info: Missing optional field [ActorSessionId]" +"(2) Info: Missing optional field [ActorUpn]" +"(2) Info: Missing optional field [ActorUserAadId]" +"(2) Info: Missing optional field [ActorUserPuid]" +"(2) Info: Missing optional field [ActorUserSid]" +"(2) Info: Missing optional field [AdditionalFields]" +"(2) Info: Missing optional field [DstDescription]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EventMessage]" +"(2) Info: Missing optional field [EventOriginalResultDetails]" +"(2) Info: Missing optional field [EventOriginalSubType]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [EventResultDetails]" +"(2) Info: Missing optional field [EventSubType]" +"(2) Info: Missing optional field [HttpUserAgent]" +"(2) Info: Missing optional field [NetworkApplicationProtocol]" +"(2) Info: Missing optional field [RuleNumber]" +"(2) Info: Missing optional field [SrcDescription]" +"(2) Info: Missing optional field [SrcDeviceType]" +"(2) Info: Missing optional field [SrcDomain]" +"(2) Info: Missing optional field [SrcDvcId]" +"(2) Info: Missing optional field [SrcDvcScopeId]" +"(2) Info: Missing optional field [SrcDvcScope]" +"(2) Info: Missing optional field [SrcFQDN]" +"(2) Info: Missing optional field [SrcFileCreationTime]" +"(2) Info: Missing optional field [SrcFileDirectory]" +"(2) Info: Missing optional field [SrcFileExtension]" +"(2) Info: Missing optional field [SrcFileMD5]" +"(2) Info: Missing optional field [SrcFileMimeType]" +"(2) Info: Missing optional field [SrcFileSHA1]" +"(2) Info: Missing optional field [SrcFileSHA256]" +"(2) Info: Missing optional field [SrcFileSHA512]" +"(2) Info: Missing optional field [SrcFileSize]" +"(2) Info: Missing optional field [SrcGeoCity]" +"(2) Info: Missing optional field [SrcGeoCountry]" +"(2) Info: Missing optional field [SrcGeoLatitude]" +"(2) Info: Missing optional field [SrcGeoLongitude]" +"(2) Info: Missing optional field [SrcGeoRegion]" +"(2) Info: Missing optional field [SrcHostname]" +"(2) Info: Missing optional field [SrcPortNumber]" +"(2) Info: Missing optional field [Src]" +"(2) Info: Missing optional field [TargetAppId]" +"(2) Info: Missing optional field [TargetAppName]" +"(2) Info: Missing optional field [TargetFileDirectory]" +"(2) Info: Missing optional field [TargetFileExtension]" +"(2) Info: Missing optional field [TargetFileMD5]" +"(2) Info: Missing optional field [TargetFileMimeType]" +"(2) Info: Missing optional field [TargetFileSHA512]" +"(2) Info: Missing optional field [TargetFileSize]" +"(2) Info: Missing optional field [TargetUrl]" +"(2) Info: Missing optional field [ThreatCategory]" +"(2) Info: Missing optional field [ThreatFilePath]" +"(2) Info: Missing optional field [ThreatFirstReportedTime]" +"(2) Info: Missing optional field [ThreatId]" +"(2) Info: Missing optional field [ThreatIsActive]" +"(2) Info: Missing optional field [ThreatLastReportedTime]" +"(2) Info: Missing optional field [ThreatName]" +"(2) Info: Missing optional field [ThreatOriginalRiskLevel]" +"(2) Info: Missing optional field [ThreatRiskLevel]" +"(2) Info: Missing recommended alias [IpAddr] aliasing non-existent column [SrcIpAddr]" diff --git a/Parsers/ASimFileEvent/test/SentinelOne_vimFileEvent_DataTest.csv b/Parsers/ASimFileEvent/test/SentinelOne_vimFileEvent_DataTest.csv new file mode 100644 index 00000000000..07732e61062 --- /dev/null +++ b/Parsers/ASimFileEvent/test/SentinelOne_vimFileEvent_DataTest.csv @@ -0,0 +1,13 @@ +Result +"(0) Error: 1 invalid value(s) (up to 10 listed) in 10004 records (100.0%) for field [EventProduct] of type [Enumerated]: [""SentinelOne""] (Schema:FileEvent)" +"(0) Error: 1 invalid value(s) (up to 10 listed) in 10004 records (100.0%) for field [EventVendor] of type [Enumerated]: [""SentinelOne""] (Schema:FileEvent)" +"(1) Warning: Empty value in 9932 records (99.28%) in mandatory field [ActorUsername] (Schema:FileEvent)" +"(2) Info: Empty value in 2048 records (20.47%) in optional field [TargetFileSHA1] (Schema:FileEvent)" +"(2) Info: Empty value in 24 records (0.24%) in optional field [ActingProcessName] (Schema:FileEvent)" +"(2) Info: Empty value in 6012 records (60.1%) in optional field [DvcFQDN] (Schema:FileEvent)" +"(2) Info: Empty value in 6012 records (60.1%) in recommended field [DvcDomain] (Schema:FileEvent)" +"(2) Info: Empty value in 72 records (0.72%) in optional field [ActingProcessGuid] (Schema:FileEvent)" +"(2) Info: Empty value in 9932 records (99.28%) in optional field [ActorUserType] (Schema:FileEvent)" +"(2) Info: Empty value in 9944 records (99.4%) in optional field [TargetFileSHA256] (Schema:FileEvent)" +"(2) Info: Empty value in 9999 records (99.95%) in optional field [SrcFileName] (Schema:FileEvent)" +"(2) Info: Empty value in 9999 records (99.95%) in recommended field [SrcFilePath] (Schema:FileEvent)" diff --git a/Parsers/ASimFileEvent/test/SentinelOne_vimFileEvent_SchemaTest.csv b/Parsers/ASimFileEvent/test/SentinelOne_vimFileEvent_SchemaTest.csv new file mode 100644 index 00000000000..b96414c0fc1 --- /dev/null +++ b/Parsers/ASimFileEvent/test/SentinelOne_vimFileEvent_SchemaTest.csv @@ -0,0 +1,81 @@ +Result +"(1) Warning: Missing recommended field [ActorUserId]" +"(1) Warning: Missing recommended field [DvcIpAddr]" +"(1) Warning: Missing recommended field [SrcFilePathType]" +"(1) Warning: Missing recommended field [SrcIpAddr]" +"(2) Info: Missing optional alias [Application] aliasing non-existent column [TargetAppName]" +"(2) Info: Missing optional alias [Url] aliasing non-existent column [TargetUrl]" +"(2) Info: Missing optional field [ActingAppId]" +"(2) Info: Missing optional field [ActingAppName]" +"(2) Info: Missing optional field [ActingAppType]" +"(2) Info: Missing optional field [ActorOriginalUserType]" +"(2) Info: Missing optional field [ActorScopeId]" +"(2) Info: Missing optional field [ActorScope]" +"(2) Info: Missing optional field [ActorSessionId]" +"(2) Info: Missing optional field [ActorUpn]" +"(2) Info: Missing optional field [ActorUserAadId]" +"(2) Info: Missing optional field [ActorUserPuid]" +"(2) Info: Missing optional field [ActorUserSid]" +"(2) Info: Missing optional field [AdditionalFields]" +"(2) Info: Missing optional field [DstDescription]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EventMessage]" +"(2) Info: Missing optional field [EventOriginalResultDetails]" +"(2) Info: Missing optional field [EventOriginalSubType]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [EventResultDetails]" +"(2) Info: Missing optional field [EventSubType]" +"(2) Info: Missing optional field [HttpUserAgent]" +"(2) Info: Missing optional field [NetworkApplicationProtocol]" +"(2) Info: Missing optional field [RuleNumber]" +"(2) Info: Missing optional field [SrcDescription]" +"(2) Info: Missing optional field [SrcDeviceType]" +"(2) Info: Missing optional field [SrcDomain]" +"(2) Info: Missing optional field [SrcDvcId]" +"(2) Info: Missing optional field [SrcDvcScopeId]" +"(2) Info: Missing optional field [SrcDvcScope]" +"(2) Info: Missing optional field [SrcFQDN]" +"(2) Info: Missing optional field [SrcFileCreationTime]" +"(2) Info: Missing optional field [SrcFileDirectory]" +"(2) Info: Missing optional field [SrcFileExtension]" +"(2) Info: Missing optional field [SrcFileMD5]" +"(2) Info: Missing optional field [SrcFileMimeType]" +"(2) Info: Missing optional field [SrcFileSHA1]" +"(2) Info: Missing optional field [SrcFileSHA256]" +"(2) Info: Missing optional field [SrcFileSHA512]" +"(2) Info: Missing optional field [SrcFileSize]" +"(2) Info: Missing optional field [SrcGeoCity]" +"(2) Info: Missing optional field [SrcGeoCountry]" +"(2) Info: Missing optional field [SrcGeoLatitude]" +"(2) Info: Missing optional field [SrcGeoLongitude]" +"(2) Info: Missing optional field [SrcGeoRegion]" +"(2) Info: Missing optional field [SrcHostname]" +"(2) Info: Missing optional field [SrcPortNumber]" +"(2) Info: Missing optional field [Src]" +"(2) Info: Missing optional field [TargetAppId]" +"(2) Info: Missing optional field [TargetAppName]" +"(2) Info: Missing optional field [TargetFileDirectory]" +"(2) Info: Missing optional field [TargetFileExtension]" +"(2) Info: Missing optional field [TargetFileMD5]" +"(2) Info: Missing optional field [TargetFileMimeType]" +"(2) Info: Missing optional field [TargetFileSHA512]" +"(2) Info: Missing optional field [TargetFileSize]" +"(2) Info: Missing optional field [TargetUrl]" +"(2) Info: Missing optional field [ThreatCategory]" +"(2) Info: Missing optional field [ThreatFilePath]" +"(2) Info: Missing optional field [ThreatFirstReportedTime]" +"(2) Info: Missing optional field [ThreatId]" +"(2) Info: Missing optional field [ThreatIsActive]" +"(2) Info: Missing optional field [ThreatLastReportedTime]" +"(2) Info: Missing optional field [ThreatName]" +"(2) Info: Missing optional field [ThreatOriginalRiskLevel]" +"(2) Info: Missing optional field [ThreatRiskLevel]" +"(2) Info: Missing recommended alias [IpAddr] aliasing non-existent column [SrcIpAddr]" diff --git a/Parsers/ASimNetworkSession/Parsers/ASimNetworkSession.yaml b/Parsers/ASimNetworkSession/Parsers/ASimNetworkSession.yaml index bf45062d7ae..1a71b12372a 100644 --- a/Parsers/ASimNetworkSession/Parsers/ASimNetworkSession.yaml +++ b/Parsers/ASimNetworkSession/Parsers/ASimNetworkSession.yaml @@ -44,6 +44,7 @@ Parsers: - _ASim_NetworkSession_CiscoMeraki - _ASim_NetworkSession_CiscoISE - _ASim_NetworkSession_BarracudaWAF + - _ASim_NetworkSession_SentinelOne ParserParams: - Name: pack @@ -77,6 +78,7 @@ ParserQuery: | , ASimNetworkSessionMicrosoftSysmon (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMicrosoftSysmon' in (DisabledParsers) )) , ASimNetworkSessionForcePointFirewall (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionForcePointFirewall' in (DisabledParsers) )) , ASimNetworkSessionNative (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionNative' in (DisabledParsers) )) + , ASimNetworkSessionSentinelOne (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionSentinelOne' in (DisabledParsers) )) , ASimNetworkSessionCiscoMeraki (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoMeraki' in (DisabledParsers) )) , ASimNetworkSessionCiscoISE (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoISE' in (DisabledParsers) )) , ASimNetworkSessionBarracudaWAF (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionBarracudaWAF' in (DisabledParsers) )) diff --git a/Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionSentinelOne.yaml b/Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionSentinelOne.yaml new file mode 100644 index 00000000000..c9f29c5e133 --- /dev/null +++ b/Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionSentinelOne.yaml @@ -0,0 +1,153 @@ +Parser: + Title: Network Session ASIM filtering parser for SentinelOne + Version: '0.1.0' + LastUpdated: Sep 18 2023 +Product: + Name: SentinelOne +Normalization: + Schema: NetworkSession + Version: '0.2.6' +References: +- Title: ASIM Network Session Schema + Link: https://aka.ms/ASimNetworkSessionDoc +- Title: ASIM + Link: https:/aka.ms/AboutASIM +- Title: SentinelOne Documentation +- Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM Network Session normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: ASimNetworkSessionSentinelOne +EquivalentBuiltInParser: _ASim_NetworkSession_SentinelOne +ParserParams: + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let NetworkDirectionLookup = datatable ( + alertInfo_netEventDirection_s: string, + NetworkDirection: string + )[ + "OUTGOING", "Outbound", + "INCOMING", "Inbound", + ]; + let DeviceTypeLookup = datatable ( + agentDetectionInfo_machineType_s: string, + SrcDeviceType: string + ) + [ + "desktop", "Computer", + "server", "Computer", + "laptop", "Computer", + "kubernetes node", "Other", + "unknown", "Other" + ]; + let ThreatConfidenceLookup_undefined = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_undefined: int + ) + [ + "FALSE_POSITIVE", 5, + "Undefined", 15, + "SUSPICIOUS", 25, + "TRUE_POSITIVE", 33 + ]; + let ThreatConfidenceLookup_suspicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_suspicious: int + ) + [ + "FALSE_POSITIVE", 40, + "Undefined", 50, + "SUSPICIOUS", 60, + "TRUE_POSITIVE", 67 + ]; + let ThreatConfidenceLookup_malicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_malicious: int + ) + [ + "FALSE_POSITIVE", 75, + "Undefined", 80, + "SUSPICIOUS", 90, + "TRUE_POSITIVE", 100 + ]; + let parser = (disabled: bool=false) { + let alldata = SentinelOne_CL + | where not(disabled) + and event_name_s == "Alerts." + and alertInfo_eventType_s == "TCPV4" + | lookup NetworkDirectionLookup on alertInfo_netEventDirection_s + | lookup DeviceTypeLookup on agentDetectionInfo_machineType_s; + let undefineddata = alldata + | where ruleInfo_treatAsThreat_s == "UNDEFINED" + | lookup ThreatConfidenceLookup_undefined on alertInfo_analystVerdict_s; + let suspiciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Suspicious" + | lookup ThreatConfidenceLookup_suspicious on alertInfo_analystVerdict_s; + let maliciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Malicious" + | lookup ThreatConfidenceLookup_malicious on alertInfo_analystVerdict_s; + union undefineddata, suspiciousdata, maliciousdata + | invoke _ASIM_ResolveDvcFQDN('agentDetectionInfo_name_s') + | extend + DstPortNumber = toint(alertInfo_dstPort_s), + SrcPortNumber = toint(alertInfo_srcPort_s), + ThreatConfidence = coalesce(ThreatConfidence_undefined, ThreatConfidence_suspicious, ThreatConfidence_malicious) + | project-rename + EventStartTime = sourceProcessInfo_pidStarttime_t, + DstIpAddr = alertInfo_dstIp_s, + EventUid = _ItemId, + SrcIpAddr = alertInfo_srcIp_s, + DvcId = agentDetectionInfo_uuid_g, + DvcOs = agentDetectionInfo_osName_s, + DvcOsVersion = agentDetectionInfo_osRevision_s, + EventOriginalSeverity = ruleInfo_severity_s, + EventOriginalUid = alertInfo_dvEventId_s, + SrcProcessName = sourceProcessInfo_name_s, + SrcProcessId = sourceProcessInfo_pid_s, + SrcUsername = sourceProcessInfo_user_s, + ThreatOriginalConfidence = ruleInfo_treatAsThreat_s + | extend + EventEndTime = EventStartTime, + Dst = DstIpAddr, + DvcIpAddr = SrcIpAddr, + Src = SrcIpAddr, + SrcHostname = DvcHostname, + SrcDvcId = DvcId, + IpAddr = SrcIpAddr, + EventSeverity = iff(EventOriginalSeverity == "Critical", "High", EventOriginalSeverity), + SrcDvcIdType = iff(isnotempty(DvcId), "Other", ""), + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + SrcUsernameType = _ASIM_GetUsernameType(SrcUsername), + SrcUserType = _ASIM_GetUserType(SrcUsername, "") + | extend + Dvc = coalesce(DvcId, DvcHostname, DvcIpAddr), + Hostname = SrcHostname + | extend + EventCount = int(1), + EventProduct = "SentinelOne", + EventResult = "Success", + DvcAction = "Allow", + EventSchema = "NetworkSession", + EventSchemaVersion = "0.2.6", + EventResultDetails = "NA", + EventType = "EndpointNetworkSession", + EventVendor = "SentinelOne", + NetworkProtocol = "TCP", + NetworkProtocolVersion = "IPv4" + | project-away + *_d, + *_s, + *_g, + *_t, + *_b, + _ResourceId, + TenantId, + RawData, + Computer, + MG, + ManagementGroupName, + SourceSystem, + ThreatConfidence_* + }; + parser(disabled = disabled) \ No newline at end of file diff --git a/Parsers/ASimNetworkSession/Parsers/imNetworkSession.yaml b/Parsers/ASimNetworkSession/Parsers/imNetworkSession.yaml index 53a2b63de9d..bdcdbd846bc 100644 --- a/Parsers/ASimNetworkSession/Parsers/imNetworkSession.yaml +++ b/Parsers/ASimNetworkSession/Parsers/imNetworkSession.yaml @@ -42,6 +42,7 @@ Parsers: - _Im_NetworkSession_CiscoMeraki - _Im_NetworkSession_CiscoISE - _Im_NetworkSession_BarracudaWAF + - _Im_NetworkSession_SentinelOne ParserParams: - Name: starttime Type: datetime @@ -109,6 +110,7 @@ ParserQuery: | , vimNetworkSessionCiscoASA (starttime, endtime, srcipaddr_has_any_prefix, dstipaddr_has_any_prefix, ipaddr_has_any_prefix, dstportnumber, hostname_has_any, dvcaction, eventresult, ASimBuiltInDisabled or ('ExcludevimNetworkSessionCiscoASA' in (DisabledParsers) )) , vimNetworkSessionForcePointFirewall (starttime, endtime, srcipaddr_has_any_prefix, dstipaddr_has_any_prefix, ipaddr_has_any_prefix, dstportnumber, hostname_has_any, dvcaction, eventresult, ASimBuiltInDisabled or ('ExcludevimNetworkSessionForcePointFirewall' in (DisabledParsers) )) , vimNetworkSessionNative (starttime, endtime, srcipaddr_has_any_prefix, dstipaddr_has_any_prefix, ipaddr_has_any_prefix, dstportnumber, hostname_has_any, dvcaction, eventresult, ASimBuiltInDisabled or ('ExcludevimNetworkSessionNative' in (DisabledParsers) )) + , vimNetworkSessionSentinelOne (starttime, endtime, srcipaddr_has_any_prefix, dstipaddr_has_any_prefix, ipaddr_has_any_prefix, dstportnumber, hostname_has_any, dvcaction, eventresult, ASimBuiltInDisabled or ('ExcludevimNetworkSessionSentinelOne' in (DisabledParsers) )) , vimNetworkSessionCiscoMeraki (starttime, endtime, srcipaddr_has_any_prefix, dstipaddr_has_any_prefix, ipaddr_has_any_prefix, dstportnumber, hostname_has_any, dvcaction, eventresult, ASimBuiltInDisabled or ('ExcludevimNetworkSessionCiscoMeraki' in (DisabledParsers) )) , vimNetworkSessionCiscoISE (starttime, endtime, srcipaddr_has_any_prefix, dstipaddr_has_any_prefix, ipaddr_has_any_prefix, dstportnumber, hostname_has_any, dvcaction, eventresult, ASimBuiltInDisabled or ('ExcludevimNetworkSessionCiscoISE' in (DisabledParsers) )) , vimNetworkSessionBarracudaWAF (starttime, endtime, srcipaddr_has_any_prefix, dstipaddr_has_any_prefix, ipaddr_has_any_prefix, dstportnumber, hostname_has_any, dvcaction, eventresult, ASimBuiltInDisabled or ('ExcludevimNetworkSessionBarracudaWAF' in (DisabledParsers) )) diff --git a/Parsers/ASimNetworkSession/Parsers/vimNetworkSessionSentinelOne.yaml b/Parsers/ASimNetworkSession/Parsers/vimNetworkSessionSentinelOne.yaml new file mode 100644 index 00000000000..7a6594d524c --- /dev/null +++ b/Parsers/ASimNetworkSession/Parsers/vimNetworkSessionSentinelOne.yaml @@ -0,0 +1,228 @@ +Parser: + Title: Network Session ASIM filtering parser for SentinelOne + Version: '0.1.0' + LastUpdated: Sep 18 2023 +Product: + Name: SentinelOne +Normalization: + Schema: NetworkSession + Version: '0.2.6' +References: +- Title: ASIM Network Session Schema + Link: https://aka.ms/ASimNetworkSessionDoc +- Title: ASIM + Link: https:/aka.ms/AboutASIM +- Title: SentinelOne Documentation +- Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM Network Session normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: vimNetworkSessionSentinelOne +EquivalentBuiltInParser: _Im_NetworkSession_SentinelOne +ParserParams: + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: srcipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: dstipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: ipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: dstportnumber + Type: int + Default: int(null) + - Name: dvcaction + Type: dynamic + Default: dynamic([]) + - Name: hostname_has_any + Type: dynamic + Default: dynamic([]) + - Name: eventresult + Type: string + Default: '*' + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let NetworkDirectionLookup = datatable ( + alertInfo_netEventDirection_s: string, + NetworkDirection: string + )[ + "OUTGOING", "Outbound", + "INCOMING", "Inbound", + ]; + let DeviceTypeLookup = datatable ( + agentDetectionInfo_machineType_s: string, + SrcDeviceType: string + ) + [ + "desktop", "Computer", + "server", "Computer", + "laptop", "Computer", + "kubernetes node", "Other", + "unknown", "Other" + ]; + let ThreatConfidenceLookup_undefined = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_undefined: int + ) + [ + "FALSE_POSITIVE", 5, + "Undefined", 15, + "SUSPICIOUS", 25, + "TRUE_POSITIVE", 33 + ]; + let ThreatConfidenceLookup_suspicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_suspicious: int + ) + [ + "FALSE_POSITIVE", 40, + "Undefined", 50, + "SUSPICIOUS", 60, + "TRUE_POSITIVE", 67 + ]; + let ThreatConfidenceLookup_malicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_malicious: int + ) + [ + "FALSE_POSITIVE", 75, + "Undefined", 80, + "SUSPICIOUS", 90, + "TRUE_POSITIVE", 100 + ]; + let parser=( + disabled: bool=false, + starttime: datetime=datetime(null), + endtime: datetime=datetime(null), + eventresult: string='*', + srcipaddr_has_any_prefix: dynamic=dynamic([]), + dstipaddr_has_any_prefix: dynamic=dynamic([]), + ipaddr_has_any_prefix: dynamic=dynamic([]), + hostname_has_any: dynamic=dynamic([]), + dstportnumber: int=int(null), + dvcaction: dynamic=dynamic([]) + ) { + let src_or_any = set_union(srcipaddr_has_any_prefix, ipaddr_has_any_prefix); + let dst_or_any = set_union(dstipaddr_has_any_prefix, ipaddr_has_any_prefix); + let alldata = SentinelOne_CL + | where not(disabled) + and (isnull(starttime) or TimeGenerated >= starttime) + and (isnull(endtime) or TimeGenerated <= endtime) + and event_name_s == "Alerts." + and alertInfo_eventType_s == "TCPV4" + and (eventresult == "*" or eventresult == "Success") + and (isnull(dstportnumber) or toint(alertInfo_dstPort_s) == dstportnumber) + and (array_length(hostname_has_any) == 0 or agentDetectionInfo_name_s has_any (hostname_has_any)) + and (array_length(dvcaction) == 0 or dvcaction has_any ("Allow")) + | extend + temp_SrcMatch = has_any_ipv4_prefix(alertInfo_srcIp_s, src_or_any), + temp_DstMatch = has_any_ipv4_prefix(alertInfo_dstIp_s, dst_or_any) + | extend + ASimMatchingIpAddr=case( + array_length(src_or_any) == 0 and array_length(dst_or_any) == 0, + "-", + temp_SrcMatch and temp_DstMatch, + "Both", + temp_SrcMatch, + "SrcIpAddr", + temp_DstMatch, + "DstIpAddr", + "No match" + ), + ASimMatchingHostname = "SrcHostname" + | where ASimMatchingIpAddr != "No match"; + let undefineddata = alldata + | where ruleInfo_treatAsThreat_s == "UNDEFINED" + | lookup ThreatConfidenceLookup_undefined on alertInfo_analystVerdict_s; + let suspiciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Suspicious" + | lookup ThreatConfidenceLookup_suspicious on alertInfo_analystVerdict_s; + let maliciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Malicious" + | lookup ThreatConfidenceLookup_malicious on alertInfo_analystVerdict_s; + union undefineddata, suspiciousdata, maliciousdata + | lookup NetworkDirectionLookup on alertInfo_netEventDirection_s + | lookup DeviceTypeLookup on agentDetectionInfo_machineType_s + | invoke _ASIM_ResolveDvcFQDN('agentDetectionInfo_name_s') + | extend + DstPortNumber = toint(alertInfo_dstPort_s), + SrcPortNumber = toint(alertInfo_srcPort_s), + ThreatConfidence = coalesce(ThreatConfidence_undefined, ThreatConfidence_suspicious, ThreatConfidence_malicious) + | project-rename + EventStartTime = sourceProcessInfo_pidStarttime_t, + DstIpAddr = alertInfo_dstIp_s, + EventUid = _ItemId, + SrcIpAddr = alertInfo_srcIp_s, + DvcId = agentDetectionInfo_uuid_g, + DvcOs = agentDetectionInfo_osName_s, + DvcOsVersion = agentDetectionInfo_osRevision_s, + EventOriginalSeverity = ruleInfo_severity_s, + EventOriginalUid = alertInfo_dvEventId_s, + SrcProcessName = sourceProcessInfo_name_s, + SrcProcessId = sourceProcessInfo_pid_s, + SrcUsername = sourceProcessInfo_user_s, + ThreatOriginalConfidence = ruleInfo_treatAsThreat_s + | extend + EventEndTime = EventStartTime, + Dst = DstIpAddr, + DvcIpAddr = SrcIpAddr, + Src = SrcIpAddr, + SrcHostname = DvcHostname, + SrcDvcId = DvcId, + IpAddr = SrcIpAddr, + EventSeverity = iff(EventOriginalSeverity == "Critical", "High", EventOriginalSeverity), + SrcDvcIdType = iff(isnotempty(DvcId), "Other", ""), + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + SrcUsernameType = _ASIM_GetUsernameType(SrcUsername), + SrcUserType = _ASIM_GetUserType(SrcUsername, "") + | extend + Dvc = coalesce(DvcId, DvcHostname, DvcIpAddr), + Hostname = SrcHostname + | extend + EventCount = int(1), + EventProduct = "SentinelOne", + EventResult = "Success", + DvcAction = "Allow", + EventSchema = "NetworkSession", + EventSchemaVersion = "0.2.6", + EventResultDetails = "NA", + EventType = "EndpointNetworkSession", + EventVendor = "SentinelOne", + NetworkProtocol = "TCP", + NetworkProtocolVersion = "IPv4" + | project-away + *_d, + *_s, + *_g, + *_t, + *_b, + _ResourceId, + temp*, + TenantId, + RawData, + Computer, + MG, + ManagementGroupName, + SourceSystem, + ThreatConfidence_* + }; + parser( + disabled=disabled, + starttime=starttime, + endtime=endtime, + eventresult=eventresult, + srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, + dstipaddr_has_any_prefix=dstipaddr_has_any_prefix, + ipaddr_has_any_prefix=ipaddr_has_any_prefix, + hostname_has_any=hostname_has_any, + dstportnumber=dstportnumber, + dvcaction=dvcaction + ) \ No newline at end of file diff --git a/Parsers/ASimNetworkSession/Tests/SentinelOne_ASimNetworkSession_DataTest.csv b/Parsers/ASimNetworkSession/Tests/SentinelOne_ASimNetworkSession_DataTest.csv new file mode 100644 index 00000000000..5a9ed0ce555 --- /dev/null +++ b/Parsers/ASimNetworkSession/Tests/SentinelOne_ASimNetworkSession_DataTest.csv @@ -0,0 +1,8 @@ +Result +"(0) Error: 1 invalid value(s) (up to 10 listed) in 11382 records (100.0%) for field [EventProduct] of type [Enumerated]: [""SentinelOne""] (Schema:NetworkSession)" +"(0) Error: 1 invalid value(s) (up to 10 listed) in 11382 records (100.0%) for field [EventVendor] of type [Enumerated]: [""SentinelOne""] (Schema:NetworkSession)" +"(2) Info: Empty value in 10986 records (96.52%) in optional field [SrcUserType] (Schema:NetworkSession)" +"(2) Info: Empty value in 10986 records (96.52%) in optional field [SrcUsername] (Schema:NetworkSession)" +"(2) Info: Empty value in 1718 records (15.09%) in optional field [DvcFQDN] (Schema:NetworkSession)" +"(2) Info: Empty value in 1718 records (15.09%) in recommended field [DvcDomain] (Schema:NetworkSession)" +"(2) Info: Empty value in 2 records (0.02%) in optional field [SrcProcessName] (Schema:NetworkSession)" diff --git a/Parsers/ASimNetworkSession/Tests/SentinelOne_ASimNetworkSession_SchemaTest.csv b/Parsers/ASimNetworkSession/Tests/SentinelOne_ASimNetworkSession_SchemaTest.csv new file mode 100644 index 00000000000..50af1297f20 --- /dev/null +++ b/Parsers/ASimNetworkSession/Tests/SentinelOne_ASimNetworkSession_SchemaTest.csv @@ -0,0 +1,107 @@ +Result +"(1) Warning: Missing recommended field [ASimMatchingHostname]" +"(1) Warning: Missing recommended field [ASimMatchingIpAddr]" +"(1) Warning: Missing recommended field [DstDomain]" +"(1) Warning: Missing recommended field [DstHostname]" +"(1) Warning: Missing recommended field [SrcDomain]" +"(2) Info: Missing optional alias [Duration] aliasing non-existent column [NetworkDuration]" +"(2) Info: Missing optional alias [InnerVlanId] aliasing non-existent column [SrcVlanId]" +"(2) Info: Missing optional alias [OuterVlanId] aliasing non-existent column [DstVlanId]" +"(2) Info: Missing optional alias [SessionId] aliasing non-existent column [NetworkSessionId]" +"(2) Info: Missing optional alias [User] aliasing non-existent column [DstUsername]" +"(2) Info: Missing optional field [AdditionalFields]" +"(2) Info: Missing optional field [DstAppId]" +"(2) Info: Missing optional field [DstAppName]" +"(2) Info: Missing optional field [DstAppType]" +"(2) Info: Missing optional field [DstBytes]" +"(2) Info: Missing optional field [DstDescription]" +"(2) Info: Missing optional field [DstDeviceType]" +"(2) Info: Missing optional field [DstDvcId]" +"(2) Info: Missing optional field [DstFQDN]" +"(2) Info: Missing optional field [DstGeoCity]" +"(2) Info: Missing optional field [DstGeoCountry]" +"(2) Info: Missing optional field [DstGeoLatitude]" +"(2) Info: Missing optional field [DstGeoLongitude]" +"(2) Info: Missing optional field [DstGeoRegion]" +"(2) Info: Missing optional field [DstInterfaceGuid]" +"(2) Info: Missing optional field [DstInterfaceName]" +"(2) Info: Missing optional field [DstMacAddr]" +"(2) Info: Missing optional field [DstNatIpAddr]" +"(2) Info: Missing optional field [DstNatPortNumber]" +"(2) Info: Missing optional field [DstOriginalUserType]" +"(2) Info: Missing optional field [DstPackets]" +"(2) Info: Missing optional field [DstProcessGuid]" +"(2) Info: Missing optional field [DstProcessId]" +"(2) Info: Missing optional field [DstProcessName]" +"(2) Info: Missing optional field [DstScopeId]" +"(2) Info: Missing optional field [DstUserId]" +"(2) Info: Missing optional field [DstUserType]" +"(2) Info: Missing optional field [DstUsername]" +"(2) Info: Missing optional field [DstVlanId]" +"(2) Info: Missing optional field [DstZone]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcInboundInterface]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcOutboundInterface]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EventMessage]" +"(2) Info: Missing optional field [EventOriginalResultDetails]" +"(2) Info: Missing optional field [EventOriginalSubType]" +"(2) Info: Missing optional field [EventOriginalType]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [EventSubType]" +"(2) Info: Missing optional field [NetworkApplicationProtocol]" +"(2) Info: Missing optional field [NetworkBytes]" +"(2) Info: Missing optional field [NetworkConnectionHistory]" +"(2) Info: Missing optional field [NetworkDuration]" +"(2) Info: Missing optional field [NetworkIcmpCode]" +"(2) Info: Missing optional field [NetworkIcmpType]" +"(2) Info: Missing optional field [NetworkPackets]" +"(2) Info: Missing optional field [NetworkRuleName]" +"(2) Info: Missing optional field [NetworkRuleNumber]" +"(2) Info: Missing optional field [NetworkSessionId]" +"(2) Info: Missing optional field [Rule]" +"(2) Info: Missing optional field [SrcAppId]" +"(2) Info: Missing optional field [SrcAppName]" +"(2) Info: Missing optional field [SrcAppType]" +"(2) Info: Missing optional field [SrcBytes]" +"(2) Info: Missing optional field [SrcDescription]" +"(2) Info: Missing optional field [SrcFQDN]" +"(2) Info: Missing optional field [SrcGeoCity]" +"(2) Info: Missing optional field [SrcGeoCountry]" +"(2) Info: Missing optional field [SrcGeoLatitude]" +"(2) Info: Missing optional field [SrcGeoLongitude]" +"(2) Info: Missing optional field [SrcGeoRegion]" +"(2) Info: Missing optional field [SrcInterfaceGuid]" +"(2) Info: Missing optional field [SrcInterfaceName]" +"(2) Info: Missing optional field [SrcMacAddr]" +"(2) Info: Missing optional field [SrcNatIpAddr]" +"(2) Info: Missing optional field [SrcNatPortNumber]" +"(2) Info: Missing optional field [SrcOriginalUserType]" +"(2) Info: Missing optional field [SrcPackets]" +"(2) Info: Missing optional field [SrcProcessGuid]" +"(2) Info: Missing optional field [SrcScopeId]" +"(2) Info: Missing optional field [SrcUserId]" +"(2) Info: Missing optional field [SrcVlanId]" +"(2) Info: Missing optional field [SrcZone]" +"(2) Info: Missing optional field [TcpFlagsAck]" +"(2) Info: Missing optional field [TcpFlagsFin]" +"(2) Info: Missing optional field [TcpFlagsPsh]" +"(2) Info: Missing optional field [TcpFlagsRst]" +"(2) Info: Missing optional field [TcpFlagsSyn]" +"(2) Info: Missing optional field [TcpFlagsUrg]" +"(2) Info: Missing optional field [ThreatCategory]" +"(2) Info: Missing optional field [ThreatFirstReportedTime]" +"(2) Info: Missing optional field [ThreatId]" +"(2) Info: Missing optional field [ThreatIpAddr]" +"(2) Info: Missing optional field [ThreatIsActive]" +"(2) Info: Missing optional field [ThreatLastReportedTime]" +"(2) Info: Missing optional field [ThreatName]" +"(2) Info: Missing optional field [ThreatOriginalRiskLevel]" +"(2) Info: Missing optional field [ThreatRiskLevel]" diff --git a/Parsers/ASimNetworkSession/Tests/SentinelOne_vimNetworkSession_DataTest.csv b/Parsers/ASimNetworkSession/Tests/SentinelOne_vimNetworkSession_DataTest.csv new file mode 100644 index 00000000000..5a9ed0ce555 --- /dev/null +++ b/Parsers/ASimNetworkSession/Tests/SentinelOne_vimNetworkSession_DataTest.csv @@ -0,0 +1,8 @@ +Result +"(0) Error: 1 invalid value(s) (up to 10 listed) in 11382 records (100.0%) for field [EventProduct] of type [Enumerated]: [""SentinelOne""] (Schema:NetworkSession)" +"(0) Error: 1 invalid value(s) (up to 10 listed) in 11382 records (100.0%) for field [EventVendor] of type [Enumerated]: [""SentinelOne""] (Schema:NetworkSession)" +"(2) Info: Empty value in 10986 records (96.52%) in optional field [SrcUserType] (Schema:NetworkSession)" +"(2) Info: Empty value in 10986 records (96.52%) in optional field [SrcUsername] (Schema:NetworkSession)" +"(2) Info: Empty value in 1718 records (15.09%) in optional field [DvcFQDN] (Schema:NetworkSession)" +"(2) Info: Empty value in 1718 records (15.09%) in recommended field [DvcDomain] (Schema:NetworkSession)" +"(2) Info: Empty value in 2 records (0.02%) in optional field [SrcProcessName] (Schema:NetworkSession)" diff --git a/Parsers/ASimNetworkSession/Tests/SentinelOne_vimNetworkSession_SchemaTest.csv b/Parsers/ASimNetworkSession/Tests/SentinelOne_vimNetworkSession_SchemaTest.csv new file mode 100644 index 00000000000..77b1fa0c1f6 --- /dev/null +++ b/Parsers/ASimNetworkSession/Tests/SentinelOne_vimNetworkSession_SchemaTest.csv @@ -0,0 +1,105 @@ +Result +"(1) Warning: Missing recommended field [DstDomain]" +"(1) Warning: Missing recommended field [DstHostname]" +"(1) Warning: Missing recommended field [SrcDomain]" +"(2) Info: Missing optional alias [Duration] aliasing non-existent column [NetworkDuration]" +"(2) Info: Missing optional alias [InnerVlanId] aliasing non-existent column [SrcVlanId]" +"(2) Info: Missing optional alias [OuterVlanId] aliasing non-existent column [DstVlanId]" +"(2) Info: Missing optional alias [SessionId] aliasing non-existent column [NetworkSessionId]" +"(2) Info: Missing optional alias [User] aliasing non-existent column [DstUsername]" +"(2) Info: Missing optional field [AdditionalFields]" +"(2) Info: Missing optional field [DstAppId]" +"(2) Info: Missing optional field [DstAppName]" +"(2) Info: Missing optional field [DstAppType]" +"(2) Info: Missing optional field [DstBytes]" +"(2) Info: Missing optional field [DstDescription]" +"(2) Info: Missing optional field [DstDeviceType]" +"(2) Info: Missing optional field [DstDvcId]" +"(2) Info: Missing optional field [DstFQDN]" +"(2) Info: Missing optional field [DstGeoCity]" +"(2) Info: Missing optional field [DstGeoCountry]" +"(2) Info: Missing optional field [DstGeoLatitude]" +"(2) Info: Missing optional field [DstGeoLongitude]" +"(2) Info: Missing optional field [DstGeoRegion]" +"(2) Info: Missing optional field [DstInterfaceGuid]" +"(2) Info: Missing optional field [DstInterfaceName]" +"(2) Info: Missing optional field [DstMacAddr]" +"(2) Info: Missing optional field [DstNatIpAddr]" +"(2) Info: Missing optional field [DstNatPortNumber]" +"(2) Info: Missing optional field [DstOriginalUserType]" +"(2) Info: Missing optional field [DstPackets]" +"(2) Info: Missing optional field [DstProcessGuid]" +"(2) Info: Missing optional field [DstProcessId]" +"(2) Info: Missing optional field [DstProcessName]" +"(2) Info: Missing optional field [DstScopeId]" +"(2) Info: Missing optional field [DstUserId]" +"(2) Info: Missing optional field [DstUserType]" +"(2) Info: Missing optional field [DstUsername]" +"(2) Info: Missing optional field [DstVlanId]" +"(2) Info: Missing optional field [DstZone]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcInboundInterface]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcOutboundInterface]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EventMessage]" +"(2) Info: Missing optional field [EventOriginalResultDetails]" +"(2) Info: Missing optional field [EventOriginalSubType]" +"(2) Info: Missing optional field [EventOriginalType]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [EventSubType]" +"(2) Info: Missing optional field [NetworkApplicationProtocol]" +"(2) Info: Missing optional field [NetworkBytes]" +"(2) Info: Missing optional field [NetworkConnectionHistory]" +"(2) Info: Missing optional field [NetworkDuration]" +"(2) Info: Missing optional field [NetworkIcmpCode]" +"(2) Info: Missing optional field [NetworkIcmpType]" +"(2) Info: Missing optional field [NetworkPackets]" +"(2) Info: Missing optional field [NetworkRuleName]" +"(2) Info: Missing optional field [NetworkRuleNumber]" +"(2) Info: Missing optional field [NetworkSessionId]" +"(2) Info: Missing optional field [Rule]" +"(2) Info: Missing optional field [SrcAppId]" +"(2) Info: Missing optional field [SrcAppName]" +"(2) Info: Missing optional field [SrcAppType]" +"(2) Info: Missing optional field [SrcBytes]" +"(2) Info: Missing optional field [SrcDescription]" +"(2) Info: Missing optional field [SrcFQDN]" +"(2) Info: Missing optional field [SrcGeoCity]" +"(2) Info: Missing optional field [SrcGeoCountry]" +"(2) Info: Missing optional field [SrcGeoLatitude]" +"(2) Info: Missing optional field [SrcGeoLongitude]" +"(2) Info: Missing optional field [SrcGeoRegion]" +"(2) Info: Missing optional field [SrcInterfaceGuid]" +"(2) Info: Missing optional field [SrcInterfaceName]" +"(2) Info: Missing optional field [SrcMacAddr]" +"(2) Info: Missing optional field [SrcNatIpAddr]" +"(2) Info: Missing optional field [SrcNatPortNumber]" +"(2) Info: Missing optional field [SrcOriginalUserType]" +"(2) Info: Missing optional field [SrcPackets]" +"(2) Info: Missing optional field [SrcProcessGuid]" +"(2) Info: Missing optional field [SrcScopeId]" +"(2) Info: Missing optional field [SrcUserId]" +"(2) Info: Missing optional field [SrcVlanId]" +"(2) Info: Missing optional field [SrcZone]" +"(2) Info: Missing optional field [TcpFlagsAck]" +"(2) Info: Missing optional field [TcpFlagsFin]" +"(2) Info: Missing optional field [TcpFlagsPsh]" +"(2) Info: Missing optional field [TcpFlagsRst]" +"(2) Info: Missing optional field [TcpFlagsSyn]" +"(2) Info: Missing optional field [TcpFlagsUrg]" +"(2) Info: Missing optional field [ThreatCategory]" +"(2) Info: Missing optional field [ThreatFirstReportedTime]" +"(2) Info: Missing optional field [ThreatId]" +"(2) Info: Missing optional field [ThreatIpAddr]" +"(2) Info: Missing optional field [ThreatIsActive]" +"(2) Info: Missing optional field [ThreatLastReportedTime]" +"(2) Info: Missing optional field [ThreatName]" +"(2) Info: Missing optional field [ThreatOriginalRiskLevel]" +"(2) Info: Missing optional field [ThreatRiskLevel]" diff --git a/Parsers/ASimProcessEvent/Parsers/ASimProcessCreateSentinelOne.yaml b/Parsers/ASimProcessEvent/Parsers/ASimProcessCreateSentinelOne.yaml new file mode 100644 index 00000000000..b95d4f15137 --- /dev/null +++ b/Parsers/ASimProcessEvent/Parsers/ASimProcessCreateSentinelOne.yaml @@ -0,0 +1,153 @@ +Parser: + Title: Process Create ASIM parser for SentinelOne + Version: '0.1.0' + LastUpdated: Sep 18, 2023 +Product: + Name: SentinelOne +Normalization: + Schema: ProcessEvent + Version: '0.1.4' +References: +- Title: ASIM ProcessEvent Schema + Link: https://aka.ms/ASimProcessEventDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: SentinelOne Documentation +- Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM Process Event normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: ASimProcessCreateSentinelOne +EquivalentBuiltInParser: _ASim_ProcessCreate_SentinelOne +ParserParams: + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let ThreatConfidenceLookup_undefined = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_undefined: int + ) + [ + "FALSE_POSITIVE", 5, + "Undefined", 15, + "SUSPICIOUS", 25, + "TRUE_POSITIVE", 33 + ]; + let ThreatConfidenceLookup_suspicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_suspicious: int + ) + [ + "FALSE_POSITIVE", 40, + "Undefined", 50, + "SUSPICIOUS", 60, + "TRUE_POSITIVE", 67 + ]; + let ThreatConfidenceLookup_malicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_malicious: int + ) + [ + "FALSE_POSITIVE", 75, + "Undefined", 80, + "SUSPICIOUS", 90, + "TRUE_POSITIVE", 100 + ]; + let parser = (disabled: bool=false) { + let alldata = SentinelOne_CL + | where not(disabled) + and event_name_s == "Alerts." + and alertInfo_eventType_s == "PROCESSCREATION"; + let undefineddata = alldata + | where ruleInfo_treatAsThreat_s == "UNDEFINED" + | lookup ThreatConfidenceLookup_undefined on alertInfo_analystVerdict_s; + let suspiciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Suspicious" + | lookup ThreatConfidenceLookup_suspicious on alertInfo_analystVerdict_s; + let maaliciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Malicious" + | lookup ThreatConfidenceLookup_malicious on alertInfo_analystVerdict_s; + union undefineddata, suspiciousdata, maaliciousdata + | extend ThreatConfidence = coalesce(ThreatConfidence_undefined, ThreatConfidence_suspicious, ThreatConfidence_malicious) + | project-rename + DvcId = agentDetectionInfo_uuid_g, + EventStartTime = sourceProcessInfo_pidStarttime_t, + TargetProcessCommandLine = targetProcessInfo_tgtProcCmdLine_s, + TargetProcessId = targetProcessInfo_tgtProcPid_s, + TargetProcessName = targetProcessInfo_tgtProcName_s, + EventUid = _ItemId, + TargetProcessCreationTime = targetProcessInfo_tgtProcessStartTime_t, + ActingProcessName = sourceProcessInfo_name_s, + ParentProcessName = sourceParentProcessInfo_name_s, + ActingProcessCommandLine = sourceProcessInfo_commandline_s, + ActingProcessGuid = sourceProcessInfo_uniqueId_g, + ActingProcessSHA1 = sourceProcessInfo_fileHashSha1_s, + ParentProcessSHA1 = sourceParentProcessInfo_fileHashSha1_s, + ActingProcessSHA256 = sourceProcessInfo_fileHashSha256_s, + ParentProcessSHA256 = sourceParentProcessInfo_fileHashSha256_s, + DvcOs = agentDetectionInfo_osName_s, + DvcOsVersion = agentDetectionInfo_osRevision_s, + TargetProcessIntegrityLevel = targetProcessInfo_tgtProcIntegrityLevel_s, + EventOriginalType = alertInfo_eventType_s, + EventOriginalSeverity = ruleInfo_severity_s, + EventOriginalUid = alertInfo_dvEventId_s, + RuleName = ruleInfo_name_s, + ThreatOriginalConfidence = ruleInfo_treatAsThreat_s + | invoke _ASIM_ResolveDvcFQDN('agentDetectionInfo_name_s') + | extend + ActingProcessId = sourceProcessInfo_pid_s, + ActorUsername = sourceProcessInfo_user_s, + TargetUsername = sourceProcessInfo_user_s, + Hash = coalesce(targetProcessInfo_tgtFileHashSha256_s, targetProcessInfo_tgtFileHashSha1_s), + ParentProcessId = sourceProcessInfo_pid_s, + TargetProcessSHA1 = targetProcessInfo_tgtFileHashSha1_s, + TargetProcessSHA256 = targetProcessInfo_tgtFileHashSha256_s, + ParentProcessMD5 = replace_string(sourceParentProcessInfo_fileHashMd5_g, "-", ""), + ActingProcessMD5 = replace_string(sourceProcessInfo_fileHashMd5_g, "-", ""), + EventSeverity = iff(EventOriginalSeverity == "Critical", "High", EventOriginalSeverity) + | extend + EventCount = int(1), + EventProduct = "SentinelOne", + EventResult = "Success", + DvcAction = "Allowed", + EventSchemaVersion = "0.1.4", + EventType = "ProcessCreated", + EventVendor = "SentinelOne", + EventSchema = "ProcessEvent" + | extend + Dvc = DvcId, + EventEndTime = EventStartTime, + User = TargetUsername, + ActingProcessCreationTime = EventStartTime, + CommandLine = TargetProcessCommandLine, + Process = TargetProcessName, + Rule = RuleName + | extend + HashType = case( + isnotempty(Hash) and isnotempty(TargetProcessSHA256), + "TargetProcessSHA256", + isnotempty(Hash) and isnotempty(TargetProcessSHA1), + "TargetProcessSHA1", + "" + ), + TargetUsernameType = _ASIM_GetUsernameType(TargetUsername), + TargetUserType = _ASIM_GetUserType(TargetUsername, ""), + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + ActorUsernameType = _ASIM_GetUsernameType(ActorUsername), + ActorUserType = _ASIM_GetUserType(ActorUsername, "") + | project-away + *_d, + *_s, + *_g, + *_t, + *_b, + _ResourceId, + TenantId, + RawData, + Computer, + MG, + ManagementGroupName, + SourceSystem, + ThreatConfidence_* + }; + parser(disabled=disabled) \ No newline at end of file diff --git a/Parsers/ASimProcessEvent/Parsers/ASimProcessEvent.yaml b/Parsers/ASimProcessEvent/Parsers/ASimProcessEvent.yaml index 552eb6156ff..798cec4733f 100644 --- a/Parsers/ASimProcessEvent/Parsers/ASimProcessEvent.yaml +++ b/Parsers/ASimProcessEvent/Parsers/ASimProcessEvent.yaml @@ -29,6 +29,7 @@ Parsers: - _ASim_ProcessEvent_TerminateMicrosoftWindowsEvents - _ASim_ProcessEvent_CreateMicrosoftWindowsEvents - _ASim_ProcessEvent_MD4IoT + - _ASim_ProcessEvent_CreateSentinelOne ParserQuery: | let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimProcess') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser); @@ -44,4 +45,5 @@ ParserQuery: | ASimProcessTerminateLinuxSysmon(imProcessEventBuiltInDisabled or ('ExcludeASimProcessTerminateLinuxSysmon' in (DisabledParsers) )), ASimProcessTerminateMicrosoftWindowsEvents(imProcessEventBuiltInDisabled or ('ExcludeASimProcessTerminateMicrosoftWindowsEvents' in (DisabledParsers) )), ASimProcessCreateMicrosoftWindowsEvents(imProcessEventBuiltInDisabled or ('ExcludeASimProcessCreateMicrosoftWindowsEvents' in (DisabledParsers) )), - ASimProcessEventMD4IoT(imProcessEventBuiltInDisabled or ('ExcludeASimProcessEventMD4IoTh' in (DisabledParsers) )) + ASimProcessEventMD4IoT(imProcessEventBuiltInDisabled or ('ExcludeASimProcessEventMD4IoTh' in (DisabledParsers) )), + ASimProcessCreateSentinelOne(imProcessEventBuiltInDisabled or ('ExcludeASimProcessCreateSentinelOne' in (DisabledParsers) )) diff --git a/Parsers/ASimProcessEvent/Parsers/ASimProcessEventCreate.yaml b/Parsers/ASimProcessEvent/Parsers/ASimProcessEventCreate.yaml index f62795df256..9ea454cfd02 100644 --- a/Parsers/ASimProcessEvent/Parsers/ASimProcessEventCreate.yaml +++ b/Parsers/ASimProcessEvent/Parsers/ASimProcessEventCreate.yaml @@ -24,6 +24,7 @@ Parsers: - _ASim_ProcessEvent_CreateLinuxSysmon - _ASim_ProcessEvent_CreateMicrosoftWindowsEvents - _ASim_ProcessEvent_MD4IoT + - _ASim_ProcessEvent_CreateSentinelOne ParserQuery: | let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimProcessEventCreate') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser); @@ -35,4 +36,5 @@ ParserQuery: | ASimProcessCreateMicrosoftSecurityEvents(imProcessEventBuiltInDisabled or ('ExcludeASimProcessCreateMicrosoftSecurityEvents' in (DisabledParsers) )), ASimProcessCreateLinuxSysmon(imProcessEventBuiltInDisabled or ('ExcludeASimProcessCreateLinuxSysmon' in (DisabledParsers) )), ASimProcessCreateMicrosoftWindowsEvents(imProcessEventBuiltInDisabled or ('ExcludeASimProcessCreateMicrosoftWindowsEvents' in (DisabledParsers) )), - ASimProcessEventMD4IoT(imProcessEventBuiltInDisabled or ('ExcludeASimProcessEventMD4IoT' in (DisabledParsers) )) + ASimProcessEventMD4IoT(imProcessEventBuiltInDisabled or ('ExcludeASimProcessEventMD4IoT' in (DisabledParsers) )), + ASimProcessCreateSentinelOne(imProcessEventBuiltInDisabled or ('ExcludeASimProcessCreateSentinelOne' in (DisabledParsers) )) diff --git a/Parsers/ASimProcessEvent/Parsers/imProcess.yaml b/Parsers/ASimProcessEvent/Parsers/imProcess.yaml new file mode 100644 index 00000000000..ba5161b191d --- /dev/null +++ b/Parsers/ASimProcessEvent/Parsers/imProcess.yaml @@ -0,0 +1,94 @@ +Parser: + Title: Process Event ASIM parser + Version: '0.1.1' + LastUpdated: Aug 28, 2023 +Product: + Name: Source Agnostic +Normalization: + Schema: ProcessEvent + Version: '0.1.0' +References: +- Title: ASIM Process Schema + Link: https://aka.ms/ASimProcessEventDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +Description: | + This ASIM parser supports normalizing process event logs from all supported sources to the ASIM ProcessEvent normalized schema. +ParserName: imProcess +ParserParams: + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: commandline_has_any + Type: dynamic + Default: dynamic([]) + - Name: commandline_has_all + Type: dynamic + Default: dynamic([]) + - Name: commandline_has_any_ip_prefix + Type: dynamic + Default: dynamic([]) + - Name: actingprocess_has_any + Type: dynamic + Default: dynamic([]) + - Name: targetprocess_has_any + Type: dynamic + Default: dynamic([]) + - Name: parentprocess_has_any + Type: dynamic + Default: dynamic([]) + - Name: targetusername_has + Type: string + Default: '*' + - Name: actorusername_has + Type: string + Default: '*' + - Name: dvcipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: dvchostname_has_any + Type: dynamic + Default: dynamic([]) + - Name: eventtype + Type: string + Default: '*' + - Name: hashes_has_any + Type: dynamic + Default: dynamic([]) +ParserQuery: | + let Generic=(starttime:datetime=datetime(null), endtime:datetime=datetime(null), commandline_has_any:dynamic=dynamic([]), commandline_has_all:dynamic=dynamic([]), commandline_has_any_ip_prefix:dynamic=dynamic([]), actingprocess_has_any:dynamic=dynamic([]), targetprocess_has_any:dynamic=dynamic([]), parentprocess_has_any:dynamic=dynamic([]), targetusername_has:string='*', actorusername_has:string='*', dvcipaddr_has_any_prefix:dynamic=dynamic([]), dvchostname_has_any:dynamic=dynamic([]), eventtype:string='*', hashes_has_any:dynamic=dynamic([])){ + let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimProcess') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser); + let imProcessBuiltInDisabled=toscalar('ExcludeimProcessBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); + union isfuzzy=true + vimProcessEmpty + , vimProcessEventMicrosoft365D ( starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, disabled=(imProcessBuiltInDisabled or('ExcludevimProcessEventMicrosoft365D' in (DisabledParsers) ))) + , vimProcessCreateMicrosoftSysmon ( starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, disabled=(imProcessBuiltInDisabled or('ExcludevimProcessCreateMicrosoftSysmon' in (DisabledParsers) ))) + , vimProcessTerminateMicrosoftSysmon ( starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, actorusername_has=actorusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, disabled=(imProcessBuiltInDisabled or('ExcludevimProcessTerminateMicrosoftSysmon' in (DisabledParsers) ))) + , vimProcessCreateMicrosoftSecurityEvents ( starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, disabled=(imProcessBuiltInDisabled or('ExcludevimProcessCreateMicrosoftSecurityEvents' in (DisabledParsers) ))) + , vimProcessTerminateMicrosoftSecurityEvents ( starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, actorusername=actorusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvcname_has_any=dvchostname_has_any, eventtype=eventtype, disabled=(imProcessBuiltInDisabled or('ExcludevimProcessTerminateMicrosoftSecurityEvents' in (DisabledParsers) ))) + , vimProcessCreateLinuxSysmon ( starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvcname_has_any=dvchostname_has_any, eventtype=eventtype, disabled=(imProcessBuiltInDisabled or('ExcludevimProcessCreateLinuxSysmon' in (DisabledParsers) ))) + , vimProcessTerminateLinuxSysmon ( starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, actorusername=actorusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvcname_has_any=dvchostname_has_any, eventtype=eventtype, disabled=(imProcessBuiltInDisabled or('ExcludevimProcessTerminateLinuxSysmon' in (DisabledParsers) ))) + , vimProcessTerminateMicrosoftWindowsEvents ( starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, actorusername_has=actorusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, disabled=(imProcessBuiltInDisabled or('ExcludevimProcessTerminateMicrosoftWindowsEvents' in (DisabledParsers) ))) + , vimProcessCreateMicrosoftWindowsEvents ( starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, disabled=(imProcessBuiltInDisabled or('ExcludevimProcessCreateMicrosoftWindowsEvents' in (DisabledParsers) ))) + , vimProcessEventMD4IoT ( starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvcname_has_any=dvchostname_has_any, eventtype=eventtype, disabled=(imProcessBuiltInDisabled or('ExcludevimProcessEventMD4IoT' in (DisabledParsers) ))) + , vimProcessCreateSentinelOne ( starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, disabled=(imProcessBuiltInDisabled or('ExcludevimProcessCreateSentinelOne' in (DisabledParsers) ))) + }; + Generic(starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any) + +EquivalentBuiltInParser: _Im_Process +Parsers: + - _Im_Process_Empty + - _Im_ProcessEvent_Microsoft365D + - _Im_ProcessCreate_MicrosoftSysmon + - _Im_ProcessTerminate_MicrosoftSysmon + - _Im_ProcessCreate_MicrosoftSecurityEvents + - _Im_ProcessTerminate_MicrosoftSecurityEvents + - _Im_ProcessCreate_LinuxSysmon + - _Im_ProcessTerminate_LinuxSysmon + - _Im_ProcessTerminate_MicrosoftWindowsEvents + - _Im_ProcessCreate_MicrosoftWindowsEvents + - _Im_ProcessCreate_MD4IoT + - _Im_ProcessCreate_SentinelOne diff --git a/Parsers/ASimProcessEvent/Parsers/imProcessCreate.yaml b/Parsers/ASimProcessEvent/Parsers/imProcessCreate.yaml index 6025f6a35a6..ccb0ccfe4b7 100644 --- a/Parsers/ASimProcessEvent/Parsers/imProcessCreate.yaml +++ b/Parsers/ASimProcessEvent/Parsers/imProcessCreate.yaml @@ -66,7 +66,8 @@ ParserQuery: | vimProcessCreateMicrosoftSecurityEvents(starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername, dvcipaddr_has_any_prefix, dvcname_has_any, eventtype, (imBuiltInDisabled or('ExcludevimProcessCreateMicrosoftSecurityEvents' in (DisabledParsers) ))), vimProcessCreateLinuxSysmon (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername, dvcipaddr_has_any_prefix, dvcname_has_any, eventtype, (imBuiltInDisabled or('ExcludevimProcessCreateLinuxSysmon' in (DisabledParsers) ))), vimProcessCreateMicrosoftWindowsEvents (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvcname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, (imBuiltInDisabled or('ExcludevimProcessCreateMicrosoftWindowsEvents' in (DisabledParsers) ))), - vimProcessCreateMD4IoT (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername, dvcipaddr_has_any_prefix, dvcname_has_any, eventtype, (imBuiltInDisabled or('ExcludevimProcessEventMD4IoT' in (DisabledParsers) ))) + vimProcessCreateMD4IoT (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername, dvcipaddr_has_any_prefix, dvcname_has_any, eventtype, (imBuiltInDisabled or('ExcludevimProcessEventMD4IoT' in (DisabledParsers) ))), + vimProcessCreateSentinelOne (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvcname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, (imBuiltInDisabled or('ExcludevimProcessCreateSentinelOne' in (DisabledParsers) ))) }; Generic(starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername=targetusername, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvcname_has_any=dvcipaddr_has_any_prefix, hashes_has_any=hashes_has_any, eventtype=eventtype) @@ -79,4 +80,5 @@ Parsers: - _Im_ProcessCreate_LinuxSysmon - _Im_ProcessCreate_MicrosoftWindowsEvents - _Im_ProcessCreate_MD4IoT + - _Im_ProcessCreate_SentinelOne diff --git a/Parsers/ASimProcessEvent/Parsers/vimProcessCreateSentinelOne.yaml b/Parsers/ASimProcessEvent/Parsers/vimProcessCreateSentinelOne.yaml new file mode 100644 index 00000000000..d40656aec75 --- /dev/null +++ b/Parsers/ASimProcessEvent/Parsers/vimProcessCreateSentinelOne.yaml @@ -0,0 +1,234 @@ +Parser: + Title: Process Create ASIM parser for SentinelOne + Version: '0.1.0' + LastUpdated: Sep 18, 2023 +Product: + Name: SentinelOne +Normalization: + Schema: ProcessEvent + Version: '0.1.4' +References: +- Title: ASIM ProcessEvent Schema + Link: https://aka.ms/ASimProcessEventDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: SentinelOne Documentation +- Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM Process Event normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: vimProcessCreateSentinelOne +EquivalentBuiltInParser: _Im_ProcessCreate_SentinelOne +ParserParams: + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: commandline_has_any + Type: dynamic + Default: dynamic([]) + - Name: commandline_has_all + Type: dynamic + Default: dynamic([]) + - Name: commandline_has_any_ip_prefix + Type: dynamic + Default: dynamic([]) + - Name: actingprocess_has_any + Type: dynamic + Default: dynamic([]) + - Name: targetprocess_has_any + Type: dynamic + Default: dynamic([]) + - Name: parentprocess_has_any + Type: dynamic + Default: dynamic([]) + - Name: targetusername_has + Type: string + Default: '*' + - Name: dvcipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: dvchostname_has_any + Type: dynamic + Default: dynamic([]) + - Name: eventtype + Type: string + Default: '*' + - Name: hashes_has_any + Type: dynamic + Default: dynamic([]) + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let ThreatConfidenceLookup_undefined = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_undefined: int + ) + [ + "FALSE_POSITIVE", 5, + "Undefined", 15, + "SUSPICIOUS", 25, + "TRUE_POSITIVE", 33 + ]; + let ThreatConfidenceLookup_suspicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_suspicious: int + ) + [ + "FALSE_POSITIVE", 40, + "Undefined", 50, + "SUSPICIOUS", 60, + "TRUE_POSITIVE", 67 + ]; + let ThreatConfidenceLookup_malicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_malicious: int + ) + [ + "FALSE_POSITIVE", 75, + "Undefined", 80, + "SUSPICIOUS", 90, + "TRUE_POSITIVE", 100 + ]; + let parser = ( + starttime: datetime=datetime(null), + endtime: datetime=datetime(null), + commandline_has_any: dynamic=dynamic([]), + commandline_has_all: dynamic=dynamic([]), + commandline_has_any_ip_prefix: dynamic=dynamic([]), + actingprocess_has_any: dynamic=dynamic([]), + targetprocess_has_any: dynamic=dynamic([]), + parentprocess_has_any: dynamic=dynamic([]), + targetusername_has: string='*', + dvcipaddr_has_any_prefix: dynamic=dynamic([]), + dvchostname_has_any: dynamic=dynamic([]), + eventtype: string='*', + hashes_has_any: dynamic=dynamic([]), + disabled: bool=false) { + let alldata = SentinelOne_CL + | where not(disabled) + and (isnull(starttime) or TimeGenerated >= starttime) + and (isnull(endtime) or TimeGenerated <= endtime) + and event_name_s == "Alerts." + and alertInfo_eventType_s == "PROCESSCREATION" + and (eventtype == '*' or eventtype == 'ProcessCreated') + and array_length(dvcipaddr_has_any_prefix) == 0 + and (targetusername_has == '*' or sourceProcessInfo_user_s has targetusername_has) + and (array_length(commandline_has_all) == 0 or targetProcessInfo_tgtProcCmdLine_s has_all (commandline_has_all)) + and (array_length(commandline_has_any) == 0 or targetProcessInfo_tgtProcCmdLine_s has_any (commandline_has_any)) + and (array_length(commandline_has_any_ip_prefix) == 0 or has_any_ipv4_prefix(targetProcessInfo_tgtProcCmdLine_s, commandline_has_any_ip_prefix)) + and (array_length(actingprocess_has_any) == 0 or sourceProcessInfo_name_s has_any (actingprocess_has_any)) + and (array_length(targetprocess_has_any) == 0 or targetProcessInfo_tgtProcName_s has_any (targetprocess_has_any)) + and (array_length(parentprocess_has_any) == 0 or sourceParentProcessInfo_name_s has_any (parentprocess_has_any)) + and (array_length(dvchostname_has_any) == 0 or agentDetectionInfo_name_s has_any (dvchostname_has_any)) + and (array_length(hashes_has_any) == 0 or targetProcessInfo_tgtFileHashSha1_s has_any (hashes_has_any) or targetProcessInfo_tgtFileHashSha256_s has_any (hashes_has_any)); + let undefineddata = alldata + | where ruleInfo_treatAsThreat_s == "UNDEFINED" + | lookup ThreatConfidenceLookup_undefined on alertInfo_analystVerdict_s; + let suspiciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Suspicious" + | lookup ThreatConfidenceLookup_suspicious on alertInfo_analystVerdict_s; + let maaliciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Malicious" + | lookup ThreatConfidenceLookup_malicious on alertInfo_analystVerdict_s; + union undefineddata, suspiciousdata, maaliciousdata + | extend ThreatConfidence = coalesce(ThreatConfidence_undefined, ThreatConfidence_suspicious, ThreatConfidence_malicious) + | project-rename + DvcId = agentDetectionInfo_uuid_g, + EventStartTime = sourceProcessInfo_pidStarttime_t, + TargetProcessCommandLine = targetProcessInfo_tgtProcCmdLine_s, + TargetProcessId = targetProcessInfo_tgtProcPid_s, + TargetProcessName = targetProcessInfo_tgtProcName_s, + EventUid = _ItemId, + TargetProcessCreationTime = targetProcessInfo_tgtProcessStartTime_t, + ActingProcessName = sourceProcessInfo_name_s, + ParentProcessName = sourceParentProcessInfo_name_s, + ActingProcessCommandLine = sourceProcessInfo_commandline_s, + ActingProcessGuid = sourceProcessInfo_uniqueId_g, + ActingProcessSHA1 = sourceProcessInfo_fileHashSha1_s, + ParentProcessSHA1 = sourceParentProcessInfo_fileHashSha1_s, + ActingProcessSHA256 = sourceProcessInfo_fileHashSha256_s, + ParentProcessSHA256 = sourceParentProcessInfo_fileHashSha256_s, + DvcOs = agentDetectionInfo_osName_s, + DvcOsVersion = agentDetectionInfo_osRevision_s, + TargetProcessIntegrityLevel = targetProcessInfo_tgtProcIntegrityLevel_s, + EventOriginalType = alertInfo_eventType_s, + EventOriginalSeverity = ruleInfo_severity_s, + EventOriginalUid = alertInfo_dvEventId_s, + RuleName = ruleInfo_name_s, + ThreatOriginalConfidence = ruleInfo_treatAsThreat_s + | invoke _ASIM_ResolveDvcFQDN('agentDetectionInfo_name_s') + | extend + ActingProcessId = sourceProcessInfo_pid_s, + ActorUsername = sourceProcessInfo_user_s, + TargetUsername = sourceProcessInfo_user_s, + Hash = coalesce(targetProcessInfo_tgtFileHashSha256_s, targetProcessInfo_tgtFileHashSha1_s), + ParentProcessId = sourceProcessInfo_pid_s, + TargetProcessSHA1 = targetProcessInfo_tgtFileHashSha1_s, + TargetProcessSHA256 = targetProcessInfo_tgtFileHashSha256_s, + ParentProcessMD5 = replace_string(sourceParentProcessInfo_fileHashMd5_g, "-", ""), + ActingProcessMD5 = replace_string(sourceProcessInfo_fileHashMd5_g, "-", ""), + EventSeverity = iff(EventOriginalSeverity == "Critical", "High", EventOriginalSeverity) + | extend + EventCount = int(1), + EventProduct = "SentinelOne", + EventResult = "Success", + DvcAction = "Allowed", + EventSchemaVersion = "0.1.4", + EventType = "ProcessCreated", + EventVendor = "SentinelOne", + EventSchema = "ProcessEvent" + | extend + Dvc = DvcId, + EventEndTime = EventStartTime, + User = TargetUsername, + ActingProcessCreationTime = EventStartTime, + CommandLine = TargetProcessCommandLine, + Process = TargetProcessName, + Rule = RuleName + | extend + HashType = case( + isnotempty(Hash) and isnotempty(TargetProcessSHA256), + "TargetProcessSHA256", + isnotempty(Hash) and isnotempty(TargetProcessSHA1), + "TargetProcessSHA1", + "" + ), + TargetUsernameType = _ASIM_GetUsernameType(TargetUsername), + TargetUserType = _ASIM_GetUserType(TargetUsername, ""), + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + ActorUsernameType = _ASIM_GetUsernameType(ActorUsername), + ActorUserType = _ASIM_GetUserType(ActorUsername, "") + | project-away + *_d, + *_s, + *_g, + *_t, + *_b, + _ResourceId, + TenantId, + RawData, + Computer, + MG, + ManagementGroupName, + SourceSystem, + ThreatConfidence_* + }; + parser( + starttime=starttime, + endtime=endtime, + commandline_has_any=commandline_has_any, + commandline_has_all=commandline_has_all, + commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, + actingprocess_has_any=actingprocess_has_any, + targetprocess_has_any=targetprocess_has_any, + parentprocess_has_any=parentprocess_has_any, + targetusername_has=targetusername_has, + dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, + dvchostname_has_any=dvchostname_has_any, + eventtype=eventtype, + hashes_has_any=hashes_has_any, + disabled=disabled + ) \ No newline at end of file diff --git a/Parsers/ASimProcessEvent/test/SentinelOne_ASimProcessCreate_DataTest.csv b/Parsers/ASimProcessEvent/test/SentinelOne_ASimProcessCreate_DataTest.csv new file mode 100644 index 00000000000..88a92faa256 --- /dev/null +++ b/Parsers/ASimProcessEvent/test/SentinelOne_ASimProcessCreate_DataTest.csv @@ -0,0 +1,23 @@ +Result +"(0) Error: 1 invalid value(s) (up to 10 listed) in 5185 records (100.0%) for field [EventProduct] of type [Enumerated]: [""SentinelOne""] (Schema:ProcessEvent)" +"(0) Error: 1 invalid value(s) (up to 10 listed) in 5185 records (100.0%) for field [EventVendor] of type [Enumerated]: [""SentinelOne""] (Schema:ProcessEvent)" +"(1) Warning: Empty value in 2 records (0.04%) in mandatory field [TargetProcessName] (Schema:ProcessEvent)" +"(1) Warning: Empty value in 4849 records (93.52%) in mandatory field [ActorUsername] (Schema:ProcessEvent)" +"(1) Warning: Empty value in 4849 records (93.52%) in mandatory field [TargetUsername] (Schema:ProcessEvent)" +"(1) Warning: Empty value in 6 records (0.12%) in mandatory field [TargetProcessCommandLine] (Schema:ProcessEvent)" +"(2) Info: Empty value in 140 records (2.7%) in optional field [ActingProcessCommandLine] (Schema:ProcessEvent)" +"(2) Info: Empty value in 140 records (2.7%) in optional field [ActingProcessName] (Schema:ProcessEvent)" +"(2) Info: Empty value in 3125 records (60.27%) in optional field [ParentProcessSHA1] (Schema:ProcessEvent)" +"(2) Info: Empty value in 336 records (6.48%) in optional field [ActingProcessGuid] (Schema:ProcessEvent)" +"(2) Info: Empty value in 3560 records (68.66%) in optional field [DvcFQDN] (Schema:ProcessEvent)" +"(2) Info: Empty value in 3560 records (68.66%) in recommended field [DvcDomain] (Schema:ProcessEvent)" +"(2) Info: Empty value in 469 records (9.05%) in optional field [ParentProcessName] (Schema:ProcessEvent)" +"(2) Info: Empty value in 4849 records (93.52%) in optional field [ActingProcessMD5] (Schema:ProcessEvent)" +"(2) Info: Empty value in 4849 records (93.52%) in optional field [ActingProcessSHA256] (Schema:ProcessEvent)" +"(2) Info: Empty value in 4849 records (93.52%) in optional field [ActorUserType] (Schema:ProcessEvent)" +"(2) Info: Empty value in 4849 records (93.52%) in optional field [TargetUserType] (Schema:ProcessEvent)" +"(2) Info: Empty value in 4851 records (93.56%) in optional field [ParentProcessMD5] (Schema:ProcessEvent)" +"(2) Info: Empty value in 4851 records (93.56%) in optional field [ParentProcessSHA256] (Schema:ProcessEvent)" +"(2) Info: Empty value in 5185 records (100.0%) in optional field [TargetProcessSHA1] (Schema:ProcessEvent)" +"(2) Info: Empty value in 5185 records (100.0%) in optional field [TargetProcessSHA256] (Schema:ProcessEvent)" +"(2) Info: Empty value in 962 records (18.55%) in optional field [ActingProcessSHA1] (Schema:ProcessEvent)" diff --git a/Parsers/ASimProcessEvent/test/SentinelOne_ASimProcessCreate_SchemaTest.csv b/Parsers/ASimProcessEvent/test/SentinelOne_ASimProcessCreate_SchemaTest.csv new file mode 100644 index 00000000000..b9b65b4c8f4 --- /dev/null +++ b/Parsers/ASimProcessEvent/test/SentinelOne_ASimProcessCreate_SchemaTest.csv @@ -0,0 +1,82 @@ +Result +"(1) Warning: Missing recommended field [ActorUserId]" +"(1) Warning: Missing recommended field [DvcIpAddr]" +"(1) Warning: Missing recommended field [TargetUserId]" +"(2) Info: Missing optional field [ActingProcessFileCompany]" +"(2) Info: Missing optional field [ActingProcessFileDescription]" +"(2) Info: Missing optional field [ActingProcessFileInternalName]" +"(2) Info: Missing optional field [ActingProcessFileOriginalName]" +"(2) Info: Missing optional field [ActingProcessFileProduct]" +"(2) Info: Missing optional field [ActingProcessFileSize]" +"(2) Info: Missing optional field [ActingProcessFileVersion]" +"(2) Info: Missing optional field [ActingProcessFilename]" +"(2) Info: Missing optional field [ActingProcessIMPHASH]" +"(2) Info: Missing optional field [ActingProcessInjectedAddress]" +"(2) Info: Missing optional field [ActingProcessIntegrityLevel]" +"(2) Info: Missing optional field [ActingProcessIsHidden]" +"(2) Info: Missing optional field [ActingProcessSHA512]" +"(2) Info: Missing optional field [ActingProcessTokenElevation]" +"(2) Info: Missing optional field [ActorOriginalUserType]" +"(2) Info: Missing optional field [ActorScopeId]" +"(2) Info: Missing optional field [ActorScope]" +"(2) Info: Missing optional field [ActorSessionId]" +"(2) Info: Missing optional field [ActorUserAadId]" +"(2) Info: Missing optional field [ActorUserSid]" +"(2) Info: Missing optional field [ActorUserUpn]" +"(2) Info: Missing optional field [AdditionalFields]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EventMessage]" +"(2) Info: Missing optional field [EventOriginalResultDetails]" +"(2) Info: Missing optional field [EventOriginalSubType]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [EventResultDetails]" +"(2) Info: Missing optional field [EventSubType]" +"(2) Info: Missing optional field [ParentProcessCreationTime]" +"(2) Info: Missing optional field [ParentProcessFileCompany]" +"(2) Info: Missing optional field [ParentProcessFileDescription]" +"(2) Info: Missing optional field [ParentProcessFileProduct]" +"(2) Info: Missing optional field [ParentProcessFileVersion]" +"(2) Info: Missing optional field [ParentProcessGuid]" +"(2) Info: Missing optional field [ParentProcessIMPHASH]" +"(2) Info: Missing optional field [ParentProcessInjectedAddress]" +"(2) Info: Missing optional field [ParentProcessIntegrityLevel]" +"(2) Info: Missing optional field [ParentProcessIsHidden]" +"(2) Info: Missing optional field [ParentProcessSHA512]" +"(2) Info: Missing optional field [ParentProcessTokenElevation]" +"(2) Info: Missing optional field [TargetOriginalUserType]" +"(2) Info: Missing optional field [TargetProcessCurrentDirectory]" +"(2) Info: Missing optional field [TargetProcessFileCompany]" +"(2) Info: Missing optional field [TargetProcessFileDescription]" +"(2) Info: Missing optional field [TargetProcessFileInternalName]" +"(2) Info: Missing optional field [TargetProcessFileOriginalName]" +"(2) Info: Missing optional field [TargetProcessFileProduct]" +"(2) Info: Missing optional field [TargetProcessFileSize]" +"(2) Info: Missing optional field [TargetProcessFileVersion]" +"(2) Info: Missing optional field [TargetProcessFilename]" +"(2) Info: Missing optional field [TargetProcessGuid]" +"(2) Info: Missing optional field [TargetProcessIMPHASH]" +"(2) Info: Missing optional field [TargetProcessInjectedAddress]" +"(2) Info: Missing optional field [TargetProcessIsHidden]" +"(2) Info: Missing optional field [TargetProcessMD5]" +"(2) Info: Missing optional field [TargetProcessSHA512]" +"(2) Info: Missing optional field [TargetProcessStatusCode]" +"(2) Info: Missing optional field [TargetProcessTokenElevation]" +"(2) Info: Missing optional field [TargetScopeId]" +"(2) Info: Missing optional field [TargetScope]" +"(2) Info: Missing optional field [TargetUserAadId]" +"(2) Info: Missing optional field [TargetUserSessionGuid]" +"(2) Info: Missing optional field [TargetUserSessionId]" +"(2) Info: Missing optional field [TargetUserSid]" +"(2) Info: Missing optional field [TargetUserUpn]" +"(2) Info: extra unnormalized column [RuleName]" +"(2) Info: extra unnormalized column [Rule]" +"(2) Info: extra unnormalized column [ThreatConfidence]" +"(2) Info: extra unnormalized column [ThreatOriginalConfidence]" diff --git a/Parsers/ASimProcessEvent/test/SentinelOne_vimProcessCreate_DataTest.csv b/Parsers/ASimProcessEvent/test/SentinelOne_vimProcessCreate_DataTest.csv new file mode 100644 index 00000000000..88a92faa256 --- /dev/null +++ b/Parsers/ASimProcessEvent/test/SentinelOne_vimProcessCreate_DataTest.csv @@ -0,0 +1,23 @@ +Result +"(0) Error: 1 invalid value(s) (up to 10 listed) in 5185 records (100.0%) for field [EventProduct] of type [Enumerated]: [""SentinelOne""] (Schema:ProcessEvent)" +"(0) Error: 1 invalid value(s) (up to 10 listed) in 5185 records (100.0%) for field [EventVendor] of type [Enumerated]: [""SentinelOne""] (Schema:ProcessEvent)" +"(1) Warning: Empty value in 2 records (0.04%) in mandatory field [TargetProcessName] (Schema:ProcessEvent)" +"(1) Warning: Empty value in 4849 records (93.52%) in mandatory field [ActorUsername] (Schema:ProcessEvent)" +"(1) Warning: Empty value in 4849 records (93.52%) in mandatory field [TargetUsername] (Schema:ProcessEvent)" +"(1) Warning: Empty value in 6 records (0.12%) in mandatory field [TargetProcessCommandLine] (Schema:ProcessEvent)" +"(2) Info: Empty value in 140 records (2.7%) in optional field [ActingProcessCommandLine] (Schema:ProcessEvent)" +"(2) Info: Empty value in 140 records (2.7%) in optional field [ActingProcessName] (Schema:ProcessEvent)" +"(2) Info: Empty value in 3125 records (60.27%) in optional field [ParentProcessSHA1] (Schema:ProcessEvent)" +"(2) Info: Empty value in 336 records (6.48%) in optional field [ActingProcessGuid] (Schema:ProcessEvent)" +"(2) Info: Empty value in 3560 records (68.66%) in optional field [DvcFQDN] (Schema:ProcessEvent)" +"(2) Info: Empty value in 3560 records (68.66%) in recommended field [DvcDomain] (Schema:ProcessEvent)" +"(2) Info: Empty value in 469 records (9.05%) in optional field [ParentProcessName] (Schema:ProcessEvent)" +"(2) Info: Empty value in 4849 records (93.52%) in optional field [ActingProcessMD5] (Schema:ProcessEvent)" +"(2) Info: Empty value in 4849 records (93.52%) in optional field [ActingProcessSHA256] (Schema:ProcessEvent)" +"(2) Info: Empty value in 4849 records (93.52%) in optional field [ActorUserType] (Schema:ProcessEvent)" +"(2) Info: Empty value in 4849 records (93.52%) in optional field [TargetUserType] (Schema:ProcessEvent)" +"(2) Info: Empty value in 4851 records (93.56%) in optional field [ParentProcessMD5] (Schema:ProcessEvent)" +"(2) Info: Empty value in 4851 records (93.56%) in optional field [ParentProcessSHA256] (Schema:ProcessEvent)" +"(2) Info: Empty value in 5185 records (100.0%) in optional field [TargetProcessSHA1] (Schema:ProcessEvent)" +"(2) Info: Empty value in 5185 records (100.0%) in optional field [TargetProcessSHA256] (Schema:ProcessEvent)" +"(2) Info: Empty value in 962 records (18.55%) in optional field [ActingProcessSHA1] (Schema:ProcessEvent)" diff --git a/Parsers/ASimProcessEvent/test/SentinelOne_vimProcessCreate_SchemaTest.csv b/Parsers/ASimProcessEvent/test/SentinelOne_vimProcessCreate_SchemaTest.csv new file mode 100644 index 00000000000..b9b65b4c8f4 --- /dev/null +++ b/Parsers/ASimProcessEvent/test/SentinelOne_vimProcessCreate_SchemaTest.csv @@ -0,0 +1,82 @@ +Result +"(1) Warning: Missing recommended field [ActorUserId]" +"(1) Warning: Missing recommended field [DvcIpAddr]" +"(1) Warning: Missing recommended field [TargetUserId]" +"(2) Info: Missing optional field [ActingProcessFileCompany]" +"(2) Info: Missing optional field [ActingProcessFileDescription]" +"(2) Info: Missing optional field [ActingProcessFileInternalName]" +"(2) Info: Missing optional field [ActingProcessFileOriginalName]" +"(2) Info: Missing optional field [ActingProcessFileProduct]" +"(2) Info: Missing optional field [ActingProcessFileSize]" +"(2) Info: Missing optional field [ActingProcessFileVersion]" +"(2) Info: Missing optional field [ActingProcessFilename]" +"(2) Info: Missing optional field [ActingProcessIMPHASH]" +"(2) Info: Missing optional field [ActingProcessInjectedAddress]" +"(2) Info: Missing optional field [ActingProcessIntegrityLevel]" +"(2) Info: Missing optional field [ActingProcessIsHidden]" +"(2) Info: Missing optional field [ActingProcessSHA512]" +"(2) Info: Missing optional field [ActingProcessTokenElevation]" +"(2) Info: Missing optional field [ActorOriginalUserType]" +"(2) Info: Missing optional field [ActorScopeId]" +"(2) Info: Missing optional field [ActorScope]" +"(2) Info: Missing optional field [ActorSessionId]" +"(2) Info: Missing optional field [ActorUserAadId]" +"(2) Info: Missing optional field [ActorUserSid]" +"(2) Info: Missing optional field [ActorUserUpn]" +"(2) Info: Missing optional field [AdditionalFields]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EventMessage]" +"(2) Info: Missing optional field [EventOriginalResultDetails]" +"(2) Info: Missing optional field [EventOriginalSubType]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [EventResultDetails]" +"(2) Info: Missing optional field [EventSubType]" +"(2) Info: Missing optional field [ParentProcessCreationTime]" +"(2) Info: Missing optional field [ParentProcessFileCompany]" +"(2) Info: Missing optional field [ParentProcessFileDescription]" +"(2) Info: Missing optional field [ParentProcessFileProduct]" +"(2) Info: Missing optional field [ParentProcessFileVersion]" +"(2) Info: Missing optional field [ParentProcessGuid]" +"(2) Info: Missing optional field [ParentProcessIMPHASH]" +"(2) Info: Missing optional field [ParentProcessInjectedAddress]" +"(2) Info: Missing optional field [ParentProcessIntegrityLevel]" +"(2) Info: Missing optional field [ParentProcessIsHidden]" +"(2) Info: Missing optional field [ParentProcessSHA512]" +"(2) Info: Missing optional field [ParentProcessTokenElevation]" +"(2) Info: Missing optional field [TargetOriginalUserType]" +"(2) Info: Missing optional field [TargetProcessCurrentDirectory]" +"(2) Info: Missing optional field [TargetProcessFileCompany]" +"(2) Info: Missing optional field [TargetProcessFileDescription]" +"(2) Info: Missing optional field [TargetProcessFileInternalName]" +"(2) Info: Missing optional field [TargetProcessFileOriginalName]" +"(2) Info: Missing optional field [TargetProcessFileProduct]" +"(2) Info: Missing optional field [TargetProcessFileSize]" +"(2) Info: Missing optional field [TargetProcessFileVersion]" +"(2) Info: Missing optional field [TargetProcessFilename]" +"(2) Info: Missing optional field [TargetProcessGuid]" +"(2) Info: Missing optional field [TargetProcessIMPHASH]" +"(2) Info: Missing optional field [TargetProcessInjectedAddress]" +"(2) Info: Missing optional field [TargetProcessIsHidden]" +"(2) Info: Missing optional field [TargetProcessMD5]" +"(2) Info: Missing optional field [TargetProcessSHA512]" +"(2) Info: Missing optional field [TargetProcessStatusCode]" +"(2) Info: Missing optional field [TargetProcessTokenElevation]" +"(2) Info: Missing optional field [TargetScopeId]" +"(2) Info: Missing optional field [TargetScope]" +"(2) Info: Missing optional field [TargetUserAadId]" +"(2) Info: Missing optional field [TargetUserSessionGuid]" +"(2) Info: Missing optional field [TargetUserSessionId]" +"(2) Info: Missing optional field [TargetUserSid]" +"(2) Info: Missing optional field [TargetUserUpn]" +"(2) Info: extra unnormalized column [RuleName]" +"(2) Info: extra unnormalized column [Rule]" +"(2) Info: extra unnormalized column [ThreatConfidence]" +"(2) Info: extra unnormalized column [ThreatOriginalConfidence]" diff --git a/Parsers/ASimRegistryEvent/Parsers/ASimRegistry.yaml b/Parsers/ASimRegistryEvent/Parsers/ASimRegistry.yaml new file mode 100644 index 00000000000..36314645a9a --- /dev/null +++ b/Parsers/ASimRegistryEvent/Parsers/ASimRegistry.yaml @@ -0,0 +1,28 @@ +Parser: + Title: Registry Event ASIM Parser + Version: '0.1.0' + LastUpdated: Sep 20, 2023 +Product: + Name: Source Agnostic +Normalization: + Schema: RegistryEvent + Version: '0.1.2' +References: +- Title: ASIM Registry Schema + Link: https://aka.ms/ASimRegistryEventDoc +- Title: ASIM + Link: https:/aka.ms/AboutASIM +Description: | + This ASIM parser supports normalizing Registry Event logs from all supported sources to the ASIM Registry Event normalized schema. +ParserName: ASimRegistry +EquivalentBuiltInParser: _ASim_RegistryEvent +Parsers: + - _Im_RegistryEvent_Empty + - _ASim_RegistryEvent_Microsoft365D + - _ASim_RegistryEvent_MicrosoftSysmon + - _ASim_RegistryEvent_MicrosoftWindowsEvent + - _ASim_RegistryEvent_SentinelOne +ParserQuery: | + union isfuzzy=true + vimRegistryEventEmpty, + ASimRegistryEventSentinelOne \ No newline at end of file diff --git a/Parsers/ASimRegistryEvent/Parsers/ASimRegistryEventSentinelOne.yaml b/Parsers/ASimRegistryEvent/Parsers/ASimRegistryEventSentinelOne.yaml new file mode 100644 index 00000000000..6619a41e603 --- /dev/null +++ b/Parsers/ASimRegistryEvent/Parsers/ASimRegistryEventSentinelOne.yaml @@ -0,0 +1,180 @@ +Parser: + Title: Registry Event ASIM Parser for SentinelOne + Version: '0.1.0' + LastUpdated: Sep 20, 2023 +Product: + Name: SentinelOne +Normalization: + Schema: RegistryEvent + Version: '0.1.2' +References: +- Title: ASIM Registry Schema + Link: https://aka.ms/ASimRegistryEventDoc +- Title: ASIM + Link: https:/aka.ms/AboutASIM +- Title: SentinelOne documentation + Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM Registry Event normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: ASimRegistryEventSentinelOne +EquivalentBuiltInParser: _ASim_RegistryEvent_SentinelOne +ParserParams: + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let EventTypeLookup = datatable (alertInfo_eventType_s: string, EventType: string) + [ + "REGVALUEMODIFIED", "RegistryValueSet", + "REGVALUECREATE", "RegistryValueSet", + "REGKEYCREATE", "RegistryKeyCreated", + "REGKEYDELETE", "RegistryKeyDeleted", + "REGVALUEDELETE", "RegistryValueDeleted", + "REGKEYRENAME", "RegistryKeyRenamed" + ]; + let RegistryKeyPrefixLookup = datatable ( + RegistryKeyPrefix: string, + RegistryKeyNormalizedPrefix: string + ) + [ + "MACHINE", "HKEY_LOCAL_MACHINE", + "USER", "HKEY_USERS", + "CONFIG", "HKEY_CURRENT_CONFIG", + "ROOT", "HKEY_CLASSES_ROOT" + ]; + let RegistryPreviousValueTypeLookup = datatable ( + alertInfo_registryOldValueType_s: string, + RegistryPreviousValueType_lookup: string + ) + [ + "BINARY", "Reg_Binary", + "DWORD", "Reg_DWord", + "QWORD", "Reg_QWord", + "SZ", "Reg_Sz", + "EXPAND_SZ", "Reg_Expand_Sz", + "MULTI_SZ", "Reg_Multi_Sz", + "DWORD_BIG_ENDIAN", "Reg_DWord" + ]; + let ThreatConfidenceLookup_undefined = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_undefined: int + ) + [ + "FALSE_POSITIVE", 5, + "Undefined", 15, + "SUSPICIOUS", 25, + "TRUE_POSITIVE", 33 + ]; + let ThreatConfidenceLookup_suspicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_suspicious: int + ) + [ + "FALSE_POSITIVE", 40, + "Undefined", 50, + "SUSPICIOUS", 60, + "TRUE_POSITIVE", 67 + ]; + let ThreatConfidenceLookup_malicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_malicious: int + ) + [ + "FALSE_POSITIVE", 75, + "Undefined", 80, + "SUSPICIOUS", 90, + "TRUE_POSITIVE", 100 + ]; + let parser = (disabled: bool=false) { + let alldata = SentinelOne_CL + | where not(disabled) + and event_name_s == "Alerts." + and alertInfo_eventType_s in ("REGVALUEMODIFIED", "REGVALUECREATE", "REGKEYCREATE", "REGKEYDELETE", "REGVALUEDELETE", "REGKEYRENAME") + | lookup EventTypeLookup on alertInfo_eventType_s + | lookup RegistryPreviousValueTypeLookup on alertInfo_registryOldValueType_s; + let undefineddata = alldata + | where ruleInfo_treatAsThreat_s == "UNDEFINED" + | lookup ThreatConfidenceLookup_undefined on alertInfo_analystVerdict_s; + let suspiciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Suspicious" + | lookup ThreatConfidenceLookup_suspicious on alertInfo_analystVerdict_s; + let maliciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Malicious" + | lookup ThreatConfidenceLookup_malicious on alertInfo_analystVerdict_s; + union undefineddata, suspiciousdata, maliciousdata + | invoke _ASIM_ResolveDvcFQDN('agentDetectionInfo_name_s') + | extend RegistryKeyPrefix = tostring(split(alertInfo_registryKeyPath_s, @'\')[0]) + | lookup RegistryKeyPrefixLookup on RegistryKeyPrefix + | extend RegistryKey = replace_string(alertInfo_registryKeyPath_s, RegistryKeyPrefix, RegistryKeyNormalizedPrefix) + | extend RegistryValue = iff(alertInfo_eventType_s in ("REGVALUEMODIFIED", "REGVALUECREATE", "REGVALUEDELETE"), tostring(split(alertInfo_registryKeyPath_s, @'\')[-1]), "") + | extend RegistryValueType = case( + alertInfo_registryValue_s matches regex '^[0-9]+$', + "Reg_Dword", + alertInfo_registryValue_s startswith "0x" and strlen(alertInfo_registryValue_s) <= 10, + "Reg_DWord", + alertInfo_registryValue_s startswith "0x" and strlen(alertInfo_registryValue_s) > 10, + "Reg_QWord", + alertInfo_registryValue_s matches regex '^[A-Fa-f0-9]+$', + "Reg_Binary", + "" + ) + | extend RegistryValueType = iff(alertInfo_eventType_s in ("REGVALUEMODIFIED", "REGVALUECREATE") and isempty(RegistryValueType), "Reg_Sz", RegistryValueType), + ThreatConfidence = coalesce(ThreatConfidence_undefined, ThreatConfidence_suspicious, ThreatConfidence_malicious) + | project-rename + ActingProcessId = sourceProcessInfo_pid_s, + ActorUsername = sourceProcessInfo_user_s, + EventStartTime= sourceProcessInfo_pidStarttime_t, + EventOriginalSeverity = ruleInfo_severity_s, + EventUid = _ItemId, + ParentProcessId = sourceParentProcessInfo_pid_s, + ActingProcessName = sourceProcessInfo_name_s, + DvcId = agentDetectionInfo_uuid_g, + DvcOs = agentDetectionInfo_osName_s, + DvcOsVersion = agentDetectionInfo_osRevision_s, + EventOriginalType = alertInfo_eventType_s, + ParentProcessName = sourceParentProcessInfo_name_s, + RegistryValueData = alertInfo_registryValue_s, + EventOriginalUid = alertInfo_dvEventId_s, + RuleName = ruleInfo_name_s, + ThreatOriginalConfidence = ruleInfo_treatAsThreat_s + | extend + EventCount = int(1), + EventProduct = "SentinelOne", + EventVendor = "SentinelOne", + EventResult = "Success", + DvcAction = "Allowed", + EventSchema = "RegistryEvent", + EventSchemaVersion = "0.1.2" + | extend + Dvc = coalesce(DvcHostname, EventProduct), + EventEndTime = EventStartTime, + EventSeverity = iff(EventOriginalSeverity == "Critical", "High", EventOriginalSeverity), + RegistryPreviousKey = RegistryKey, + RegistryPreviousValueData = coalesce(alertInfo_registryOldValue_s, RegistryValueData), + RegistryPreviousValueType = coalesce(RegistryPreviousValueType_lookup, RegistryValueType), + RegistryPreviousValue = RegistryValue, + Process = ActingProcessName, + User = ActorUsername, + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + ActorUsernameType = _ASIM_GetUsernameType(ActorUsername), + ActorUserType = _ASIM_GetUserType(ActorUsername, ""), + Rule = RuleName + | project-away + *_d, + *_s, + *_g, + *_t, + *_b, + _ResourceId, + Computer, + MG, + ManagementGroupName, + RawData, + SourceSystem, + TenantId, + RegistryKeyPrefix, + RegistryKeyNormalizedPrefix, + RegistryPreviousValueType_lookup, + ThreatConfidence_* + }; + parser(disabled = disabled) \ No newline at end of file diff --git a/Parsers/ASimRegistryEvent/Parsers/imRegistry.yaml b/Parsers/ASimRegistryEvent/Parsers/imRegistry.yaml index 52ca7f629a9..c2a83982a11 100644 --- a/Parsers/ASimRegistryEvent/Parsers/imRegistry.yaml +++ b/Parsers/ASimRegistryEvent/Parsers/imRegistry.yaml @@ -12,14 +12,22 @@ References: Link: https://aka.ms/ASimRegistryEventDoc - Title: ASIM Link: https:/aka.ms/AboutASIM - Description: | This ASIM parser supports normalizing Registry Event logs from all supported sources to the ASIM Registry Event normalized schema. ParserName: imRegistry +EquivalentBuiltInParser: _Im_RegistryEvent +Parsers: + - _Im_RegistryEvent_Empty + # - _Im_RegistryEvent_MicrosoftSecurityEvents // Deprecated + - _Im_RegistryEvent_Microsoft365D + - _Im_RegistryEvent_MicrosoftSysmon + - _Im_RegistryEvent_MicrosoftWindowsEvent + - _Im_RegistryEvent_SentinelOne ParserQuery: | union isfuzzy=true vimRegistryEventEmpty, vimRegistryEventMicrosoft365D, vimRegistryEventMicrosoftSysmon, // vimRegistryEventMicrosoftSecurityEvents, // Deprecated, now included in vimRegistryEventMicrosoftWindowsEvent. - vimRegistryEventMicrosoftWindowsEvent \ No newline at end of file + vimRegistryEventMicrosoftWindowsEvent, + vimRegistryEventSentinelOne \ No newline at end of file diff --git a/Parsers/ASimRegistryEvent/Parsers/vimRegistryEventSentinelOne.yaml b/Parsers/ASimRegistryEvent/Parsers/vimRegistryEventSentinelOne.yaml new file mode 100644 index 00000000000..bd9ded6d1df --- /dev/null +++ b/Parsers/ASimRegistryEvent/Parsers/vimRegistryEventSentinelOne.yaml @@ -0,0 +1,180 @@ +Parser: + Title: Registry Event ASIM Parser for SentinelOne + Version: '0.1.0' + LastUpdated: Sep 18, 2023 +Product: + Name: SentinelOne +Normalization: + Schema: RegistryEvent + Version: '0.1.2' +References: +- Title: ASIM Registry Schema + Link: https://aka.ms/ASimRegistryEventDoc +- Title: ASIM + Link: https:/aka.ms/AboutASIM +- Title: SentinelOne documentation + Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM Registry Event normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: vimRegistryEventSentinelOne +EquivalentBuiltInParser: _Im_RegistryEvent_SentinelOne +ParserParams: + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let EventTypeLookup = datatable (alertInfo_eventType_s: string, EventType: string) + [ + "REGVALUEMODIFIED", "RegistryValueSet", + "REGVALUECREATE", "RegistryValueSet", + "REGKEYCREATE", "RegistryKeyCreated", + "REGKEYDELETE", "RegistryKeyDeleted", + "REGVALUEDELETE", "RegistryValueDeleted", + "REGKEYRENAME", "RegistryKeyRenamed" + ]; + let RegistryKeyPrefixLookup = datatable ( + RegistryKeyPrefix: string, + RegistryKeyNormalizedPrefix: string + ) + [ + "MACHINE", "HKEY_LOCAL_MACHINE", + "USER", "HKEY_USERS", + "CONFIG", "HKEY_CURRENT_CONFIG", + "ROOT", "HKEY_CLASSES_ROOT" + ]; + let RegistryPreviousValueTypeLookup = datatable ( + alertInfo_registryOldValueType_s: string, + RegistryPreviousValueType_lookup: string + ) + [ + "BINARY", "Reg_Binary", + "DWORD", "Reg_DWord", + "QWORD", "Reg_QWord", + "SZ", "Reg_Sz", + "EXPAND_SZ", "Reg_Expand_Sz", + "MULTI_SZ", "Reg_Multi_Sz", + "DWORD_BIG_ENDIAN", "Reg_DWord" + ]; + let ThreatConfidenceLookup_undefined = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_undefined: int + ) + [ + "FALSE_POSITIVE", 5, + "Undefined", 15, + "SUSPICIOUS", 25, + "TRUE_POSITIVE", 33 + ]; + let ThreatConfidenceLookup_suspicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_suspicious: int + ) + [ + "FALSE_POSITIVE", 40, + "Undefined", 50, + "SUSPICIOUS", 60, + "TRUE_POSITIVE", 67 + ]; + let ThreatConfidenceLookup_malicious = datatable( + alertInfo_analystVerdict_s: string, + ThreatConfidence_malicious: int + ) + [ + "FALSE_POSITIVE", 75, + "Undefined", 80, + "SUSPICIOUS", 90, + "TRUE_POSITIVE", 100 + ]; + let parser = (disabled: bool=false) { + let alldata = SentinelOne_CL + | where not(disabled) + and event_name_s == "Alerts." + and alertInfo_eventType_s in ("REGVALUEMODIFIED", "REGVALUECREATE", "REGKEYCREATE", "REGKEYDELETE", "REGVALUEDELETE", "REGKEYRENAME") + | lookup EventTypeLookup on alertInfo_eventType_s + | lookup RegistryPreviousValueTypeLookup on alertInfo_registryOldValueType_s; + let undefineddata = alldata + | where ruleInfo_treatAsThreat_s == "UNDEFINED" + | lookup ThreatConfidenceLookup_undefined on alertInfo_analystVerdict_s; + let suspiciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Suspicious" + | lookup ThreatConfidenceLookup_suspicious on alertInfo_analystVerdict_s; + let maliciousdata = alldata + | where ruleInfo_treatAsThreat_s == "Malicious" + | lookup ThreatConfidenceLookup_malicious on alertInfo_analystVerdict_s; + union undefineddata, suspiciousdata, maliciousdata + | invoke _ASIM_ResolveDvcFQDN('agentDetectionInfo_name_s') + | extend RegistryKeyPrefix = tostring(split(alertInfo_registryKeyPath_s, @'\')[0]) + | lookup RegistryKeyPrefixLookup on RegistryKeyPrefix + | extend RegistryKey = replace_string(alertInfo_registryKeyPath_s, RegistryKeyPrefix, RegistryKeyNormalizedPrefix) + | extend RegistryValue = iff(alertInfo_eventType_s in ("REGVALUEMODIFIED", "REGVALUECREATE", "REGVALUEDELETE"), tostring(split(alertInfo_registryKeyPath_s, @'\')[-1]), "") + | extend RegistryValueType = case( + alertInfo_registryValue_s matches regex '^[0-9]+$', + "Reg_Dword", + alertInfo_registryValue_s startswith "0x" and strlen(alertInfo_registryValue_s) <= 10, + "Reg_DWord", + alertInfo_registryValue_s startswith "0x" and strlen(alertInfo_registryValue_s) > 10, + "Reg_QWord", + alertInfo_registryValue_s matches regex '^[A-Fa-f0-9]+$', + "Reg_Binary", + "" + ) + | extend RegistryValueType = iff(alertInfo_eventType_s in ("REGVALUEMODIFIED", "REGVALUECREATE") and isempty(RegistryValueType), "Reg_Sz", RegistryValueType), + ThreatConfidence = coalesce(ThreatConfidence_undefined, ThreatConfidence_suspicious, ThreatConfidence_malicious) + | project-rename + ActingProcessId = sourceProcessInfo_pid_s, + ActorUsername = sourceProcessInfo_user_s, + EventStartTime= sourceProcessInfo_pidStarttime_t, + EventOriginalSeverity = ruleInfo_severity_s, + EventUid = _ItemId, + ParentProcessId = sourceParentProcessInfo_pid_s, + ActingProcessName = sourceProcessInfo_name_s, + DvcId = agentDetectionInfo_uuid_g, + DvcOs = agentDetectionInfo_osName_s, + DvcOsVersion = agentDetectionInfo_osRevision_s, + EventOriginalType = alertInfo_eventType_s, + ParentProcessName = sourceParentProcessInfo_name_s, + RegistryValueData = alertInfo_registryValue_s, + EventOriginalUid = alertInfo_dvEventId_s, + RuleName = ruleInfo_name_s, + ThreatOriginalConfidence = ruleInfo_treatAsThreat_s + | extend + EventCount = int(1), + EventProduct = "SentinelOne", + EventVendor = "SentinelOne", + EventResult = "Success", + DvcAction = "Allowed", + EventSchema = "RegistryEvent", + EventSchemaVersion = "0.1.2" + | extend + Dvc = coalesce(DvcHostname, EventProduct), + EventEndTime = EventStartTime, + EventSeverity = iff(EventOriginalSeverity == "Critical", "High", EventOriginalSeverity), + RegistryPreviousKey = RegistryKey, + RegistryPreviousValueData = coalesce(alertInfo_registryOldValue_s, RegistryValueData), + RegistryPreviousValueType = coalesce(RegistryPreviousValueType_lookup, RegistryValueType), + RegistryPreviousValue = RegistryValue, + Process = ActingProcessName, + User = ActorUsername, + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + ActorUsernameType = _ASIM_GetUsernameType(ActorUsername), + ActorUserType = _ASIM_GetUserType(ActorUsername, ""), + Rule = RuleName + | project-away + *_d, + *_s, + *_g, + *_t, + *_b, + _ResourceId, + Computer, + MG, + ManagementGroupName, + RawData, + SourceSystem, + TenantId, + RegistryKeyPrefix, + RegistryKeyNormalizedPrefix, + RegistryPreviousValueType_lookup, + ThreatConfidence_* + }; + parser(disabled = disabled) \ No newline at end of file diff --git a/Parsers/ASimRegistryEvent/test/SentinelOne_vimRegistryEvent_DataTest.csv b/Parsers/ASimRegistryEvent/test/SentinelOne_vimRegistryEvent_DataTest.csv new file mode 100644 index 00000000000..0434f0ef7f2 --- /dev/null +++ b/Parsers/ASimRegistryEvent/test/SentinelOne_vimRegistryEvent_DataTest.csv @@ -0,0 +1,9 @@ +Result +"(0) Error: 1 invalid value(s) (up to 10 listed) in 159 records (100.0%) for field [EventProduct] of type [Enumerated]: [""SentinelOne""] (Schema:RegistryEvent)" +"(0) Error: 2 invalid value(s) (up to 10 listed) in 130 records (81.76%) for field [EventType] of type [Enumerated]: [""RegistryValueSet"",""RegistryValueDeleted""] (Schema:RegistryEvent)" +"(2) Info: Empty value in 29 records (18.24%) in recommended field [RegistryPreviousValue] (Schema:RegistryEvent)" +"(2) Info: Empty value in 29 records (18.24%) in recommended field [RegistryValue] (Schema:RegistryEvent)" +"(2) Info: Empty value in 40 records (25.16%) in recommended field [RegistryPreviousValueType] (Schema:RegistryEvent)" +"(2) Info: Empty value in 40 records (25.16%) in recommended field [RegistryValueType] (Schema:RegistryEvent)" +"(2) Info: Empty value in 56 records (35.22%) in recommended field [RegistryPreviousValueData] (Schema:RegistryEvent)" +"(2) Info: Empty value in 56 records (35.22%) in recommended field [RegistryValueData] (Schema:RegistryEvent)" diff --git a/Parsers/ASimRegistryEvent/test/SentinelOne_vimRegistryEvent_SchemaTest.csv b/Parsers/ASimRegistryEvent/test/SentinelOne_vimRegistryEvent_SchemaTest.csv new file mode 100644 index 00000000000..d77113676d3 --- /dev/null +++ b/Parsers/ASimRegistryEvent/test/SentinelOne_vimRegistryEvent_SchemaTest.csv @@ -0,0 +1,38 @@ +Result +"(1) Warning: Missing recommended field [ActorUserId]" +"(1) Warning: Missing recommended field [DvcIpAddr]" +"(2) Info: Missing optional field [ActingProcessGuid]" +"(2) Info: Missing optional field [ActorSessionId]" +"(2) Info: Missing optional field [AdditionalFields]" +"(2) Info: Missing optional field [DstDescription]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [EventMessage]" +"(2) Info: Missing optional field [EventOriginalSubType]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [ParentProcessGuid]" +"(2) Info: Missing optional field [RuleNumber]" +"(2) Info: Missing optional field [SrcDescription]" +"(2) Info: Missing optional field [ThreatCategory]" +"(2) Info: Missing optional field [ThreatField]" +"(2) Info: Missing optional field [ThreatFirstReportedTime]" +"(2) Info: Missing optional field [ThreatId]" +"(2) Info: Missing optional field [ThreatIsActive]" +"(2) Info: Missing optional field [ThreatLastReportedTime]" +"(2) Info: Missing optional field [ThreatName]" +"(2) Info: Missing optional field [ThreatOriginalRiskLevel]" +"(2) Info: Missing optional field [ThreatRiskLevel]" +"(2) Info: extra unnormalized column [ActorUserType]" +"(2) Info: extra unnormalized column [DvcAction]" +"(2) Info: extra unnormalized column [DvcDomainType]" +"(2) Info: extra unnormalized column [DvcDomain]" +"(2) Info: extra unnormalized column [DvcFQDN]" +"(2) Info: extra unnormalized column [DvcIdType]" +"(2) Info: extra unnormalized column [EventOriginalSeverity]" +"(2) Info: extra unnormalized column [EventSchema]" +"(2) Info: extra unnormalized column [EventSeverity]" +"(2) Info: extra unnormalized column [EventVendor]" diff --git a/Parsers/ASimUserManagement/Parsers/ASimUserManagement.yaml b/Parsers/ASimUserManagement/Parsers/ASimUserManagement.yaml index 0f812cc8625..00687de422b 100644 --- a/Parsers/ASimUserManagement/Parsers/ASimUserManagement.yaml +++ b/Parsers/ASimUserManagement/Parsers/ASimUserManagement.yaml @@ -18,7 +18,8 @@ ParserName: ASimUserManagement EquivalentBuiltInParser: _ASim_UserManagement Parsers: - _Im_UserManagement_Empty - - _ASim_UserManagement_MicrosoftSecurityEvent + - _ASim_UserManagement_MicrosoftSecurityEvent + - _ASim_UserManagement_SentinelOne ParserParams: - Name: pack Type: bool @@ -32,7 +33,8 @@ ParserQuery: | union isfuzzy=true vimUserManagementEmpty, ASimUserManagementMicrosoftSecurityEvent (ASimBuiltInDisabled or ('ExcludeASimUserManagementMicrosoftSecurityEvent' in (DisabledParsers))), - ASimUserManagementCiscoISE (ASimBuiltInDisabled or ('ExcludeASimUserManagementCiscoISE in (DisabledParsers))) + ASimUserManagementCiscoISE (ASimBuiltInDisabled or ('ExcludeASimUserManagementCiscoISE in (DisabledParsers))), + ASimUserManagementSentinelOne (ASimBuiltInDisabled or ('ExcludeASimUserManagementSentinelOne in (DisabledParsers))) }; parser ( pack=pack diff --git a/Parsers/ASimUserManagement/Parsers/ASimUserManagementSentinelOne.yaml b/Parsers/ASimUserManagement/Parsers/ASimUserManagementSentinelOne.yaml new file mode 100644 index 00000000000..57a5450cc62 --- /dev/null +++ b/Parsers/ASimUserManagement/Parsers/ASimUserManagementSentinelOne.yaml @@ -0,0 +1,144 @@ +Parser: + Title: User Management ASIM parser for SentinelOne + Version: '0.1.0' + LastUpdated: Aug 24, 2023 +Product: + Name: SentinelOne +Normalization: + Schema: UserManagement + Version: '0.1.1' +References: +- Title: ASIM UserManagement Schema + Link: https://aka.ms/ASimUserManagementDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: SentinelOne Documentation +- Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM User Management normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: ASimUserManagementSentinelOne +EquivalentBuiltInParser: _ASim_UserManagement_SentinelOne +ParserParams: + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let EventTypeLookup = datatable ( + activityType_d: real, + EventType: string, + EventOriginalType: string, + EventSubType: string + )[ + 23, "UserCreated", "User Added", "", + 24, "UserModified", "User Modified", "MultipleProperties", + 25, "UserDeleted", "User Deleted", "", + 37, "UserModified", "User modified", "MultipleProperties", + 102, "UserDeleted", "User Deleted", "", + 110, "UserModified", "Enable API Token Generation", "NewPermissions", + 111, "UserModified", "Disable API Token Generation", "PreviousPermissions", + 140, "UserCreated", "Service User creation", "", + 141, "UserModified", "Service User modification", "MultipleProperties", + 142, "UserDeleted", "Service User deletion", "", + 3522, "GroupCreated", "Ranger Deploy - Credential Group Created", "", + 3523, "GroupModified", "Ranger Deploy -Credential Group Edited", "MultipleProperties", + 3524, "GroupDeleted", "Ranger Deploy - Credential Group Deleted", "", + 3710, "PasswordReset", "User Reset Password with Forgot Password from the Login", "", + 3711, "PasswordChanged", "User Changed Their Password", "", + 3715, "PasswordReset", "User Reset Password by Admin Request", "", + 5006, "GroupDeleted", "Group Deleted", "", + 5008, "GroupCreated", "User created a Manual or Pinned Group", "", + 5011, "GroupModified", "Group Policy Reverted", "Newpolicy", + ]; + let parser = (disabled: bool=false) { + SentinelOne_CL + | where not(disabled) + and event_name_s == "Activities." + and activityType_d in (23, 24, 25, 37, 102, 110, 111, 140, 141, 142, 3522, 3523, 3524, 3710, 3711, 3715, 5006, 5008, 5011) + | parse-kv DataFields_s as (byUser: string, username: string, email: string, ipAddress: string, group: string, groupName: string, name: string, oldDescription: string, oldRole: string, description: string, role: string, userScope: string, scopeLevelName: string, scopeName: string, roleName: string, modifiedFields: string, deactivationPeriodInDays: string, descriptionChanged: string, groupType: string) with (pair_delimiter=",", kv_delimiter=":", quote='"') + | parse modifiedFields with 'Modified fields: ' ModifiedFields:string + | parse description_s with * "with id=" id: string "," restOfMessage + | lookup EventTypeLookup on activityType_d + | extend + ActorUsername = iff(activityType_d == 102, "SentinelOne", coalesce(byUser, username, email)), + GroupName = coalesce(group, groupName, name), + TargetUsername = iff(isnotempty(byUser), username, ""), + PreviousPropertyValue = coalesce(oldDescription, oldRole), + NewPropertyValue = coalesce(description, role) + | extend GroupName = iff(GroupName == "null", "", GroupName) + | project-rename + EventStartTime = createdAt_t, + SrcIpAddr = ipAddress, + EventUid = _ItemId, + ActorUserId = id, + GroupId = groupId_s, + EventMessage = primaryDescription_s, + EventOriginalUid = activityUuid_g + | extend + EventCount = int(1), + EventResult = "Success", + DvcAction = "Allowed", + EventSeverity = "Informational", + EventSchema = "UserManagement", + EventSchemaVersion = "0.1.1", + EventProduct = "SentinelOne", + EventVendor = "SentinelOne", + EventResultDetails = "Other" + | extend + Dvc = EventProduct, + EventEndTime = EventStartTime, + IpAddr = SrcIpAddr, + User = ActorUsername, + UpdatedPropertyName = EventSubType, + ActorUserIdType = iff(isnotempty(ActorUserId),"Other",""), + ActorUserType = _ASIM_GetUserType(ActorUsername,ActorUserId), + ActorUsernameType = _ASIM_GetUsernameType(ActorUsername), + GroupIdType = iff(isnotempty(GroupId), "UID", ""), + GroupNameType = iff(isnotempty(GroupName), "Simple", ""), + GroupType = iff(isnotempty(groupType), "Other", ""), + GroupOriginalType = groupType, + TargetUsernameType = _ASIM_GetUsernameType(TargetUsername), + TargetUserType = _ASIM_GetUserType(TargetUsername, ""), + AdditionalFields = bag_pack( + "userScope", userScope, + "scopeLevelName", scopeLevelName, + "scopeName", scopeName, + "modifiedFields", modifiedFields, + "roleName", roleName, + "deactivationPeriodInDays", deactivationPeriodInDays, + "descriptionChanged", descriptionChanged + ) + | project-away + *_b, + *_d, + *_g, + *_s, + *_t, + byUser, + username, + email, + group, + groupName, + groupType, + name, + oldDescription, + oldRole, + description, + role, + userScope, + scopeLevelName, + scopeName, + roleName, + modifiedFields, + ModifiedFields, + deactivationPeriodInDays, + descriptionChanged, + restOfMessage, + _ResourceId, + TenantId, + RawData, + Computer, + MG, + ManagementGroupName, + SourceSystem + }; + parser(disabled=disabled) \ No newline at end of file diff --git a/Parsers/ASimUserManagement/Parsers/imUserManagement.yaml b/Parsers/ASimUserManagement/Parsers/imUserManagement.yaml index c74f7ef8079..9e0178c423a 100644 --- a/Parsers/ASimUserManagement/Parsers/imUserManagement.yaml +++ b/Parsers/ASimUserManagement/Parsers/imUserManagement.yaml @@ -19,6 +19,7 @@ EquivalentBuiltInParser: _Im_UserManagement Parsers: - _Im_UserManagement_Empty - _Im_UserManagement_MicrosoftSecurityEvent + - _Im_UserManagement_SentinelOne ParserParams: - Name: starttime Type: datetime @@ -57,7 +58,8 @@ ParserQuery: | union isfuzzy=true vimUserManagementEmpty, vimUserManagementMicrosoftSecurityEvent(starttime, endtime, srcipaddr_has_any_prefix, targetusername_has_any, actorusername_has_any, eventtype_in, ASimBuiltInDisabled or ('ExcludevimUserManagementMicrosoftSecurityEvent' in (DisabledParsers) )), - vimUserManagementCiscoISE(starttime, endtime, srcipaddr_has_any_prefix, eventresult, eventtype_in, actorusername_has_any, ASimBuiltInDisabled or ('ExcludevimUserManagementCiscoISE' in (DisabledParsers) )) + vimUserManagementCiscoISE(starttime, endtime, srcipaddr_has_any_prefix, eventresult, eventtype_in, actorusername_has_any, ASimBuiltInDisabled or ('ExcludevimUserManagementCiscoISE' in (DisabledParsers) )), + vimUserManagementSentinelOne(starttime, endtime, targetusername_has, actorusername_has, targetdomain_has_any, anydomain_has_any, ASimBuiltInDisabled or ('ExcludevimUserManagementSentinelOne' in (DisabledParsers) )) }; parser ( starttime=starttime, diff --git a/Parsers/ASimUserManagement/Parsers/vimUserManagementSentinelOne.yaml b/Parsers/ASimUserManagement/Parsers/vimUserManagementSentinelOne.yaml new file mode 100644 index 00000000000..78fd4e9d92c --- /dev/null +++ b/Parsers/ASimUserManagement/Parsers/vimUserManagementSentinelOne.yaml @@ -0,0 +1,186 @@ +Parser: + Title: User Management ASIM parser for SentinelOne + Version: '0.1.0' + LastUpdated: Aug 24, 2023 +Product: + Name: SentinelOne +Normalization: + Schema: UserManagement + Version: '0.1.1' +References: +- Title: ASIM UserManagement Schema + Link: https://aka.ms/ASimUserManagementDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: SentinelOne Documentation +- Link: https://.sentinelone.net/api-doc/overview +Description: | + This ASIM parser supports normalizing SentinelOne logs to the ASIM User Management normalized schema. SentinelOne events are captured through SentinelOne data connector which ingests SentinelOne server objects such as Threats, Agents, Applications, Activities, Policies, Groups, and more events into Microsoft Sentinel through the REST API. +ParserName: vimUserManagementSentinelOne +EquivalentBuiltInParser: _Im_UserManagement_SentinelOne +ParserParams: + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: srcipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: actorusername_has_any + Type: dynamic + Default: dynamic([]) + - Name: targetusername_has_any + Type: dynamic + Default: dynamic([]) + - Name: eventtype_in + Type: dynamic + Default: dynamic([]) + - Name: disabled + Type: bool + Default: false +ParserQuery: | + let EventTypeLookup = datatable ( + activityType_d: real, + EventType: string, + EventOriginalType: string, + EventSubType: string + )[ + 23, "UserCreated", "User Added", "", + 24, "UserModified", "User Modified", "MultipleProperties", + 25, "UserDeleted", "User Deleted", "", + 37, "UserModified", "User modified", "MultipleProperties", + 102, "UserDeleted", "User Deleted", "", + 110, "UserModified", "Enable API Token Generation", "NewPermissions", + 111, "UserModified", "Disable API Token Generation", "PreviousPermissions", + 140, "UserCreated", "Service User creation", "", + 141, "UserModified", "Service User modification", "MultipleProperties", + 142, "UserDeleted", "Service User deletion", "", + 3522, "GroupCreated", "Ranger Deploy - Credential Group Created", "", + 3523, "GroupModified", "Ranger Deploy -Credential Group Edited", "MultipleProperties", + 3524, "GroupDeleted", "Ranger Deploy - Credential Group Deleted", "", + 3710, "PasswordReset", "User Reset Password with Forgot Password from the Login", "", + 3711, "PasswordChanged", "User Changed Their Password", "", + 3715, "PasswordReset", "User Reset Password by Admin Request", "", + 5006, "GroupDeleted", "Group Deleted", "", + 5008, "GroupCreated", "User created a Manual or Pinned Group", "", + 5011, "GroupModified", "Group Policy Reverted", "Newpolicy", + ]; + let parser = ( + starttime:datetime=datetime(null), + endtime:datetime=datetime(null), + srcipaddr_has_any_prefix: dynamic=dynamic([]), + targetusername_has_any: dynamic=dynamic([]), + actorusername_has_any: dynamic=dynamic([]), + eventtype_in: dynamic=dynamic([]), + disabled:bool=false + ) { + SentinelOne_CL + | where not(disabled) + and event_name_s == "Activities." + and (isnull(starttime) or TimeGenerated >= starttime) and (isnull(endtime) or TimeGenerated <= endtime) + and activityType_d in (23, 24, 25, 37, 102, 110, 111, 140, 141, 142, 3522, 3523, 3524, 3710, 3711, 3715, 5006, 5008, 5011) + and (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(DataFields_s, srcipaddr_has_any_prefix)) + and (array_length(targetusername_has_any) == 0 or DataFields_s has_any (targetusername_has_any)) + and (array_length(actorusername_has_any) == 0 or DataFields_s has_any (actorusername_has_any)) + | parse-kv DataFields_s as (byUser: string, username: string, email: string, ipAddress: string, group: string, groupName: string, name: string, oldDescription: string, oldRole: string, description: string, role: string, userScope: string, scopeLevelName: string, scopeName: string, roleName: string, modifiedFields: string, deactivationPeriodInDays: string, descriptionChanged: string, groupType: string) with (pair_delimiter=",", kv_delimiter=":", quote='"') + | where array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(ipAddress, srcipaddr_has_any_prefix) + | parse modifiedFields with 'Modified fields: ' ModifiedFields:string + | parse description_s with * "with id=" id: string "," restOfMessage + | lookup EventTypeLookup on activityType_d + | where (array_length(eventtype_in) == 0 or (EventType in (eventtype_in))) + | extend + ActorUsername = iff(activityType_d == 102, "SentinelOne", coalesce(byUser, username, email)), + GroupName = coalesce(group, groupName, name), + TargetUsername = iff(isnotempty(byUser), username, ""), + PreviousPropertyValue = coalesce(oldDescription, oldRole), + NewPropertyValue = coalesce(description, role) + | where (array_length(targetusername_has_any) == 0 or TargetUsername has_any (targetusername_has_any)) + and (array_length(actorusername_has_any) == 0 or ActorUsername has_any (actorusername_has_any)) + | extend GroupName = iff(GroupName == "null", "", GroupName) + | project-rename + EventStartTime = createdAt_t, + SrcIpAddr = ipAddress, + EventUid = _ItemId, + ActorUserId = id, + GroupId = groupId_s, + EventMessage = primaryDescription_s, + EventOriginalUid = activityUuid_g + | extend + EventCount = int(1), + EventResult = "Success", + DvcAction = "Allowed", + EventSeverity = "Informational", + EventSchema = "UserManagement", + EventSchemaVersion = "0.1.1", + EventProduct = "SentinelOne", + EventVendor = "SentinelOne", + EventResultDetails = "Other" + | extend + Dvc = EventProduct, + EventEndTime = EventStartTime, + IpAddr = SrcIpAddr, + User = ActorUsername, + UpdatedPropertyName = EventSubType, + ActorUserIdType = iff(isnotempty(ActorUserId),"Other",""), + ActorUserType = _ASIM_GetUserType(ActorUsername,ActorUserId), + ActorUsernameType = _ASIM_GetUsernameType(ActorUsername), + GroupIdType = iff(isnotempty(GroupId), "UID", ""), + GroupNameType = iff(isnotempty(GroupName), "Simple", ""), + GroupType = iff(isnotempty(groupType), "Other", ""), + GroupOriginalType = groupType, + TargetUsernameType = _ASIM_GetUsernameType(TargetUsername), + TargetUserType = _ASIM_GetUserType(TargetUsername, ""), + AdditionalFields = bag_pack( + "userScope", userScope, + "scopeLevelName", scopeLevelName, + "scopeName", scopeName, + "modifiedFields", modifiedFields, + "roleName", roleName, + "deactivationPeriodInDays", deactivationPeriodInDays, + "descriptionChanged", descriptionChanged + ) + | project-away + *_b, + *_d, + *_g, + *_s, + *_t, + byUser, + username, + email, + group, + groupName, + groupType, + name, + oldDescription, + oldRole, + description, + role, + userScope, + scopeLevelName, + scopeName, + roleName, + modifiedFields, + ModifiedFields, + deactivationPeriodInDays, + descriptionChanged, + restOfMessage, + _ResourceId, + TenantId, + RawData, + Computer, + MG, + ManagementGroupName, + SourceSystem + }; + parser( + starttime = starttime, + endtime = endtime, + srcipaddr_has_any_prefix = srcipaddr_has_any_prefix , + targetusername_has_any = targetusername_has_any, + actorusername_has_any = actorusername_has_any, + eventtype_in = eventtype_in, + disabled = disabled + ) \ No newline at end of file diff --git a/Parsers/ASimUserManagement/Tests/SentinelOne_ASimUserManagement_DataTest.csv b/Parsers/ASimUserManagement/Tests/SentinelOne_ASimUserManagement_DataTest.csv new file mode 100644 index 00000000000..114a38bd4d2 --- /dev/null +++ b/Parsers/ASimUserManagement/Tests/SentinelOne_ASimUserManagement_DataTest.csv @@ -0,0 +1,15 @@ +Result +"(0) Error: 4 invalid value(s) (up to 10 listed) in 32 records (52.46%) for field [EventSubType] of type [Enumerated]: [""MultipleProperties"",""PreviousPermissions"",""NewPermissions"",""Newpolicy""] (Schema:UserManagement)" +"(0) Error: type mismatch for column [SrcIpAddr]. It is currently [string] and should be [IP address] (Schema:UserManagement)" +"(2) Info: Empty value in 29 records (47.54%) in optional field [EventSubType] (Schema:UserManagement)" +"(2) Info: Empty value in 44 records (72.13%) in optional field [ActorUserId] (Schema:UserManagement)" +"(2) Info: Empty value in 54 records (88.52%) in optional field [GroupIdType] (Schema:UserManagement)" +"(2) Info: Empty value in 54 records (88.52%) in optional field [GroupId] (Schema:UserManagement)" +"(2) Info: Empty value in 54 records (88.52%) in optional field [GroupNameType] (Schema:UserManagement)" +"(2) Info: Empty value in 54 records (88.52%) in optional field [GroupName] (Schema:UserManagement)" +"(2) Info: Empty value in 54 records (88.52%) in optional field [GroupOriginalType] (Schema:UserManagement)" +"(2) Info: Empty value in 54 records (88.52%) in optional field [GroupType] (Schema:UserManagement)" +"(2) Info: Empty value in 59 records (96.72%) in optional field [PreviousPropertyValue] (Schema:UserManagement)" +"(2) Info: Empty value in 7 records (11.48%) in optional field [NewPropertyValue] (Schema:UserManagement)" +"(2) Info: Empty value in 8 records (13.11%) in optional field [TargetUserType] (Schema:UserManagement)" +"(2) Info: Empty value in 8 records (13.11%) in optional field [TargetUsername] (Schema:UserManagement)" diff --git a/Parsers/ASimUserManagement/Tests/SentinelOne_ASimUserManagement_SchemaTest.csv b/Parsers/ASimUserManagement/Tests/SentinelOne_ASimUserManagement_SchemaTest.csv new file mode 100644 index 00000000000..2a84a67791a --- /dev/null +++ b/Parsers/ASimUserManagement/Tests/SentinelOne_ASimUserManagement_SchemaTest.csv @@ -0,0 +1,47 @@ +Result +"(0) Error: type mismatch for column [SrcIpAddr]. It is currently string and should be IP address" +"(1) Warning: Missing recommended field [DvcDomain]" +"(1) Warning: Missing recommended field [DvcFQDN]" +"(1) Warning: Missing recommended field [DvcHostname]" +"(1) Warning: Missing recommended field [DvcIdType]" +"(1) Warning: Missing recommended field [DvcId]" +"(1) Warning: Missing recommended field [DvcIpAddr]" +"(1) Warning: Missing recommended field [SrcDomainType]" +"(1) Warning: Missing recommended field [SrcDomain]" +"(1) Warning: Missing recommended field [SrcHostname]" +"(1) Warning: Missing recommended field [Src]" +"(2) Info: Missing optional field [ActingAppId]" +"(2) Info: Missing optional field [ActingAppType]" +"(2) Info: Missing optional field [ActiveAppName]" +"(2) Info: Missing optional field [ActorSessionId]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcOsVersion]" +"(2) Info: Missing optional field [DvcOs]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EventOriginalResultDetails]" +"(2) Info: Missing optional field [EventOriginalSeverity]" +"(2) Info: Missing optional field [EventOriginalSubType]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [HttpUserAgent]" +"(2) Info: Missing optional field [SrcDeviceType]" +"(2) Info: Missing optional field [SrcDvcId]" +"(2) Info: Missing optional field [SrcDvcScopeId]" +"(2) Info: Missing optional field [SrcDvcScope]" +"(2) Info: Missing optional field [SrcFQDN]" +"(2) Info: Missing optional field [SrcGeoCity]" +"(2) Info: Missing optional field [SrcGeoCountry]" +"(2) Info: Missing optional field [SrcGeoLatitude]" +"(2) Info: Missing optional field [SrcGeoLongitude]" +"(2) Info: Missing optional field [SrcGeoRegion]" +"(2) Info: Missing optional field [TargetOriginalUserType]" +"(2) Info: Missing optional field [TargetUserId]" +"(2) Info: Missing recommended alias [Hostname] aliasing non-existent column [DvcHostname]" +"(2) Info: extra unnormalized column [TimeGenerated]" +"(2) Info: extra unnormalized column [Type]" diff --git a/Parsers/ASimUserManagement/Tests/SentinelOne_vimUserManagement_DataTest.csv b/Parsers/ASimUserManagement/Tests/SentinelOne_vimUserManagement_DataTest.csv new file mode 100644 index 00000000000..114a38bd4d2 --- /dev/null +++ b/Parsers/ASimUserManagement/Tests/SentinelOne_vimUserManagement_DataTest.csv @@ -0,0 +1,15 @@ +Result +"(0) Error: 4 invalid value(s) (up to 10 listed) in 32 records (52.46%) for field [EventSubType] of type [Enumerated]: [""MultipleProperties"",""PreviousPermissions"",""NewPermissions"",""Newpolicy""] (Schema:UserManagement)" +"(0) Error: type mismatch for column [SrcIpAddr]. It is currently [string] and should be [IP address] (Schema:UserManagement)" +"(2) Info: Empty value in 29 records (47.54%) in optional field [EventSubType] (Schema:UserManagement)" +"(2) Info: Empty value in 44 records (72.13%) in optional field [ActorUserId] (Schema:UserManagement)" +"(2) Info: Empty value in 54 records (88.52%) in optional field [GroupIdType] (Schema:UserManagement)" +"(2) Info: Empty value in 54 records (88.52%) in optional field [GroupId] (Schema:UserManagement)" +"(2) Info: Empty value in 54 records (88.52%) in optional field [GroupNameType] (Schema:UserManagement)" +"(2) Info: Empty value in 54 records (88.52%) in optional field [GroupName] (Schema:UserManagement)" +"(2) Info: Empty value in 54 records (88.52%) in optional field [GroupOriginalType] (Schema:UserManagement)" +"(2) Info: Empty value in 54 records (88.52%) in optional field [GroupType] (Schema:UserManagement)" +"(2) Info: Empty value in 59 records (96.72%) in optional field [PreviousPropertyValue] (Schema:UserManagement)" +"(2) Info: Empty value in 7 records (11.48%) in optional field [NewPropertyValue] (Schema:UserManagement)" +"(2) Info: Empty value in 8 records (13.11%) in optional field [TargetUserType] (Schema:UserManagement)" +"(2) Info: Empty value in 8 records (13.11%) in optional field [TargetUsername] (Schema:UserManagement)" diff --git a/Parsers/ASimUserManagement/Tests/SentinelOne_vimUserManagement_SchemaTest.csv b/Parsers/ASimUserManagement/Tests/SentinelOne_vimUserManagement_SchemaTest.csv new file mode 100644 index 00000000000..5c8362233ee --- /dev/null +++ b/Parsers/ASimUserManagement/Tests/SentinelOne_vimUserManagement_SchemaTest.csv @@ -0,0 +1,47 @@ +Result +"(0) Error: type mismatch for column [SrcIpAddr]. It is currently string and should be IP address" +"(1) Warning: Missing recommended field [DvcDomain]" +"(1) Warning: Missing recommended field [DvcFQDN]" +"(1) Warning: Missing recommended field [DvcHostname]" +"(1) Warning: Missing recommended field [DvcIdType]" +"(1) Warning: Missing recommended field [DvcId]" +"(1) Warning: Missing recommended field [DvcIpAddr]" +"(1) Warning: Missing recommended field [SrcDomainType]" +"(1) Warning: Missing recommended field [SrcDomain]" +"(1) Warning: Missing recommended field [SrcHostname]" +"(1) Warning: Missing recommended field [Src]" +"(2) Info: Missing optional field [ActingAppId]" +"(2) Info: Missing optional field [ActingAppType]" +"(2) Info: Missing optional field [ActiveAppName]" +"(2) Info: Missing optional field [ActorSessionId]" +"(2) Info: Missing optional field [DvcDescription]" +"(2) Info: Missing optional field [DvcInterface]" +"(2) Info: Missing optional field [DvcMacAddr]" +"(2) Info: Missing optional field [DvcOriginalAction]" +"(2) Info: Missing optional field [DvcOsVersion]" +"(2) Info: Missing optional field [DvcOs]" +"(2) Info: Missing optional field [DvcScopeId]" +"(2) Info: Missing optional field [DvcScope]" +"(2) Info: Missing optional field [DvcZone]" +"(2) Info: Missing optional field [EventOriginalResultDetails]" +"(2) Info: Missing optional field [EventOriginalSeverity]" +"(2) Info: Missing optional field [EventOriginalSubType]" +"(2) Info: Missing optional field [EventOwner]" +"(2) Info: Missing optional field [EventProductVersion]" +"(2) Info: Missing optional field [EventReportUrl]" +"(2) Info: Missing optional field [HttpUserAgent]" +"(2) Info: Missing optional field [SrcDeviceType]" +"(2) Info: Missing optional field [SrcDvcId]" +"(2) Info: Missing optional field [SrcDvcScopeId]" +"(2) Info: Missing optional field [SrcDvcScope]" +"(2) Info: Missing optional field [SrcFQDN]" +"(2) Info: Missing optional field [SrcGeoCity]" +"(2) Info: Missing optional field [SrcGeoCountry]" +"(2) Info: Missing optional field [SrcGeoLatitude]" +"(2) Info: Missing optional field [SrcGeoLongitude]" +"(2) Info: Missing optional field [SrcGeoRegion]" +"(2) Info: Missing optional field [TargetOriginalUserType]" +"(2) Info: Missing optional field [TargetUserId]" +"(2) Info: Missing recommended alias [Hostname] aliasing non-existent column [DvcHostname]" +"(2) Info: extra unnormalized column [TimeGenerated]" +"(2) Info: extra unnormalized column [Type]" diff --git a/Sample Data/ASIM/SentinelOne_ASimAuthentication_IngestedLogs.csv b/Sample Data/ASIM/SentinelOne_ASimAuthentication_IngestedLogs.csv new file mode 100644 index 00000000000..54309a3fa8d --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimAuthentication_IngestedLogs.csv @@ -0,0 +1,29 @@ +TenantId,SourceSystem,MG,ManagementGroupName,TimeGenerated [UTC],Computer,RawData,alertInfo_indicatorDescription_s,alertInfo_indicatorName_s,targetProcessInfo_tgtFileOldPath_s,alertInfo_indicatorCategory_s,alertInfo_registryOldValue_g,alertInfo_dstIp_s,alertInfo_dstPort_s,alertInfo_netEventDirection_s,alertInfo_srcIp_s,alertInfo_srcPort_s,containerInfo_id_s,targetProcessInfo_tgtFileId_g,alertInfo_registryOldValue_s,alertInfo_registryOldValueType_s,alertInfo_dnsRequest_s,alertInfo_dnsResponse_s,alertInfo_registryKeyPath_s,alertInfo_registryPath_s,alertInfo_registryValue_g,ruleInfo_description_s,alertInfo_registryValue_s,alertInfo_loginAccountDomain_s,alertInfo_loginAccountSid_s,alertInfo_loginIsAdministratorEquivalent_s,alertInfo_loginIsSuccessful_s,alertInfo_loginType_s,alertInfo_loginsUserName_s,alertInfo_srcMachineIp_s,targetProcessInfo_tgtProcCmdLine_s,targetProcessInfo_tgtProcImagePath_s,targetProcessInfo_tgtProcName_s,targetProcessInfo_tgtProcPid_s,targetProcessInfo_tgtProcSignedStatus_s,targetProcessInfo_tgtProcStorylineId_s,targetProcessInfo_tgtProcUid_s,sourceParentProcessInfo_storyline_g,sourceParentProcessInfo_uniqueId_g,sourceProcessInfo_storyline_g,sourceProcessInfo_uniqueId_g,targetProcessInfo_tgtProcStorylineId_g,targetProcessInfo_tgtProcUid_g,agentDetectionInfo_machineType_s,agentDetectionInfo_name_s,agentDetectionInfo_osFamily_s,agentDetectionInfo_osName_s,agentDetectionInfo_osRevision_s,agentDetectionInfo_uuid_g,agentDetectionInfo_version_s,agentRealtimeInfo_id_s,agentRealtimeInfo_infected_b,agentRealtimeInfo_isActive_b,agentRealtimeInfo_isDecommissioned_b,agentRealtimeInfo_machineType_s,agentRealtimeInfo_name_s,agentRealtimeInfo_os_s,agentRealtimeInfo_uuid_g,alertInfo_alertId_s,alertInfo_analystVerdict_s,alertInfo_createdAt_t [UTC],alertInfo_dvEventId_s,alertInfo_eventType_s,alertInfo_hitType_s,alertInfo_incidentStatus_s,alertInfo_isEdr_b,alertInfo_reportedAt_t [UTC],alertInfo_source_s,alertInfo_updatedAt_t [UTC],ruleInfo_id_s,ruleInfo_name_s,ruleInfo_queryLang_s,ruleInfo_queryType_s,ruleInfo_s1ql_s,ruleInfo_scopeLevel_s,ruleInfo_severity_s,ruleInfo_treatAsThreat_s,sourceParentProcessInfo_commandline_s,sourceParentProcessInfo_fileHashMd5_g,sourceParentProcessInfo_fileHashSha1_s,sourceParentProcessInfo_fileHashSha256_s,sourceParentProcessInfo_filePath_s,sourceParentProcessInfo_fileSignerIdentity_s,sourceParentProcessInfo_integrityLevel_s,sourceParentProcessInfo_name_s,sourceParentProcessInfo_pid_s,sourceParentProcessInfo_pidStarttime_t [UTC],sourceParentProcessInfo_storyline_s,sourceParentProcessInfo_subsystem_s,sourceParentProcessInfo_uniqueId_s,sourceParentProcessInfo_user_s,sourceProcessInfo_commandline_s,sourceProcessInfo_fileHashMd5_g,sourceProcessInfo_fileHashSha1_s,sourceProcessInfo_fileHashSha256_s,sourceProcessInfo_filePath_s,sourceProcessInfo_fileSignerIdentity_s,sourceProcessInfo_integrityLevel_s,sourceProcessInfo_name_s,sourceProcessInfo_pid_s,sourceProcessInfo_pidStarttime_t [UTC],sourceProcessInfo_storyline_s,sourceProcessInfo_subsystem_s,sourceProcessInfo_uniqueId_s,sourceProcessInfo_user_s,targetProcessInfo_tgtFileCreatedAt_t [UTC],targetProcessInfo_tgtFileHashSha1_s,targetProcessInfo_tgtFileHashSha256_s,targetProcessInfo_tgtFileId_s,targetProcessInfo_tgtFileIsSigned_s,targetProcessInfo_tgtFileModifiedAt_t [UTC],targetProcessInfo_tgtFilePath_s,targetProcessInfo_tgtProcIntegrityLevel_s,targetProcessInfo_tgtProcessStartTime_t [UTC],agentUpdatedVersion_s,agentId_s,hash_s,osFamily_s,threatId_s,creator_s,creatorId_s,inherits_b,isDefault_b,name_s,registrationToken_s,totalAgents_d,type_s,agentDetectionInfo_accountId_s,agentDetectionInfo_accountName_s,agentDetectionInfo_agentDetectionState_s,agentDetectionInfo_agentDomain_s,agentDetectionInfo_agentIpV4_s,agentDetectionInfo_agentIpV6_s,agentDetectionInfo_agentLastLoggedInUserName_s,agentDetectionInfo_agentMitigationMode_s,agentDetectionInfo_agentOsName_s,agentDetectionInfo_agentOsRevision_s,agentDetectionInfo_agentRegisteredAt_t [UTC],agentDetectionInfo_agentUuid_g,agentDetectionInfo_agentVersion_s,agentDetectionInfo_externalIp_s,agentDetectionInfo_groupId_s,agentDetectionInfo_groupName_s,agentDetectionInfo_siteId_s,agentDetectionInfo_siteName_s,agentRealtimeInfo_accountId_s,agentRealtimeInfo_accountName_s,agentRealtimeInfo_activeThreats_d,agentRealtimeInfo_agentComputerName_s,agentRealtimeInfo_agentDomain_s,agentRealtimeInfo_agentId_s,agentRealtimeInfo_agentInfected_b,agentRealtimeInfo_agentIsActive_b,agentRealtimeInfo_agentIsDecommissioned_b,agentRealtimeInfo_agentMachineType_s,agentRealtimeInfo_agentMitigationMode_s,agentRealtimeInfo_agentNetworkStatus_s,agentRealtimeInfo_agentOsName_s,agentRealtimeInfo_agentOsRevision_s,agentRealtimeInfo_agentOsType_s,agentRealtimeInfo_agentUuid_g,agentRealtimeInfo_agentVersion_s,agentRealtimeInfo_groupId_s,agentRealtimeInfo_groupName_s,agentRealtimeInfo_networkInterfaces_s,agentRealtimeInfo_operationalState_s,agentRealtimeInfo_rebootRequired_b,agentRealtimeInfo_scanFinishedAt_t [UTC],agentRealtimeInfo_scanStartedAt_t [UTC],agentRealtimeInfo_scanStatus_s,agentRealtimeInfo_siteId_s,agentRealtimeInfo_siteName_s,agentRealtimeInfo_userActionsNeeded_s,indicators_s,mitigationStatus_s,threatInfo_analystVerdict_s,threatInfo_analystVerdictDescription_s,threatInfo_automaticallyResolved_b,threatInfo_certificateId_s,threatInfo_classification_s,threatInfo_classificationSource_s,threatInfo_cloudFilesHashVerdict_s,threatInfo_collectionId_s,threatInfo_confidenceLevel_s,threatInfo_createdAt_t [UTC],threatInfo_detectionEngines_s,threatInfo_detectionType_s,threatInfo_engines_s,threatInfo_externalTicketExists_b,threatInfo_failedActions_b,threatInfo_fileExtension_s,threatInfo_fileExtensionType_s,threatInfo_filePath_s,threatInfo_fileSize_d,threatInfo_fileVerificationType_s,threatInfo_identifiedAt_t [UTC],threatInfo_incidentStatus_s,threatInfo_incidentStatusDescription_s,threatInfo_initiatedBy_s,threatInfo_initiatedByDescription_s,threatInfo_isFileless_b,threatInfo_isValidCertificate_b,threatInfo_mitigatedPreemptively_b,threatInfo_mitigationStatus_s,threatInfo_mitigationStatusDescription_s,threatInfo_originatorProcess_s,threatInfo_pendingActions_b,threatInfo_processUser_s,threatInfo_publisherName_s,threatInfo_reacheDaveentsLimit_b,threatInfo_rebootRequired_b,threatInfo_sha1_s,threatInfo_storyline_s,threatInfo_threatId_s,threatInfo_threatName_s,threatInfo_updatedAt_t [UTC],whiteningOptions_s,threatInfo_maliciousProcessArguments_s,threatInfo_fileExtension_g,threatInfo_threatName_g,threatInfo_storyline_g,accountId_s,accountName_s,activityType_d,activityUuid_g,createdAt_t [UTC],id_s,primaryDescription_s,secondaryDescription_s,siteId_s,siteName_s,updatedAt_t [UTC],userId_s,event_name_s,DataFields_s,description_s,comments_s,activeDirectory_computerMemberOf_s,activeDirectory_lastUserMemberOf_s,activeThreats_d,agentVersion_s,allowRemoteShell_b,appsVulnerabilityStatus_s,computerName_s,consoleMigrationStatus_s,coreCount_d,cpuCount_d,cpuId_s,detectionState_s,domain_s,encryptedApplications_b,externalId_s,externalIp_s,firewallEnabled_b,firstFullModeTime_t [UTC],fullDiskScanLastUpdatedAt_t [UTC],groupId_s,groupIp_s,groupName_s,inRemoteShellSession_b,infected_b,installerType_s,isActive_b,isDecommissioned_b,isPendingUninstall_b,isUninstalled_b,isUpToDate_b,lastActiveDate_t [UTC],lastIpToMgmt_s,lastLoggedInUserName_s,licenseKey_s,locationEnabled_b,locationType_s,locations_s,machineType_s,mitigationMode_s,mitigationModeSuspicious_s,modelName_s,networkInterfaces_s,networkQuarantineEnabled_b,networkStatus_s,operationalState_s,osArch_s,osName_s,osRevision_s,osStartTime_t [UTC],osType_s,rangerStatus_s,rangerVersion_s,registeredAt_t [UTC],remoteProfilingState_s,scanFinishedAt_t [UTC],scanStartedAt_t [UTC],scanStatus_s,serialNumber_s,showAlertIcon_b,tags_sentinelone_s,threatRebootRequired_b,totalMemory_d,userActionsNeeded_s,uuid_g,osUsername_s,scanAbortedAt_t [UTC],activeDirectory_computerDistinguishedName_s,activeDirectory_lastUserDistinguishedName_s,Type,_ResourceId +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,73808999-ab8f-04e4-0db3-092fdce2f16f,73808999-63ba-5f28-b08f-59a1d2a2aeda,7323b552-1241-34f2-d32e-69e7ed79ed77,7323b652-2b18-1c06-46bc-e88629a31195,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,Undefined,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login""",site,Low,UNDEFINED, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,, /usr/sbin/sshd -D -R,,f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211,,/host/usr/sbin/sshd,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.2,,,,,,,,73808999-ab8f-04e4-0db3-092fdce2f16f,73808999-63ba-5f28-b08f-59a1d2a2aeda,73344950-5fe4-fe9b-da2f-052be5efa0fd,73344966-0bf9-6ca9-19c9-f7bdaa769c0b,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.7338232453504E+018,Undefined,"7/21/2023, 5:17:08.002 AM",01H5VE2FWZ8GQTM4HXTJY3X9VJ_384,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:17:17.283 AM",STAR,"7/21/2023, 5:17:17.283 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login""",site,Low,UNDEFINED, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,, /usr/sbin/sshd -D -R,,f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211,,/host/usr/sbin/sshd,,unknown,sshd,66340,"7/21/2023, 5:16:50.550 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 6:50:03.449 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.3,,,,,,,,73808999-ab8f-04e4-0db3-092fdce2f16f,73808999-63ba-5f28-b08f-59a1d2a2aeda,7398939b-2fbb-3163-f010-ff0947c94775,739893ad-db0c-e434-acce-32a99eef6c51,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.7338639921789E+018,Undefined,"7/21/2023, 6:38:07.655 AM",01H5VJPSZY105Q9R3KAQDJKB8S_199,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 6:38:14.683 AM",STAR,"7/21/2023, 6:38:14.683 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login""",site,Low,UNDEFINED, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,, /usr/sbin/sshd -D -R,,f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211,,/host/usr/sbin/sshd,,unknown,sshd,97697,"7/21/2023, 6:37:19.030 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 12:40:03.218 PM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.4,,,,,,,,73c80b2c-3eee-d83f-2433-f81d53448b74,73c80b2b-eb13-db32-f340-1381d663a68b,73a1ec72-e89a-bf52-2eea-eb1b2c83b068,73a1ec99-5194-e603-2e86-3bb195bfd72d,,,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,false,true,false,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.7340399160625E+018,Undefined,"7/21/2023, 12:27:36.257 PM",01H5W6PQAZMW74MP03PFC77JDY_6,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 12:27:46.445 PM",STAR,"7/21/2023, 12:27:46.445 PM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login""",site,Low,UNDEFINED, /usr/sbin/sshd -D,,f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211,,/usr/sbin/sshd,,unknown,sshd,1114,"7/21/2023, 6:39:49.340 AM",,unknown,,, /usr/sbin/sshd -D -R,,f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211,,/usr/sbin/sshd,,unknown,sshd,9478,"7/21/2023, 12:26:09.620 PM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 8:40:04.319 AM",,,,,,,,,,,,,,,,,,,,,,,,WORKGROUP,S-1-5-18,false,true,INTERACTIVE,Crest,1.1.1.5,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1.73097946686588E+018,false,true,false,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1.73391822233841E+018,Undefined,"7/21/2023, 8:25:44.089 AM",01H5VRVY136CS3Z938DG03AHH6_125,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 8:25:59.424 AM",STAR,"7/21/2023, 8:25:59.424 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login""",site,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:46.739 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,2032,"7/17/2023, 10:22:47.441 AM",D23C0EF580778F51,sys_win32,D13C0EF580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 8:50:03.539 AM",,,,,,,,,,,,,,,,,,,,,,,,CLO007,S-1-5-21-3622100493-2250088526-2058887289-1000,,false,NETWORK,Guest,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1.73097946686588E+018,false,true,false,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1.73392378611679E+018,Undefined,"7/21/2023, 8:36:49.111 AM",01H5VSG5P9CM96S5M7D37AMJQ2_59,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 8:37:02.677 AM",STAR,"7/21/2023, 8:37:02.677 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login""",site,Low,UNDEFINED,C:\Windows\system32\userinit.exe,fc003295-bccc-472c-f80d-e65788f64978,43246106034f0fcbb07ecda6be3635a967bac688,f098ce116049a2024fa282fd62764159f451a9c1cc21a7845d155d439cf52b27,C:\Windows\System32\userinit.exe,MICROSOFT WINDOWS,medium,userinit.exe,10796,"7/21/2023, 4:49:44.429 AM",8C8712F580778F51,sys_win32,8B8712F580778F51,CLO007\Crest,C:\Windows\Explorer.EXE,357b678c-68d3-d5ee-86e1-b706fbfd994b,a4e4e2bc502e4ab249b219da357d1aad163ab175,8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,5000,"7/21/2023, 4:49:44.522 AM",8F8712F580778F51,sys_win32,8E8712F580778F51,CLO007\Crest,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:00:04.226 AM",,,,,,,,,,,,,,,,,,,,,,,,WORKGROUP,S-1-5-18,false,true,INTERACTIVE,DWM-5,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1.73097946686588E+018,false,true,false,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1.73380957130602E+018,Undefined,"7/21/2023, 4:49:54.878 AM",01H5VCGKX654Z6M4GRY5GYDXEQ_319,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 4:50:07.209 AM",STAR,"7/21/2023, 4:50:07.209 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,UNDEFINED,\SystemRoot\System32\smss.exe 00000118 000000c0 C:\Windows\System32\WinLogon.exe -SpecialSession,49ce4a7f-ed5d-271a-0142-6f2bc262d23c,746f5ae87f13a46e88088dea31d1362727b9ec49,b6800c2ca4bfec26c8b8553beee774f4ebab741b1a48adcccce79f07062977be,C:\Windows\System32\smss.exe,MICROSOFT WINDOWS,system,smss.exe,12104,"7/20/2023, 1:42:45.411 PM",D98512F580778F51,sys_win32,D88512F580778F51,NT AUTHORITY\SYSTEM,C:\Windows\System32\WinLogon.exe -SpecialSession,bc97817d-5acf-afc4-ab85-ed9c3c576161,2a142db7d20ea7dd8e63341a7cc4c4035c461e64,51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a,C:\Windows\System32\winlogon.exe,MICROSOFT WINDOWS,system,winlogon.exe,15044,"7/20/2023, 1:42:45.436 PM",DD8512F580778F51,sys_win32,DC8512F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:40:04.395 AM",,,,,,,,,,,,,,,,,,,,,,,,,,true,true,REMOTE_INTERACTIVE,root,1.1.1.5,,,,,,,,73c8f4f5-60ad-faab-1729-3ad90759ffb6,73c8f530-7d1c-7b0a-ec58-d6476bca7364,73ca47fd-c89d-b501-9808-d73a7deff8d3,73ca47fd-3dd1-a7dd-410a-2836cfa6a929,,,server,CENT7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,false,true,false,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73382875819303E+018,Undefined,"7/21/2023, 5:28:06.847 AM",01H5VEPM5AM6WHVTGF1WKQD7M3_25,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:28:14.464 AM",STAR,"7/21/2023, 5:28:14.464 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login""",site,Low,UNDEFINED, /usr/sbin/sshd -D -R,,f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211,,/usr/sbin/sshd,,unknown,sshd,59549,"7/21/2023, 5:27:28.900 AM",,unknown,,, sshd: root@pts/0,,f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211,,/usr/sbin/sshd,,unknown,sshd,59555,"7/21/2023, 5:27:34.520 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:40:03.934 AM",,,,,,,,,,,,,,,,,,,,,,,,WORKGROUP,S-1-5-18,false,true,INTERACTIVE,Crest,1.1.1.5,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1.73097946686588E+018,false,true,false,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1.73675609965504E+018,Undefined,"7/25/2023, 6:23:59.251 AM",01H65VFT5FJT5WRW54TT0TPT5X_178,WINLOGONATTEMPT,Events,Unresolved,true,"7/25/2023, 6:24:20.761 AM",STAR,"7/25/2023, 6:24:20.761 AM",1.73674317140012E+018,CWL547,1,events,"EndpointName = ""CLO007""",account,Medium,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:46.739 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,2032,"7/17/2023, 10:22:47.441 AM",D23C0EF580778F51,sys_win32,D13C0EF580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/26/2023, 12:50:03.507 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1.71250023793415E+018,Crest Data Systems,27,d985cfbc-6237-4c90-a96e-b4163d6361fc,"7/26/2023, 12:34:34.382 PM",1.73766721674396E+018,The management user Jack logged in to the management console with IP Address 1.1.1.1.,IP address: 1.1.1.1,,,"7/26/2023, 12:34:34.377 PM",1.72246596566398E+018,Activities.,"{""accountName"": ""Crest Data Systems"", ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""reason"": null, ""role"": ""Admin"", ""scopeLevel"": ""Account"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""source"": ""mgmt"", ""sourceType"": ""UI"", ""userScope"": ""account"", ""username"": ""Jack""}",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/27/2023, 5:00:13.116 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1.71250023793415E+018,Crest Data Systems,27,8e51cc95-293a-45dc-b44e-4a0b3bafc1d3,"7/27/2023, 4:43:02.582 AM",1.73815466364599E+018,The management user Dave Patel logged in to the management console with IP Address 1.1.1.1.,IP address: 1.1.1.1,,,"7/27/2023, 4:43:02.574 AM",1.71658347026226E+018,Activities.,"{""accountName"": ""Crest Data Systems"", ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""reason"": null, ""role"": ""Admin"", ""scopeLevel"": ""Account"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""source"": ""mgmt"", ""sourceType"": ""UI"", ""userScope"": ""account"", ""username"": ""Dave Patel""}",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/27/2023, 5:30:30.296 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1.71250023793415E+018,Crest Data Systems,33,3ce06642-38a3-4bf4-9299-7a572011ae22,"7/27/2023, 5:13:53.227 AM",1.73817018799215E+018,The management user Dave Patel logged out of the management console.,IP address: 1.1.1.1,,,"7/27/2023, 5:13:53.221 AM",1.71658347026226E+018,Activities.,"{""accountName"": ""Crest Data Systems"", ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""role"": ""Admin"", ""scopeLevel"": ""Account"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""sourceType"": ""UI"", ""userScope"": ""account"", ""username"": ""Dave Patel""}",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/27/2023, 7:20:03.555 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1.71250023793415E+018,Crest Data Systems,33,a26ae595-71f2-426d-a7c1-d17e982a2c77,"7/27/2023, 7:04:49.720 AM",1.73822602670272E+018,The management user Jack logged out of the management console.,IP address: 1.1.1.1,,,"7/27/2023, 7:04:49.715 AM",1.72246596566398E+018,Activities.,"{""accountName"": ""Crest Data Systems"", ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""role"": ""Admin"", ""scopeLevel"": ""Account"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""sourceType"": ""UI"", ""userScope"": ""account"", ""username"": ""Jack""}",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/24/2023, 11:10:02.861 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1.71250023793415E+018,Crest Data Systems,133,3333bba1-1b75-4526-b4ac-3aa17c74da31,"7/24/2023, 10:50:54.397 PM",1.73652787612635E+018,The management user Dave Patel failed to log in to the management console.,,1.71250024242206E+018,Default site,"7/24/2023, 10:50:54.395 PM",1.71658347026226E+018,Activities.,"{""accountName"": ""Crest Data Systems"", ""fullScopeDetails"": ""Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site"", ""groupName"": null, ""ipAddress"": null, ""realUser"": null, ""role"": null, ""scopeLevel"": ""Site"", ""scopeName"": ""Default site"", ""siteName"": ""Default site"", ""sourceType"": ""API"", ""userScope"": ""site"", ""username"": ""Dave Patel""}",,no active site,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/24/2023, 11:10:02.861 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1.71250023793415E+018,Crest Data Systems,133,4240a5e6-adf4-48fe-9243-a042c76739a5,"7/24/2023, 10:55:44.928 PM",1.7365303132942E+018,The management user Dave Patel failed to log in to the management console.,,1.71250024242206E+018,Default site,"7/24/2023, 10:55:44.926 PM",1.71658347026226E+018,Activities.,"{""accountName"": ""Crest Data Systems"", ""fullScopeDetails"": ""Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site"", ""groupName"": null, ""ipAddress"": null, ""realUser"": null, ""role"": null, ""scopeLevel"": ""Site"", ""scopeName"": ""Default site"", ""siteName"": ""Default site"", ""sourceType"": ""API"", ""userScope"": ""site"", ""username"": ""Dave Patel""}",,no active site,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 1:20:05.436 PM",,,,,,,,,,,,,,,,,,,,,,,,WORKGROUP,S-1-5-18,false,true,INTERACTIVE,DWM-4,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1.73097946686588E+018,false,true,false,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1.73333453561327E+018,Undefined,"7/20/2023, 1:06:06.398 PM",01H5SPGE2BKCTFNPDW0YQH4B13_100,WINLOGONATTEMPT,Events,Unresolved,true,"7/20/2023, 1:06:18.543 PM",STAR,"7/20/2023, 1:06:18.543 PM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,UNDEFINED,\SystemRoot\System32\smss.exe 00000100 000000c0,49ce4a7f-ed5d-271a-0142-6f2bc262d23c,746f5ae87f13a46e88088dea31d1362727b9ec49,b6800c2ca4bfec26c8b8553beee774f4ebab741b1a48adcccce79f07062977be,C:\Windows\System32\smss.exe,MICROSOFT WINDOWS PUBLISHER,system,smss.exe,1292,"7/20/2023, 1:05:12.847 PM",D57E12F580778F51,sys_win32,D47E12F580778F51,NT AUTHORITY\SYSTEM,winlogon.exe,bc97817d-5acf-afc4-ab85-ed9c3c576161,2a142db7d20ea7dd8e63341a7cc4c4035c461e64,51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a,C:\Windows\System32\winlogon.exe,MICROSOFT WINDOWS,system,winlogon.exe,17052,"7/20/2023, 1:05:12.892 PM",DB7E12F580778F51,sys_win32,DA7E12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,,,,,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,FALSE_POSITIVE,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,UNDEFINED, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,,,,,,,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,,,,,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,TRUE_POSITIVE,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,UNDEFINED, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,,,,,,,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,,,,,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,SUSPICIOUS,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,Suspicious, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,,,,,,,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,,,,,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,FALSE_POSITIVE,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,Suspicious, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,,,,,,,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,,,,,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,TRUE_POSITIVE,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,Suspicious, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,,,,,,,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,,,,,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,SUSPICIOUS,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,Malicious, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,,,,,,,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,,,,,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,FALSE_POSITIVE,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,Malicious, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,,,,,,,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,,,,,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,TRUE_POSITIVE,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,Malicious, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,,,,,,,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,,,,,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,SUSPICIOUS,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,Malicious, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,,,,,,,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,,,,,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,Undefined,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,Suspicious, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,,,,,,,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,,,,,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,Undefined,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,UNDEFINED, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,,,,,,,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:30:03.212 AM",,,,,,,,,,,,,,,,,,,,,,,,,,false,true,REMOTE_INTERACTIVE,serviceuser,1.1.1.1,,,,,,,,,,,,,,kubernetes node,k8s-master,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,23.1.2.9,1.73323555874879E+018,false,true,false,kubernetes node,k8s-master,linux,73798876-6a5c-5ffe-07fb-6a90ea86b0c3,1.73382271255631E+018,Undefined,"7/21/2023, 5:16:07.367 AM",01H5VE0N9Z4AJFRJC81GKFVJ4J_299,WINLOGONATTEMPT,Events,Unresolved,true,"7/21/2023, 5:16:13.769 AM",STAR,"7/21/2023, 5:16:13.769 AM",1.73313188414935E+018,Login Test,1,events,"EventType = ""Login"" OR EventType = ""Logout""",site,Low,UNDEFINED, /usr/sbin/sshd -D,,,,/usr/sbin/sshd,,unknown,sshd,963,"7/20/2023, 9:40:51.770 AM",,unknown,,,,,,,,,unknown,sshd,65848,"7/21/2023, 5:15:39.120 AM",,unknown,,,"1/1/1970, 12:00:00.000 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, diff --git a/Sample Data/ASIM/SentinelOne_ASimAuthentication_RawLogs.json b/Sample Data/ASIM/SentinelOne_ASimAuthentication_RawLogs.json new file mode 100644 index 00000000000..438aa85eef5 --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimAuthentication_RawLogs.json @@ -0,0 +1,8534 @@ +[ + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 5:30:03.212 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "0f81ec00-9e52-48e6-b899-eb3bbeede741", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "78d7744d-2837-40d2-aff4-bede5877836e", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 5:30:03.212 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "AC644457DCBAD901", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "FB4511F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "svchost.exe,FrameServer", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.2", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "FFDE12F580778F51", + "targetProcessInfo_tgtProcUid": "FFC79AC6A067F7A0", + "sourceParentProcessInfo_storyline": "FFC79AC6A067F6B0", + "sourceParentProcessInfo_uniqueId": "FFC79AC6A067F5D0", + "sourceProcessInfo_storyline": "FFC79AC6A067F7C0", + "sourceProcessInfo_uniqueId": "FFC79AC6A067F7D0", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733823245350397700, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 5:17:08.002 AM", + "alertInfo_dvEventId": "01H5VE2FWZ8GQTM4HXTJY3X9VJ_384", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:17:17.283 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:17:17.283 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 66340, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:16:50.550 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 6:50:03.449 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.3", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733863992178899700, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 6:38:07.655 AM", + "alertInfo_dvEventId": "01H5VJPSZY105Q9R3KAQDJKB8S_199", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 6:38:14.683 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 6:38:14.683 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 97697, + "sourceProcessInfo_pidStarttime": "7/21/2023, 6:37:19.030 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 12:40:03.218 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.4", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1734039916062504700, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 12:27:36.257 PM", + "alertInfo_dvEventId": "01H5W6PQAZMW74MP03PFC77JDY_6", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 12:27:46.445 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 12:27:46.445 PM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 1114, + "sourceParentProcessInfo_pidStarttime": "7/21/2023, 6:39:49.340 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 9478, + "sourceProcessInfo_pidStarttime": "7/21/2023, 12:26:09.620 PM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 8:40:04.319 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "WORKGROUP", + "alertInfo_loginAccountSid": "S-1-5-18", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "INTERACTIVE", + "alertInfo_loginsUserName": "Crest", + "alertInfo_srcMachineIp": "1.1.1.5", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "D23C0EF580778F51", + "sourceProcessInfo_uniqueId": "D13C0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733918222338408700, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 8:25:44.089 AM", + "alertInfo_dvEventId": "01H5VRVY136CS3Z938DG03AHH6_125", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 8:25:59.424 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 8:25:59.424 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:46.739 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s UserManager", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 2032, + "sourceProcessInfo_pidStarttime": "7/17/2023, 10:22:47.441 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 8:50:03.539 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "CLO007", + "alertInfo_loginAccountSid": "S-1-5-21-3622100493-2250088526-2058887289-1000", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": false, + "alertInfo_loginType": "NETWORK", + "alertInfo_loginsUserName": "Guest", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "8C8712F580778F51", + "sourceParentProcessInfo_uniqueId": "8B8712F580778F51", + "sourceProcessInfo_storyline": "8F8712F580778F51", + "sourceProcessInfo_uniqueId": "8E8712F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733923786116792600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 8:36:49.111 AM", + "alertInfo_dvEventId": "01H5VSG5P9CM96S5M7D37AMJQ2_59", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 8:37:02.677 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 8:37:02.677 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\userinit.exe", + "sourceParentProcessInfo_fileHashMd5": "fc003295-bccc-472c-f80d-e65788f64978", + "sourceParentProcessInfo_fileHashSha1": "43246106034f0fcbb07ecda6be3635a967bac688", + "sourceParentProcessInfo_fileHashSha256": "f098ce116049a2024fa282fd62764159f451a9c1cc21a7845d155d439cf52b27", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\userinit.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "userinit.exe", + "sourceParentProcessInfo_pid": 10796, + "sourceParentProcessInfo_pidStarttime": "7/21/2023, 4:49:44.429 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\Explorer.EXE", + "sourceProcessInfo_fileHashMd5": "357b678c-68d3-d5ee-86e1-b706fbfd994b", + "sourceProcessInfo_fileHashSha1": "a4e4e2bc502e4ab249b219da357d1aad163ab175", + "sourceProcessInfo_fileHashSha256": "8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b", + "sourceProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "explorer.exe", + "sourceProcessInfo_pid": 5000, + "sourceProcessInfo_pidStarttime": "7/21/2023, 4:49:44.522 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 5:00:04.226 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "WORKGROUP", + "alertInfo_loginAccountSid": "S-1-5-18", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "INTERACTIVE", + "alertInfo_loginsUserName": "DWM-5", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "D98512F580778F51", + "sourceParentProcessInfo_uniqueId": "D88512F580778F51", + "sourceProcessInfo_storyline": "DD8512F580778F51", + "sourceProcessInfo_uniqueId": "DC8512F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733809571306024200, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 4:49:54.878 AM", + "alertInfo_dvEventId": "01H5VCGKX654Z6M4GRY5GYDXEQ_319", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 4:50:07.209 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 4:50:07.209 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login\" OR EventType = \"Logout", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "\\SystemRoot\\System32\\smss.exe 00000118 000000c0 C:\\Windows\\System32\\WinLogon.exe -SpecialSession", + "sourceParentProcessInfo_fileHashMd5": "49ce4a7f-ed5d-271a-0142-6f2bc262d23c", + "sourceParentProcessInfo_fileHashSha1": "746f5ae87f13a46e88088dea31d1362727b9ec49", + "sourceParentProcessInfo_fileHashSha256": "b6800c2ca4bfec26c8b8553beee774f4ebab741b1a48adcccce79f07062977be", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\smss.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "smss.exe", + "sourceParentProcessInfo_pid": 12104, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 1:42:45.411 PM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\WinLogon.exe -SpecialSession", + "sourceProcessInfo_fileHashMd5": "bc97817d-5acf-afc4-ab85-ed9c3c576161", + "sourceProcessInfo_fileHashSha1": "2a142db7d20ea7dd8e63341a7cc4c4035c461e64", + "sourceProcessInfo_fileHashSha256": "51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\winlogon.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "winlogon.exe", + "sourceProcessInfo_pid": 15044, + "sourceProcessInfo_pidStarttime": "7/20/2023, 1:42:45.436 PM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 5:40:04.395 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": true, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "root", + "alertInfo_srcMachineIp": "1.1.1.5", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "CENT7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733828758193028000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 5:28:06.847 AM", + "alertInfo_dvEventId": "01H5VEPM5AM6WHVTGF1WKQD7M3_25", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:28:14.464 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:28:14.464 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 59549, + "sourceParentProcessInfo_pidStarttime": "7/21/2023, 5:27:28.900 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "sshd: root@pts/0", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 59555, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:27:34.520 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 6:40:03.934 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "WORKGROUP", + "alertInfo_loginAccountSid": "S-1-5-18", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "INTERACTIVE", + "alertInfo_loginsUserName": "Crest", + "alertInfo_srcMachineIp": "1.1.1.5", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "D23C0EF580778F51", + "sourceProcessInfo_uniqueId": "D13C0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736756099655035400, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 6:23:59.251 AM", + "alertInfo_dvEventId": "01H65VFT5FJT5WRW54TT0TPT5X_178", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 6:24:20.761 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 6:24:20.761 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:46.739 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s UserManager", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 2032, + "sourceProcessInfo_pidStarttime": "7/17/2023, 10:22:47.441 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/26/2023, 12:50:03.507 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected": "", + "agentRealtimeInfo_isActive": "", + "agentRealtimeInfo_isDecommissioned": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr": "", + "alertInfo_reportedAt": "", + "alertInfo_source": "", + "alertInfo_updatedAt": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 27, + "activityUuid": "d985cfbc-6237-4c90-a96e-b4163d6361fc", + "createdAt": "7/26/2023, 12:34:34.382 PM", + "id": 1737667216743959600, + "primaryDescription": "The management user Jack logged in to the management console with IP Address 1.1.1.1.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt": "7/26/2023, 12:34:34.377 PM", + "userId": 1722465965663983400, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "reason": null, + "role": "Admin", + "scopeLevel": "Account", + "scopeName": "Crest Data Systems", + "siteName": null, + "source": "mgmt", + "sourceType": "UI", + "userScope": "account", + "username": "Jack" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/27/2023, 5:00:13.116 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected": "", + "agentRealtimeInfo_isActive": "", + "agentRealtimeInfo_isDecommissioned": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr": "", + "alertInfo_reportedAt": "", + "alertInfo_source": "", + "alertInfo_updatedAt": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 27, + "activityUuid": "8e51cc95-293a-45dc-b44e-4a0b3bafc1d3", + "createdAt": "7/27/2023, 4:43:02.582 AM", + "id": 1738154663645986000, + "primaryDescription": "The management user Dave Patel logged in to the management console with IP Address 1.1.1.1.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt": "7/27/2023, 4:43:02.574 AM", + "userId": 1716583470262263000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "reason": null, + "role": "Admin", + "scopeLevel": "Account", + "scopeName": "Crest Data Systems", + "siteName": null, + "source": "mgmt", + "sourceType": "UI", + "userScope": "account", + "username": "Dave Patel" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/27/2023, 5:30:30.296 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected": "", + "agentRealtimeInfo_isActive": "", + "agentRealtimeInfo_isDecommissioned": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr": "", + "alertInfo_reportedAt": "", + "alertInfo_source": "", + "alertInfo_updatedAt": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 33, + "activityUuid": "3ce06642-38a3-4bf4-9299-7a572011ae22", + "createdAt": "7/27/2023, 5:13:53.227 AM", + "id": 1738170187992149500, + "primaryDescription": "The management user Dave Patel logged out of the management console.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt": "7/27/2023, 5:13:53.221 AM", + "userId": 1716583470262263000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "role": "Admin", + "scopeLevel": "Account", + "scopeName": "Crest Data Systems", + "siteName": null, + "sourceType": "UI", + "userScope": "account", + "username": "Dave Patel" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/27/2023, 7:20:03.555 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected": "", + "agentRealtimeInfo_isActive": "", + "agentRealtimeInfo_isDecommissioned": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr": "", + "alertInfo_reportedAt": "", + "alertInfo_source": "", + "alertInfo_updatedAt": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 33, + "activityUuid": "a26ae595-71f2-426d-a7c1-d17e982a2c77", + "createdAt": "7/27/2023, 7:04:49.720 AM", + "id": 1738226026702715400, + "primaryDescription": "The management user Jack logged out of the management console.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt": "7/27/2023, 7:04:49.715 AM", + "userId": 1722465965663983400, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "role": "Admin", + "scopeLevel": "Account", + "scopeName": "Crest Data Systems", + "siteName": null, + "sourceType": "UI", + "userScope": "account", + "username": "Jack" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/24/2023, 11:10:02.861 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected": "", + "agentRealtimeInfo_isActive": "", + "agentRealtimeInfo_isDecommissioned": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr": "", + "alertInfo_reportedAt": "", + "alertInfo_source": "", + "alertInfo_updatedAt": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 133, + "activityUuid": "3333bba1-1b75-4526-b4ac-3aa17c74da31", + "createdAt": "7/24/2023, 10:50:54.397 PM", + "id": 1736527876126354700, + "primaryDescription": "The management user Dave Patel failed to log in to the management console.", + "secondaryDescription": "", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt": "7/24/2023, 10:50:54.395 PM", + "userId": 1716583470262263000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "fullScopeDetails": "Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site", + "groupName": null, + "ipAddress": null, + "realUser": null, + "role": null, + "scopeLevel": "Site", + "scopeName": "Default site", + "siteName": "Default site", + "sourceType": "API", + "userScope": "site", + "username": "Dave Patel" + }, + "description": "", + "comments": "no active site", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/24/2023, 11:10:02.861 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected": "", + "agentRealtimeInfo_isActive": "", + "agentRealtimeInfo_isDecommissioned": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr": "", + "alertInfo_reportedAt": "", + "alertInfo_source": "", + "alertInfo_updatedAt": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 133, + "activityUuid": "4240a5e6-adf4-48fe-9243-a042c76739a5", + "createdAt": "7/24/2023, 10:55:44.928 PM", + "id": 1736530313294199000, + "primaryDescription": "The management user Dave Patel failed to log in to the management console.", + "secondaryDescription": "", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt": "7/24/2023, 10:55:44.926 PM", + "userId": 1716583470262263000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "fullScopeDetails": "Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site", + "groupName": null, + "ipAddress": null, + "realUser": null, + "role": null, + "scopeLevel": "Site", + "scopeName": "Default site", + "siteName": "Default site", + "sourceType": "API", + "userScope": "site", + "username": "Dave Patel" + }, + "description": "", + "comments": "no active site", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "WORKGROUP", + "alertInfo_loginAccountSid": "S-1-5-18", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "INTERACTIVE", + "alertInfo_loginsUserName": "DWM-4", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "D57E12F580778F51", + "sourceParentProcessInfo_uniqueId": "D47E12F580778F51", + "sourceProcessInfo_storyline": "DB7E12F580778F51", + "sourceProcessInfo_uniqueId": "DA7E12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733334535613272300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/20/2023, 1:06:06.398 PM", + "alertInfo_dvEventId": "01H5SPGE2BKCTFNPDW0YQH4B13_100", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/20/2023, 1:06:18.543 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/20/2023, 1:06:18.543 PM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login\" OR EventType = \"Logout", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "\\SystemRoot\\System32\\smss.exe 00000100 000000c0", + "sourceParentProcessInfo_fileHashMd5": "49ce4a7f-ed5d-271a-0142-6f2bc262d23c", + "sourceParentProcessInfo_fileHashSha1": "746f5ae87f13a46e88088dea31d1362727b9ec49", + "sourceParentProcessInfo_fileHashSha256": "b6800c2ca4bfec26c8b8553beee774f4ebab741b1a48adcccce79f07062977be", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\smss.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "smss.exe", + "sourceParentProcessInfo_pid": 1292, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 1:05:12.847 PM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "winlogon.exe", + "sourceProcessInfo_fileHashMd5": "bc97817d-5acf-afc4-ab85-ed9c3c576161", + "sourceProcessInfo_fileHashSha1": "2a142db7d20ea7dd8e63341a7cc4c4035c461e64", + "sourceProcessInfo_fileHashSha256": "51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\winlogon.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "winlogon.exe", + "sourceProcessInfo_pid": 17052, + "sourceProcessInfo_pidStarttime": "7/20/2023, 1:05:12.892 PM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", +"alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "FALSE_POSITIVE", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", +"alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "TRUE_POSITIVE", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", +"alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "SUSPICIOUS", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", +"alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "FALSE_POSITIVE", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "Suspicious", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", +"alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "TRUE_POSITIVE", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "Suspicious", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", +"alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "SUSPICIOUS", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "Suspicious", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", +"alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "FALSE_POSITIVE", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "Malicious", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", +"alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "TRUE_POSITIVE", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "Malicious", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", +"alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "SUSPICIOUS", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "Malicious", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", +"alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "Malicious", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", +"alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "Suspicious", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:20:05.436 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", +"alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": false, + "alertInfo_loginIsSuccessful": true, + "alertInfo_loginType": "REMOTE_INTERACTIVE", + "alertInfo_loginsUserName": "serviceuser", + "alertInfo_srcMachineIp": "1.1.1.1", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "kubernetes node", + "agentDetectionInfo_name": "k8s-master", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.88.1.el7.x86_64", + "agentDetectionInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1733235558748789000, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "kubernetes node", + "agentRealtimeInfo_name": "k8s-master", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "73798876-6a5c-5ffe-07fb-6a90ea86b0c3", + "alertInfo_alertId": 1733822712556310300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 5:16:07.367 AM", + "alertInfo_dvEventId": "01H5VE0N9Z4AJFRJC81GKFVJ4J_299", + "alertInfo_eventType": "WINLOGONATTEMPT", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:16:13.769 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:16:13.769 AM", + "ruleInfo_id": 1733131884149349000, + "ruleInfo_name": "Login Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Login", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/sshd -D", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/sshd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "sshd", + "sourceParentProcessInfo_pid": 963, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 9:40:51.770 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sshd -D -R", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f2e3a8c77dc72a358e5c3d0e4cabf278bf7dc211", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/host/usr/sbin/sshd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sshd", + "sourceProcessInfo_pid": 65848, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:15:39.120 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reacheDaveentsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "_ResourceId": "" + } +] \ No newline at end of file diff --git a/Sample Data/ASIM/SentinelOne_ASimDns_IngestedLogs.csv b/Sample Data/ASIM/SentinelOne_ASimDns_IngestedLogs.csv new file mode 100644 index 00000000000..d01aa0260ef --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimDns_IngestedLogs.csv @@ -0,0 +1,21 @@ +TenantId,SourceSystem,MG,ManagementGroupName,TimeGenerated [UTC],Computer,RawData,alertInfo_indicatorDescription_s,alertInfo_indicatorName_s,targetProcessInfo_tgtFileOldPath_s,alertInfo_indicatorCategory_s,alertInfo_registryOldValue_g,alertInfo_dstIp_s,alertInfo_dstPort_s,alertInfo_netEventDirection_s,alertInfo_srcIp_s,alertInfo_srcPort_s,containerInfo_id_s,targetProcessInfo_tgtFileId_g,alertInfo_registryOldValue_s,alertInfo_registryOldValueType_s,alertInfo_dnsRequest_s,alertInfo_dnsResponse_s,alertInfo_registryKeyPath_s,alertInfo_registryPath_s,alertInfo_registryValue_g,ruleInfo_description_s,alertInfo_registryValue_s,alertInfo_loginAccountDomain_s,alertInfo_loginAccountSid_s,alertInfo_loginIsAdministratorEquivalent_s,alertInfo_loginIsSuccessful_s,alertInfo_loginType_s,alertInfo_loginsUserName_s,alertInfo_srcMachineIp_s,targetProcessInfo_tgtProcCmdLine_s,targetProcessInfo_tgtProcImagePath_s,targetProcessInfo_tgtProcName_s,targetProcessInfo_tgtProcPid_s,targetProcessInfo_tgtProcSignedStatus_s,targetProcessInfo_tgtProcStorylineId_s,targetProcessInfo_tgtProcUid_s,sourceParentProcessInfo_storyline_g,sourceParentProcessInfo_uniqueId_g,sourceProcessInfo_storyline_g,sourceProcessInfo_uniqueId_g,targetProcessInfo_tgtProcStorylineId_g,targetProcessInfo_tgtProcUid_g,agentDetectionInfo_machineType_s,agentDetectionInfo_name_s,agentDetectionInfo_osFamily_s,agentDetectionInfo_osName_s,agentDetectionInfo_osRevision_s,agentDetectionInfo_uuid_g,agentDetectionInfo_version_s,agentRealtimeInfo_id_s,agentRealtimeInfo_infected_b,agentRealtimeInfo_isActive_b,agentRealtimeInfo_isDecommissioned_b,agentRealtimeInfo_machineType_s,agentRealtimeInfo_name_s,agentRealtimeInfo_os_s,agentRealtimeInfo_uuid_g,alertInfo_alertId_s,alertInfo_analystVerdict_s,alertInfo_createdAt_t [UTC],alertInfo_dvEventId_s,alertInfo_eventType_s,alertInfo_hitType_s,alertInfo_incidentStatus_s,alertInfo_isEdr_b,alertInfo_reportedAt_t [UTC],alertInfo_source_s,alertInfo_updatedAt_t [UTC],ruleInfo_id_s,ruleInfo_name_s,ruleInfo_queryLang_s,ruleInfo_queryType_s,ruleInfo_s1ql_s,ruleInfo_scopeLevel_s,ruleInfo_severity_s,ruleInfo_treatAsThreat_s,sourceParentProcessInfo_commandline_s,sourceParentProcessInfo_fileHashMd5_g,sourceParentProcessInfo_fileHashSha1_s,sourceParentProcessInfo_fileHashSha256_s,sourceParentProcessInfo_filePath_s,sourceParentProcessInfo_fileSignerIdentity_s,sourceParentProcessInfo_integrityLevel_s,sourceParentProcessInfo_name_s,sourceParentProcessInfo_pid_s,sourceParentProcessInfo_pidStarttime_t [UTC],sourceParentProcessInfo_storyline_s,sourceParentProcessInfo_subsystem_s,sourceParentProcessInfo_uniqueId_s,sourceParentProcessInfo_user_s,sourceProcessInfo_commandline_s,sourceProcessInfo_fileHashMd5_g,sourceProcessInfo_fileHashSha1_s,sourceProcessInfo_fileHashSha256_s,sourceProcessInfo_filePath_s,sourceProcessInfo_fileSignerIdentity_s,sourceProcessInfo_integrityLevel_s,sourceProcessInfo_name_s,sourceProcessInfo_pid_s,sourceProcessInfo_pidStarttime_t [UTC],sourceProcessInfo_storyline_s,sourceProcessInfo_subsystem_s,sourceProcessInfo_uniqueId_s,sourceProcessInfo_user_s,targetProcessInfo_tgtFileCreatedAt_t [UTC],targetProcessInfo_tgtFileHashSha1_s,targetProcessInfo_tgtFileHashSha256_s,targetProcessInfo_tgtFileId_s,targetProcessInfo_tgtFileIsSigned_s,targetProcessInfo_tgtFileModifiedAt_t [UTC],targetProcessInfo_tgtFilePath_s,targetProcessInfo_tgtProcIntegrityLevel_s,targetProcessInfo_tgtProcessStartTime_t [UTC],agentUpdatedVersion_s,agentId_s,hash_s,osFamily_s,threatId_s,creator_s,creatorId_s,inherits_b,isDefault_b,name_s,registrationToken_s,totalAgents_d,type_s,agentDetectionInfo_accountId_s,agentDetectionInfo_accountName_s,agentDetectionInfo_agentDetectionState_s,agentDetectionInfo_agentDomain_s,agentDetectionInfo_agentIpV4_s,agentDetectionInfo_agentIpV6_s,agentDetectionInfo_agentLastLoggedInUserName_s,agentDetectionInfo_agentMitigationMode_s,agentDetectionInfo_agentOsName_s,agentDetectionInfo_agentOsRevision_s,agentDetectionInfo_agentRegisteredAt_t [UTC],agentDetectionInfo_agentUuid_g,agentDetectionInfo_agentVersion_s,agentDetectionInfo_externalIp_s,agentDetectionInfo_groupId_s,agentDetectionInfo_groupName_s,agentDetectionInfo_siteId_s,agentDetectionInfo_siteName_s,agentRealtimeInfo_accountId_s,agentRealtimeInfo_accountName_s,agentRealtimeInfo_activeThreats_d,agentRealtimeInfo_agentComputerName_s,agentRealtimeInfo_agentDomain_s,agentRealtimeInfo_agentId_s,agentRealtimeInfo_agentInfected_b,agentRealtimeInfo_agentIsActive_b,agentRealtimeInfo_agentIsDecommissioned_b,agentRealtimeInfo_agentMachineType_s,agentRealtimeInfo_agentMitigationMode_s,agentRealtimeInfo_agentNetworkStatus_s,agentRealtimeInfo_agentOsName_s,agentRealtimeInfo_agentOsRevision_s,agentRealtimeInfo_agentOsType_s,agentRealtimeInfo_agentUuid_g,agentRealtimeInfo_agentVersion_s,agentRealtimeInfo_groupId_s,agentRealtimeInfo_groupName_s,agentRealtimeInfo_networkInterfaces_s,agentRealtimeInfo_operationalState_s,agentRealtimeInfo_rebootRequired_b,agentRealtimeInfo_scanFinishedAt_t [UTC],agentRealtimeInfo_scanStartedAt_t [UTC],agentRealtimeInfo_scanStatus_s,agentRealtimeInfo_siteId_s,agentRealtimeInfo_siteName_s,agentRealtimeInfo_userActionsNeeded_s,indicators_s,mitigationStatus_s,threatInfo_analystVerdict_s,threatInfo_analystVerdictDescription_s,threatInfo_automaticallyResolved_b,threatInfo_certificateId_s,threatInfo_classification_s,threatInfo_classificationSource_s,threatInfo_cloudFilesHashVerdict_s,threatInfo_collectionId_s,threatInfo_confidenceLevel_s,threatInfo_createdAt_t [UTC],threatInfo_detectionEngines_s,threatInfo_detectionType_s,threatInfo_engines_s,threatInfo_externalTicketExists_b,threatInfo_failedActions_b,threatInfo_fileExtension_s,threatInfo_fileExtensionType_s,threatInfo_filePath_s,threatInfo_fileSize_d,threatInfo_fileVerificationType_s,threatInfo_identifiedAt_t [UTC],threatInfo_incidentStatus_s,threatInfo_incidentStatusDescription_s,threatInfo_initiatedBy_s,threatInfo_initiatedByDescription_s,threatInfo_isFileless_b,threatInfo_isValidCertificate_b,threatInfo_mitigatedPreemptively_b,threatInfo_mitigationStatus_s,threatInfo_mitigationStatusDescription_s,threatInfo_originatorProcess_s,threatInfo_pendingActions_b,threatInfo_processUser_s,threatInfo_publisherName_s,threatInfo_reachedEventsLimit_b,threatInfo_rebootRequired_b,threatInfo_sha1_s,threatInfo_storyline_s,threatInfo_threatId_s,threatInfo_threatName_s,threatInfo_updatedAt_t [UTC],whiteningOptions_s,threatInfo_maliciousProcessArguments_s,threatInfo_fileExtension_g,threatInfo_threatName_g,threatInfo_storyline_g,accountId_s,accountName_s,activityType_d,activityUuid_g,createdAt_t [UTC],id_s,primaryDescription_s,secondaryDescription_s,siteId_s,siteName_s,updatedAt_t [UTC],userId_s,event_name_s,DataFields_s,description_s,comments_s,activeDirectory_computerMemberOf_s,activeDirectory_lastUserMemberOf_s,activeThreats_d,agentVersion_s,allowRemoteShell_b,appsVulnerabilityStatus_s,computerName_s,consoleMigrationStatus_s,coreCount_d,cpuCount_d,cpuId_s,detectionState_s,domain_s,encryptedApplications_b,externalId_s,externalIp_s,firewallEnabled_b,firstFullModeTime_t [UTC],fullDiskScanLastUpdatedAt_t [UTC],groupId_s,groupIp_s,groupName_s,inRemoteShellSession_b,infected_b,installerType_s,isActive_b,isDecommissioned_b,isPendingUninstall_b,isUninstalled_b,isUpToDate_b,lastActiveDate_t [UTC],lastIpToMgmt_s,lastLoggedInUserName_s,licenseKey_s,locationEnabled_b,locationType_s,locations_s,machineType_s,mitigationMode_s,mitigationModeSuspicious_s,modelName_s,networkInterfaces_s,networkQuarantineEnabled_b,networkStatus_s,operationalState_s,osArch_s,osName_s,osRevision_s,osStartTime_t [UTC],osType_s,rangerStatus_s,rangerVersion_s,registeredAt_t [UTC],remoteProfilingState_s,scanFinishedAt_t [UTC],scanStartedAt_t [UTC],scanStatus_s,serialNumber_s,showAlertIcon_b,tags_sentinelone_s,threatRebootRequired_b,totalMemory_d,userActionsNeeded_s,uuid_g,osUsername_s,scanAbortedAt_t [UTC],activeDirectory_computerDistinguishedName_s,activeDirectory_lastUserDistinguishedName_s,Type,_ResourceId +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,,,,,,,,,,watson.events.data.microsoft.com,type: 5 blobcollectorcommon.trafficmanager.net;type: 5 onedsblobprdcus17.centralus.cloudapp.azure.com;13.89.179.12;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738453470521043,Undefined,"7/25/2023, 5:49:11 AM",01H65SG9CAMBQHFPH0TJD6EYXN_430,DNS,Events,Unresolved,TRUE,"7/25/2023, 5:49:17 AM",STAR,"7/25/2023, 5:49:17 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,1752,"7/17/2023, 10:22:47 AM",C43C0EF580778F51,sys_win32,C33C0EF580778F51,NT AUTHORITY\SYSTEM,"""C:\Windows\system32\wermgr.exe"" -upload",b2eb37f1-bd88-302c-2f15-0217722a8c9f,d8e0c1e1ad99a38f3a84414d5af7b761bf0eb924,a4c41c6c4e1d0fadc9bd3313a3d0e329517f400bd8908dd8c70ac69758e60875,C:\Windows\System32\wermgr.exe,MICROSOFT WINDOWS,system,wermgr.exe,5488,"7/25/2023, 5:37:03 AM",34B612F580778F51,sys_win32,33B612F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,,,,,,,,,,settings-win.data.microsoft.com,type: 5 atm-settingsfe-prod-geo2.trafficmanager.net;type: 5 settings-prod-eus2-2.eastus2.cloudapp.azure.com;52.167.17.97;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738465390733605,Undefined,"7/25/2023, 5:49:11 AM",01H65SG9CAMBQHFPH0TJD6EYXN_392,DNS,Events,Unresolved,TRUE,"7/25/2023, 5:49:19 AM",STAR,"7/25/2023, 5:49:19 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\System32\svchost.exe -k utcsvc -p,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,4604,"7/17/2023, 10:22:49 AM",553D0EF580778F51,sys_win32,543D0EF580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,,,,,,,,,,ctldl.windowsupdate.com,type: 5 wu-bg-shim.trafficmanager.net;type: 5 fg.download.windowsupdate.com.c.footprint.net;2001:1900:2381:8::1fe;2001:1900:2381:b0e::1fe;2001:1900:2381:a06::1fe;2001:1900:2381:a04::1fe;2001:1900:2381:201f::1fe;type: 2 eu-b.dns.footprint.net;type: 2 usa-d.dns.footprint.net;type: 2 apac-a.dns.footprint.net;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738470977546837,Undefined,"7/25/2023, 5:49:11 AM",01H65SG9CAMBQHFPH0TJD6EYXN_413,DNS,Events,Unresolved,TRUE,"7/25/2023, 5:49:19 AM",STAR,"7/25/2023, 5:49:19 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,11436,"7/25/2023, 5:34:08 AM",FEAE12F580778F51,sys_win32,FDAE12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,,,,,,,,,,self.events.data.microsoft.com,type: 5 self-events-data.trafficmanager.net;type: 5 onedscolprdcus12.centralus.cloudapp.azure.com;13.89.179.10;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738517366551759,Undefined,"7/25/2023, 5:49:11 AM",01H65SG9CAMBQHFPH0TJD6EYXN_423,DNS,Events,Unresolved,TRUE,"7/25/2023, 5:49:25 AM",STAR,"7/25/2023, 5:49:25 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,C:\Windows\Explorer.EXE,357b678c-68d3-d5ee-86e1-b706fbfd994b,a4e4e2bc502e4ab249b219da357d1aad163ab175,8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,11056,"7/25/2023, 5:36:14 AM",87B212F580778F51,sys_win32,86B212F580778F51,CLO007\Crest,"""C:\Users\Crest\AppData\Local\Microsoft\OneDrive\OneDrive.exe"" /background",8395b7e9-2283-6e33-629d-67e6ccd46869,5e59701140d628e24c7be94a541ffab1cc32a6f6,734da8ffb983303fa0afc63301152aa8b59565e3342a7a306dac73414d23559e,C:\Users\Crest\AppData\Local\Microsoft\OneDrive\OneDrive.exe,MICROSOFT CORPORATION,medium,OneDrive.exe,10772,"7/25/2023, 5:36:20 AM",F3B212F580778F51,sys_win32,F2B212F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:40:04 AM",,,,,,,,,,,,,,,,,fctupdate.fortinet.net,173.243.143.6;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736754737420512884,Undefined,"7/25/2023, 6:21:26 AM",01H65VB5DF5XKTNW3DPG0MTQ35_5,DNS,Events,Unresolved,TRUE,"7/25/2023, 6:21:38 AM",STAR,"7/25/2023, 6:21:38 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,"""C:\Program Files\Fortinet\FortiClient\scheduler.exe""",bf3562cc-7e68-b446-e8a0-0755837c7bb9,8324e6c57aaf70e6f4d28d6849573635d577ac5b,30dbb96d2ed1e3bc5d335744e744fa66eaef9184ebcecf55dc98089042f91285,C:\Program Files\Fortinet\FortiClient\scheduler.exe,FORTINET TECHNOLOGIES (CANADA) ULC,system,scheduler.exe,4000,"7/17/2023, 10:22:48 AM",3C3D0EF580778F51,sys_win32,3B3D0EF580778F51,NT AUTHORITY\SYSTEM,update_task.exe -s FC_{73EFB30F-1CAD-4a7a-AE2E-150282B6CE25}_001000,64daf8fe-dbd8-3495-bdbc-c926baeba739,01894b3921ed84c876e83cc13dce6752852eb53d,1d5d163d963db6bfd32cca6050890253a7b5715d6e35dfe1141987eefd576096,C:\Program Files\Fortinet\FortiClient\update_task.exe,FORTINET TECHNOLOGIES (CANADA) ULC,system,update_task.exe,13936,"7/25/2023, 6:21:04 AM",3C3D0EF580778F51,sys_win32,95DA12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:40:04 AM",,,,,,,,,,,,,,,,,settings-win.data.microsoft.com,type: 5 atm-settingsfe-prod-geo2.trafficmanager.net;type: 5 settings-prod-wjp-1.japanwest.cloudapp.azure.com;64:ff9b::284a:6c7b;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736757502993733126,Undefined,"7/25/2023, 6:27:00 AM",01H65VN9YVSBR9FGDK3RJX7NKK_9,DNS,Events,Unresolved,TRUE,"7/25/2023, 6:27:08 AM",STAR,"7/25/2023, 6:27:08 AM",1736743171400115521,CLO008,1,events,"EndpointName = ""CLO007""",account,Medium,UNDEFINED,C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,1752,"7/17/2023, 10:22:47 AM",C43C0EF580778F51,sys_win32,C33C0EF580778F51,NT AUTHORITY\SYSTEM,taskhostw.exe,4887a65f-d4f6-598a-f498-6cbc1c0e5488,0882f3f9947405bb80c2e830adf69af85c9b51c7,82472a84bcbb4009add338200f8e853fe4c5eafe2e2c3a2d711b85bf29b72d54,C:\Windows\System32\taskhostw.exe,MICROSOFT WINDOWS,system,taskhostw.exe,8648,"7/25/2023, 6:26:34 AM",24DB12F580778F51,sys_win32,23DB12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:40:04 AM",,,,,,,,,,,,,,,,,assets.msn.com,type: 5 assets.msn.com.edgekey.net;type: 5 e28578.d.akamaiedge.net;64:ff9b::2a6a:a492;64:ff9b::2a6a:a278;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736757509536847908,Undefined,"7/25/2023, 6:27:00 AM",01H65VN9YVSBR9FGDK3RJX7NKK_8,DNS,Events,Unresolved,TRUE,"7/25/2023, 6:27:09 AM",STAR,"7/25/2023, 6:27:09 AM",1736743171400115521,CLO008,1,events,"EndpointName = ""CLO007""",account,Medium,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,medium,svchost.exe,11004,"7/25/2023, 5:42:20 AM",EDBB12F580778F51,sys_win32,ECBB12F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:40:04 AM",,,,,,,,,,,,,,,,,settings-win.data.microsoft.com,type: 5 atm-settingsfe-prod-geo2.trafficmanager.net;type: 5 settings-prod-eus-1.eastus.cloudapp.azure.com;52.191.219.104;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736757523109616661,Undefined,"7/25/2023, 6:27:00 AM",01H65VN9YVSBR9FGDK3RJX7NKK_7,DNS,Events,Unresolved,TRUE,"7/25/2023, 6:27:10 AM",STAR,"7/25/2023, 6:27:10 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,1752,"7/17/2023, 10:22:47 AM",C43C0EF580778F51,sys_win32,C33C0EF580778F51,NT AUTHORITY\SYSTEM,taskhostw.exe,4887a65f-d4f6-598a-f498-6cbc1c0e5488,0882f3f9947405bb80c2e830adf69af85c9b51c7,82472a84bcbb4009add338200f8e853fe4c5eafe2e2c3a2d711b85bf29b72d54,C:\Windows\System32\taskhostw.exe,MICROSOFT WINDOWS,system,taskhostw.exe,8648,"7/25/2023, 6:26:34 AM",24DB12F580778F51,sys_win32,23DB12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 2:00:04 PM",,,,,,,,,,,,,,,,,teams.events.data.microsoft.com,type: 5 teams-events-data.trafficmanager.net;type: 5 onedscolprdwus00.westus.cloudapp.azure.com;20.189.173.1;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736977159242096637,Undefined,"7/25/2023, 1:43:18 PM",01H66MM8VMFWW6SBPQ81V9PDKH_71,DNS,Events,Unresolved,TRUE,"7/25/2023, 1:43:33 PM",STAR,"7/25/2023, 1:43:33 PM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,C:\Windows\system32\svchost.exe -k DcomLaunch -p,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,1204,"7/17/2023, 10:22:47 AM",9A3C0EF580778F51,sys_win32,993C0EF580778F51,NT AUTHORITY\SYSTEM,"""C:\Program Files\WindowsApps\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\msteamsupdate.exe"" -RegisterComServerForUpdaterTask -Embedding",2f74f9b2-08d2-c0b4-1892-ff9f9961c4c0,f23bf2ad9ad69ae38fd7575fcced6f37c7b2142e,30018ca29efe5fbeaa03253ea4827fefca031dff1c002f5f7844483abf90c27e,C:\Program Files\WindowsApps\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\msteamsupdate.exe,MICROSOFT CORPORATION,medium,msteamsupdate.exe,16600,"7/25/2023, 1:12:58 PM",EDDB12F580778F51,sys_win32,ECDB12F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 2:00:04 PM",,,,,,,,,,,,,,,,,telem-edge.smartscreen.microsoft.com,type: 5 tm-prod-wd-csp-edge.trafficmanager.net;type: 5 wd-prod-ss-as-southeast-3-fe.southeastasia.cloudapp.azure.com;20.198.188.157;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736978427801032969,Undefined,"7/25/2023, 1:45:59 PM",01H66MS4AHVPK6ZSZA1W047SMR_277,DNS,Events,Unresolved,TRUE,"7/25/2023, 1:46:04 PM",STAR,"7/25/2023, 1:46:04 PM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,C:\Windows\Explorer.EXE,357b678c-68d3-d5ee-86e1-b706fbfd994b,a4e4e2bc502e4ab249b219da357d1aad163ab175,8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,14472,"7/25/2023, 5:42:20 AM",FEBB12F580778F51,sys_win32,FDBB12F580778F51,CLO007\Crest,C:\Windows\System32\smartscreen.exe -Embedding,8b71524d-b619-2b9a-1967-1156e27b1826,4549fabd13aaf136087a4501682eb2559eaafdbb,83c9bd1ff0dd424a841cd1b22993e09e16d1339501070613236b0d1f8bff92bc,C:\Windows\System32\smartscreen.exe,MICROSOFT WINDOWS,medium,smartscreen.exe,14528,"7/25/2023, 1:45:28 PM",E0E912F580778F51,sys_win32,DFE912F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 2:00:04 PM",,,,,,,,,,,,,,,,,telem-edge.smartscreen.microsoft.com,type: 5 tm-prod-wd-csp-edge.trafficmanager.net;type: 5 wd-prod-ss-as-southeast-3-fe.southeastasia.cloudapp.azure.com;20.198.188.157;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736978452270603436,Undefined,"7/25/2023, 1:45:59 PM",01H66MS4AHVPK6ZSZA1W047SMR_277,DNS,Events,Unresolved,TRUE,"7/25/2023, 1:46:07 PM",STAR,"7/25/2023, 1:46:07 PM",1736743171400115521,CLO008,1,events,"EndpointName = ""CLO007""",account,Medium,UNDEFINED,C:\Windows\Explorer.EXE,357b678c-68d3-d5ee-86e1-b706fbfd994b,a4e4e2bc502e4ab249b219da357d1aad163ab175,8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,14472,"7/25/2023, 5:42:20 AM",FEBB12F580778F51,sys_win32,FDBB12F580778F51,CLO007\Crest,C:\Windows\System32\smartscreen.exe -Embedding,8b71524d-b619-2b9a-1967-1156e27b1826,4549fabd13aaf136087a4501682eb2559eaafdbb,83c9bd1ff0dd424a841cd1b22993e09e16d1339501070613236b0d1f8bff92bc,C:\Windows\System32\smartscreen.exe,MICROSOFT WINDOWS,medium,smartscreen.exe,14528,"7/25/2023, 1:45:28 PM",E0E912F580778F51,sys_win32,DFE912F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:50:03 AM",,,,,,,,,,,,,,,,,to-do.microsoft.com,type: 5 todo-web-production-traffic-manager.trafficmanager.net;type: 5 todo-web-production-westindia.azurewebsites.net;type: 5 waws-prod-bm1-003.sip.azurewebsites.windows.net;type: 5 waws-prod-bm1-003.cloudapp.net;104.211.184.197;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736761020077216368,Undefined,"7/25/2023, 6:33:57 AM",01H65W245BAGADGRFVC0V5ESDN_15,DNS,Events,Unresolved,TRUE,"7/25/2023, 6:34:07 AM",STAR,"7/25/2023, 6:34:07 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,1752,"7/17/2023, 10:22:47 AM",C43C0EF580778F51,sys_win32,C33C0EF580778F51,NT AUTHORITY\SYSTEM,"""C:\Windows\system32\AppHostRegistrationVerifier.exe""",5a7831fe-6c45-2547-ada5-ad795320a4a5,b6dd065e459c602341cce8c9dd85d70627fcddaf,a50beece3cab3c18fee40596c3a96501183198d6d19e24041a506180c0924d5d,C:\Windows\System32\AppHostRegistrationVerifier.exe,MICROSOFT WINDOWS,medium,AppHostRegistrationVerifier.exe,9556,"7/25/2023, 6:33:34 AM",6BDB12F580778F51,sys_win32,6ADB12F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,,,,,,,,,,teams.events.data.microsoft.com,type: 5 teams-events-data.trafficmanager.net;type: 5 onedscolprdcus03.centralus.cloudapp.azure.com;64:ff9b::d59:b21b;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738576808232122,Undefined,"7/25/2023, 5:49:11 AM",01H65SG9CAMBQHFPH0TJD6EYXN_418,DNS,Events,Unresolved,TRUE,"7/25/2023, 5:49:32 AM",STAR,"7/25/2023, 5:49:32 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,"""C:\Program Files\WindowsApps\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\msteams.exe"" ms-teams:system-initiated",1626f236-c0dc-28d5-92a1-0a359ebe3460,0fc1714b93869441cba7d44368ec411bac434e68,8cca5e46f6e9dfe566795c4e76aae4d44de8885f43bed759ef6bcad2516ac285,C:\Program Files\WindowsApps\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\msteams.exe,MICROSOFT CORPORATION,medium,msteams.exe,9452,"7/25/2023, 5:36:24 AM",C9B312F580778F51,sys_win32,CCB312F580778F51,CLO007\Crest,"""C:\Program Files\WindowsApps\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\msteamsupdate.exe"" -CheckUpdate -AppSessionGUID 5f23fd1b-805c-4d0a-a246-a6baae250641",2f74f9b2-08d2-c0b4-1892-ff9f9961c4c0,f23bf2ad9ad69ae38fd7575fcced6f37c7b2142e,30018ca29efe5fbeaa03253ea4827fefca031dff1c002f5f7844483abf90c27e,C:\Program Files\WindowsApps\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\msteamsupdate.exe,MICROSOFT CORPORATION,medium,msteamsupdate.exe,10628,"7/25/2023, 5:36:24 AM",C9B312F580778F51,sys_win32,E8B312F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,,,,,,,,,,disc601.prod.do.dsp.mp.microsoft.com,type: 5 disc601.prod.do.dsp.mp.microsoft.com.edgekey.net;type: 5 e12358.d.akamaiedge.net;type: 6 n0d.akamaiedge.net;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738586681624349,Undefined,"7/25/2023, 5:49:14 AM",01H65SGAGCE4JDGCGC1GCKNT9S_2,DNS,Events,Unresolved,TRUE,"7/25/2023, 5:49:33 AM",STAR,"7/25/2023, 5:49:33 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\System32\svchost.exe -k NetworkService -p,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,8620,"7/17/2023, 10:33:11 AM",4E4B0EF580778F51,sys_win32,4D4B0EF580778F51,NT AUTHORITY\NETWORK SERVICE,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,,,,,,,,,,edgedl.me.gvt1.com,34.104.35.123;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738647784248248,Undefined,"7/25/2023, 5:49:14 AM",01H65SGAGCE4JDGCGC1GCKNT9S_14,DNS,Events,Unresolved,TRUE,"7/25/2023, 5:49:40 AM",STAR,"7/25/2023, 5:49:40 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,10972,"7/25/2023, 5:28:16 AM",09AB12F580778F51,sys_win32,08AB12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,,,,,,,,,,spclient.wg.spotify.com,type: 5 edge-web.dual-gslb.spotify.com;35.186.224.25;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738650518934577,Undefined,"7/25/2023, 5:49:11 AM",01H65SG9CAMBQHFPH0TJD6EYXN_388,DNS,Events,Unresolved,TRUE,"7/25/2023, 5:49:41 AM",STAR,"7/25/2023, 5:49:41 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,medium,svchost.exe,17308,"7/25/2023, 5:36:13 AM",7AB212F580778F51,sys_win32,79B212F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,,,,,,,,,,clients1.google.com,type: 5 clients.l.google.com;142.251.42.78;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738692386479262,Undefined,"7/25/2023, 5:49:14 AM",01H65SGAGCE4JDGCGC1GCKNT9S_41,DNS,Events,Unresolved,TRUE,"7/25/2023, 5:49:46 AM",STAR,"7/25/2023, 5:49:46 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,"""C:\Program Files\Google\Chrome\Application\chrome.exe""",a4055576-b3c2-8c82-dfb0-e8a4c5249665,4aead115343858d095687c129e198f26f77fb3f0,30173761d733d6431312118566947a48142b10fa4dec784af6316eb15b80b769,C:\Program Files\Google\Chrome\Application\chrome.exe,GOOGLE LLC,medium,chrome.exe,5084,"7/25/2023, 5:38:34 AM",A9B712F580778F51,sys_win32,A8B712F580778F51,CLO007\Crest,"""C:\Program Files\Google\Chrome\Application\chrome.exe"" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1876,i,7828680769750590995,7072517024340962698,262144 /prefetch:8",a4055576-b3c2-8c82-dfb0-e8a4c5249665,4aead115343858d095687c129e198f26f77fb3f0,30173761d733d6431312118566947a48142b10fa4dec784af6316eb15b80b769,C:\Program Files\Google\Chrome\Application\chrome.exe,GOOGLE LLC,medium,chrome.exe,11092,"7/25/2023, 5:38:35 AM",A9B712F580778F51,sys_win32,AFB712F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,,,,,,,,,,statics.teams.cdn.live.net,type: 5 tfl-staticscdn.trafficmanager.net;type: 5 statics.teams.cdn.live.net.edgesuite.net;type: 5 a1996.dscd.akamai.net;2402:3a80:c000:23::2a6a:a208;2402:3a80:c000:23::2a6a:a26a;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738713316057235,Undefined,"7/25/2023, 5:49:14 AM",01H65SGAGCE4JDGCGC1GCKNT9S_20,DNS,Events,Unresolved,TRUE,"7/25/2023, 5:49:48 AM",STAR,"7/25/2023, 5:49:48 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,"""C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.82\msedgewebview2.exe"" --embedded-browser-webview=1 --webview-exe-name=msteams.exe --webview-exe-version=23119.303.2080.2726 --user-data-dir=""C:\Users\Crest\AppData\Local\Packages\MicrosoftTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView"" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=MojoIpcz,msWebOOUI --edge-webview-is-background --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msEdgeFluentOverlayScrollbar,msWebView2CodeCache,msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=9452.304.10670547643736121190 /pfhostedapp:e7e952ed836442a682dca713cb7c4d91d21a087a",0f259745-8e7a-c81b-049d-45ef5b291246,bbd88a2a41c94d4140ccaef71bfb771e0ccc5c32,0ce0ef234aba4bf60f1c48a058ce764d52e91078e95312de4db4b0911f4cc7d4,C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.82\msedgewebview2.exe,MICROSOFT CORPORATION,medium,msedgewebview2.exe,11324,"7/25/2023, 5:37:27 AM",C9B312F580778F51,sys_win32,A0B612F580778F51,CLO007\Crest,"""C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.82\msedgewebview2.exe"" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir=""C:\Users\Crest\AppData\Local\Packages\MicrosoftTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView"" --webview-exe-name=msteams.exe --webview-exe-version=23119.303.2080.2726 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2084 --field-trial-handle=1856,i,10401165809981385728,645714553629917069,262144 --enable-features=msEdgeFluentOverlayScrollbar,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2CodeCache,msWebView2EnableDraggableRegions --disable-features=MojoIpcz,msWebOOUI /prefetch:3 /pfhostedapp:e7e952ed836442a682dca713cb7c4d91d21a087a",0f259745-8e7a-c81b-049d-45ef5b291246,bbd88a2a41c94d4140ccaef71bfb771e0ccc5c32,0ce0ef234aba4bf60f1c48a058ce764d52e91078e95312de4db4b0911f4cc7d4,C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.82\msedgewebview2.exe,MICROSOFT CORPORATION,medium,msedgewebview2.exe,5728,"7/25/2023, 5:37:27 AM",C9B312F580778F51,sys_win32,BFB612F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,,,,,,,,,,ocsp.digicert.com,type: 5 ocsp.edge.digicert.com;type: 5 fp2e7a.wpc.2be4.phicdn.net;type: 5 fp2e7a.wpc.phicdn.net;64:ff9b::98c3:264c;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738722031821381,Undefined,"7/25/2023, 5:49:11 AM",01H65SG9CAMBQHFPH0TJD6EYXN_440,DNS,Events,Unresolved,TRUE,"7/25/2023, 5:49:49 AM",STAR,"7/25/2023, 5:49:49 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,sihost.exe,e5a23407-157b-23f3-c244-1d412163e4ee,e8d9750e757e5b580c56521a81ed0cc41d327d82,51eb6455bdca85d3102a00b1ce89969016efc3ed8b08b24a2aa10e03ba1e2b13,C:\Windows\System32\sihost.exe,MICROSOFT WINDOWS,medium,sihost.exe,13788,"7/25/2023, 5:36:13 AM",B2B112F580778F51,sys_win32,B1B112F580778F51,CLO007\Crest,"""C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca",4bd84472-eca2-b69a-0391-f61fa50d0f31,0ca4bcd60601ec0d8602d4f5994cb0393edb892b,c1fc7f6cb2228ee6386d91f27f1a61ae60a63deefb21d78bb810b7f027f1a489,C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe,MICROSOFT WINDOWS,low,StartMenuExperienceHost.exe,4524,"7/25/2023, 5:36:15 AM",B5B212F580778F51,sys_win32,B4B212F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,,,,,,,,,,ctldl.windowsupdate.com,type: 5 wu-bg-shim.trafficmanager.net;type: 5 fg.download.windowsupdate.com.c.footprint.net;8.241.152.254;8.241.160.126;8.241.135.126;8.241.154.254;8.241.151.126;type: 2 usa-d.dns.footprint.net;type: 2 apac-a.dns.footprint.net;type: 2 eu-b.dns.footprint.net;,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738767942674071,Undefined,"7/25/2023, 5:49:14 AM",01H65SGAGCE4JDGCGC1GCKNT9S_30,DNS,Events,Unresolved,TRUE,"7/25/2023, 5:49:55 AM",STAR,"7/25/2023, 5:49:55 AM",1733163280061426015,DNS,1,events,"EventType = ""DNS Resolved"" OR EventType = ""DNS Unresolved""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k NetworkService -p,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,1576,"7/17/2023, 10:22:47 AM",B83C0EF580778F51,sys_win32,B73C0EF580778F51,NT AUTHORITY\NETWORK SERVICE,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, \ No newline at end of file diff --git a/Sample Data/ASIM/SentinelOne_ASimDns_RawLogs.json b/Sample Data/ASIM/SentinelOne_ASimDns_RawLogs.json new file mode 100644 index 00000000000..24ef91f4697 --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimDns_RawLogs.json @@ -0,0 +1,6042 @@ +[ + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "0f81ec00-9e52-48e6-b899-eb3bbeede741", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "watson.events.data.microsoft.com", + "alertInfo_dnsResponse": "type: 5 blobcollectorcommon.trafficmanager.net;type: 5 onedsblobprdcus17.centralus.cloudapp.azure.com;13.89.179.12;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738453470521000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:11 AM", + "alertInfo_dvEventId": "01H65SG9CAMBQHFPH0TJD6EYXN_430", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:17 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:17 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule", + "sourceParentProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceParentProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceParentProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "svchost.exe", + "sourceParentProcessInfo_pid": 1752, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\wermgr.exe\" -upload", + "sourceProcessInfo_fileHashMd5": "b2eb37f1-bd88-302c-2f15-0217722a8c9f", + "sourceProcessInfo_fileHashSha1": "d8e0c1e1ad99a38f3a84414d5af7b761bf0eb924", + "sourceProcessInfo_fileHashSha256": "a4c41c6c4e1d0fadc9bd3313a3d0e329517f400bd8908dd8c70ac69758e60875", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\wermgr.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "wermgr.exe", + "sourceProcessInfo_pid": 5488, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:37:03 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "AC644457DCBAD901", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "FB4511F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "settings-win.data.microsoft.com", + "alertInfo_dnsResponse": "type: 5 atm-settingsfe-prod-geo2.trafficmanager.net;type: 5 settings-prod-eus2-2.eastus2.cloudapp.azure.com;52.167.17.97;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "433C0EF580778F52", + "targetProcessInfo_tgtProcUid": "433C0EF580778F53", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "553D0EF580778F51", + "sourceProcessInfo_uniqueId": "543D0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738465390733600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:11 AM", + "alertInfo_dvEventId": "01H65SG9CAMBQHFPH0TJD6EYXN_392", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:19 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:19 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\svchost.exe -k utcsvc -p", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 4604, + "sourceProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:49 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "ctldl.windowsupdate.com", + "alertInfo_dnsResponse": "type: 5 wu-bg-shim.trafficmanager.net;type: 5 fg.download.windowsupdate.com.c.footprint.net;2001:1900:2381:8::1fe;2001:1900:2381:b0e::1fe;2001:1900:2381:a06::1fe;2001:1900:2381:a04::1fe;2001:1900:2381:201f::1fe;type: 2 eu-b.dns.footprint.net;type: 2 usa-d.dns.footprint.net;type: 2 apac-a.dns.footprint.net;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "78d7744d-2837-40d2-aff4-bede5877836e", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "FEAE12F580778F51", + "sourceProcessInfo_uniqueId": "FDAE12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738470977546800, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:11 AM", + "alertInfo_dvEventId": "01H65SG9CAMBQHFPH0TJD6EYXN_413", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:19 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:19 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s wlidsvc", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 11436, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:34:08 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "self.events.data.microsoft.com", + "alertInfo_dnsResponse": "type: 5 self-events-data.trafficmanager.net;type: 5 onedscolprdcus12.centralus.cloudapp.azure.com;13.89.179.10;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "svchost.exe,FrameServer", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "87B212F580778F51", + "sourceParentProcessInfo_uniqueId": "86B212F580778F51", + "sourceProcessInfo_storyline": "F3B212F580778F51", + "sourceProcessInfo_uniqueId": "F2B212F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738517366551800, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:11 AM", + "alertInfo_dvEventId": "01H65SG9CAMBQHFPH0TJD6EYXN_423", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:25 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:25 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\Explorer.EXE", + "sourceParentProcessInfo_fileHashMd5": "357b678c-68d3-d5ee-86e1-b706fbfd994b", + "sourceParentProcessInfo_fileHashSha1": "a4e4e2bc502e4ab249b219da357d1aad163ab175", + "sourceParentProcessInfo_fileHashSha256": "8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "explorer.exe", + "sourceParentProcessInfo_pid": 11056, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:36:14 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Users\\Crest\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /background", + "sourceProcessInfo_fileHashMd5": "8395b7e9-2283-6e33-629d-67e6ccd46869", + "sourceProcessInfo_fileHashSha1": "5e59701140d628e24c7be94a541ffab1cc32a6f6", + "sourceProcessInfo_fileHashSha256": "734da8ffb983303fa0afc63301152aa8b59565e3342a7a306dac73414d23559e", + "sourceProcessInfo_filePath": "C:\\Users\\Crest\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "OneDrive.exe", + "sourceProcessInfo_pid": 10772, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:36:20 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:40:04 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "fctupdate.fortinet.net", + "alertInfo_dnsResponse": "173.243.143.6;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "3C3D0EF580778F51", + "sourceParentProcessInfo_uniqueId": "3B3D0EF580778F51", + "sourceProcessInfo_storyline": "3C3D0EF580778F51", + "sourceProcessInfo_uniqueId": "95DA12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736754737420512800, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 6:21:26 AM", + "alertInfo_dvEventId": "01H65VB5DF5XKTNW3DPG0MTQ35_5", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 6:21:38 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 6:21:38 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Program Files\\Fortinet\\FortiClient\\scheduler.exe", + "sourceParentProcessInfo_fileHashMd5": "bf3562cc-7e68-b446-e8a0-0755837c7bb9", + "sourceParentProcessInfo_fileHashSha1": "8324e6c57aaf70e6f4d28d6849573635d577ac5b", + "sourceParentProcessInfo_fileHashSha256": "30dbb96d2ed1e3bc5d335744e744fa66eaef9184ebcecf55dc98089042f91285", + "sourceParentProcessInfo_filePath": "C:\\Program Files\\Fortinet\\FortiClient\\scheduler.exe", + "sourceParentProcessInfo_fileSignerIdentity": "FORTINET TECHNOLOGIES (CANADA) ULC", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "scheduler.exe", + "sourceParentProcessInfo_pid": 4000, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:48 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "update_task.exe -s FC_{73EFB30F-1CAD-4a7a-AE2E-150282B6CE25}_001000", + "sourceProcessInfo_fileHashMd5": "64daf8fe-dbd8-3495-bdbc-c926baeba739", + "sourceProcessInfo_fileHashSha1": "01894b3921ed84c876e83cc13dce6752852eb53d", + "sourceProcessInfo_fileHashSha256": "1d5d163d963db6bfd32cca6050890253a7b5715d6e35dfe1141987eefd576096", + "sourceProcessInfo_filePath": "C:\\Program Files\\Fortinet\\FortiClient\\update_task.exe", + "sourceProcessInfo_fileSignerIdentity": "FORTINET TECHNOLOGIES (CANADA) ULC", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "update_task.exe", + "sourceProcessInfo_pid": 13936, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 6:21:04 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:40:04 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "settings-win.data.microsoft.com", + "alertInfo_dnsResponse": "type: 5 atm-settingsfe-prod-geo2.trafficmanager.net;type: 5 settings-prod-wjp-1.japanwest.cloudapp.azure.com;64:ff9b::284a:6c7b;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "C43C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "C33C0EF580778F51", + "sourceProcessInfo_storyline": "24DB12F580778F51", + "sourceProcessInfo_uniqueId": "23DB12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736757502993733000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 6:27:00 AM", + "alertInfo_dvEventId": "01H65VN9YVSBR9FGDK3RJX7NKK_9", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 6:27:08 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 6:27:08 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CLO008", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule", + "sourceParentProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceParentProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceParentProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "svchost.exe", + "sourceParentProcessInfo_pid": 1752, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "taskhostw.exe", + "sourceProcessInfo_fileHashMd5": "4887a65f-d4f6-598a-f498-6cbc1c0e5488", + "sourceProcessInfo_fileHashSha1": "0882f3f9947405bb80c2e830adf69af85c9b51c7", + "sourceProcessInfo_fileHashSha256": "82472a84bcbb4009add338200f8e853fe4c5eafe2e2c3a2d711b85bf29b72d54", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\taskhostw.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "taskhostw.exe", + "sourceProcessInfo_pid": 8648, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 6:26:34 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:40:04 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "assets.msn.com", + "alertInfo_dnsResponse": "type: 5 assets.msn.com.edgekey.net;type: 5 e28578.d.akamaiedge.net;64:ff9b::2a6a:a492;64:ff9b::2a6a:a278;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "EDBB12F580778F51", + "sourceProcessInfo_uniqueId": "ECBB12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736757509536848000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 6:27:00 AM", + "alertInfo_dvEventId": "01H65VN9YVSBR9FGDK3RJX7NKK_8", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 6:27:09 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 6:27:09 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CLO008", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup -s WpnUserService", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 11004, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:42:20 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:40:04 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "settings-win.data.microsoft.com", + "alertInfo_dnsResponse": "type: 5 atm-settingsfe-prod-geo2.trafficmanager.net;type: 5 settings-prod-eus-1.eastus.cloudapp.azure.com;52.191.219.104;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "C43C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "C33C0EF580778F51", + "sourceProcessInfo_storyline": "24DB12F580778F51", + "sourceProcessInfo_uniqueId": "23DB12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736757523109616600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 6:27:00 AM", + "alertInfo_dvEventId": "01H65VN9YVSBR9FGDK3RJX7NKK_7", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 6:27:10 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 6:27:10 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule", + "sourceParentProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceParentProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceParentProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "svchost.exe", + "sourceParentProcessInfo_pid": 1752, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "taskhostw.exe", + "sourceProcessInfo_fileHashMd5": "4887a65f-d4f6-598a-f498-6cbc1c0e5488", + "sourceProcessInfo_fileHashSha1": "0882f3f9947405bb80c2e830adf69af85c9b51c7", + "sourceProcessInfo_fileHashSha256": "82472a84bcbb4009add338200f8e853fe4c5eafe2e2c3a2d711b85bf29b72d54", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\taskhostw.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "taskhostw.exe", + "sourceProcessInfo_pid": 8648, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 6:26:34 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 2:00:04 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "teams.events.data.microsoft.com", + "alertInfo_dnsResponse": "type: 5 teams-events-data.trafficmanager.net;type: 5 onedscolprdwus00.westus.cloudapp.azure.com;20.189.173.1;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "9A3C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "993C0EF580778F51", + "sourceProcessInfo_storyline": "EDDB12F580778F51", + "sourceProcessInfo_uniqueId": "ECDB12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736977159242096600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 1:43:18 PM", + "alertInfo_dvEventId": "01H66MM8VMFWW6SBPQ81V9PDKH_71", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 1:43:33 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 1:43:33 PM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p", + "sourceParentProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceParentProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceParentProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "svchost.exe", + "sourceParentProcessInfo_pid": 1204, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Program Files\\WindowsApps\\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\\msteamsupdate.exe\" -RegisterComServerForUpdaterTask -Embedding", + "sourceProcessInfo_fileHashMd5": "2f74f9b2-08d2-c0b4-1892-ff9f9961c4c0", + "sourceProcessInfo_fileHashSha1": "f23bf2ad9ad69ae38fd7575fcced6f37c7b2142e", + "sourceProcessInfo_fileHashSha256": "30018ca29efe5fbeaa03253ea4827fefca031dff1c002f5f7844483abf90c27e", + "sourceProcessInfo_filePath": "C:\\Program Files\\WindowsApps\\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\\msteamsupdate.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "msteamsupdate.exe", + "sourceProcessInfo_pid": 16600, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 1:12:58 PM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 2:00:04 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "telem-edge.smartscreen.microsoft.com", + "alertInfo_dnsResponse": "type: 5 tm-prod-wd-csp-edge.trafficmanager.net;type: 5 wd-prod-ss-as-southeast-3-fe.southeastasia.cloudapp.azure.com;20.198.188.157;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "FEBB12F580778F51", + "sourceParentProcessInfo_uniqueId": "FDBB12F580778F51", + "sourceProcessInfo_storyline": "E0E912F580778F51", + "sourceProcessInfo_uniqueId": "DFE912F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736978427801033000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 1:45:59 PM", + "alertInfo_dvEventId": "01H66MS4AHVPK6ZSZA1W047SMR_277", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 1:46:04 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 1:46:04 PM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\Explorer.EXE", + "sourceParentProcessInfo_fileHashMd5": "357b678c-68d3-d5ee-86e1-b706fbfd994b", + "sourceParentProcessInfo_fileHashSha1": "a4e4e2bc502e4ab249b219da357d1aad163ab175", + "sourceParentProcessInfo_fileHashSha256": "8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "explorer.exe", + "sourceParentProcessInfo_pid": 14472, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:42:20 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\smartscreen.exe -Embedding", + "sourceProcessInfo_fileHashMd5": "8b71524d-b619-2b9a-1967-1156e27b1826", + "sourceProcessInfo_fileHashSha1": "4549fabd13aaf136087a4501682eb2559eaafdbb", + "sourceProcessInfo_fileHashSha256": "83c9bd1ff0dd424a841cd1b22993e09e16d1339501070613236b0d1f8bff92bc", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\smartscreen.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "smartscreen.exe", + "sourceProcessInfo_pid": 14528, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 1:45:28 PM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 2:00:04 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "telem-edge.smartscreen.microsoft.com", + "alertInfo_dnsResponse": "type: 5 tm-prod-wd-csp-edge.trafficmanager.net;type: 5 wd-prod-ss-as-southeast-3-fe.southeastasia.cloudapp.azure.com;20.198.188.157;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "FEBB12F580778F51", + "sourceParentProcessInfo_uniqueId": "FDBB12F580778F51", + "sourceProcessInfo_storyline": "E0E912F580778F51", + "sourceProcessInfo_uniqueId": "DFE912F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736978452270603500, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 1:45:59 PM", + "alertInfo_dvEventId": "01H66MS4AHVPK6ZSZA1W047SMR_277", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 1:46:07 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 1:46:07 PM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CLO008", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\Explorer.EXE", + "sourceParentProcessInfo_fileHashMd5": "357b678c-68d3-d5ee-86e1-b706fbfd994b", + "sourceParentProcessInfo_fileHashSha1": "a4e4e2bc502e4ab249b219da357d1aad163ab175", + "sourceParentProcessInfo_fileHashSha256": "8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "explorer.exe", + "sourceParentProcessInfo_pid": 14472, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:42:20 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\smartscreen.exe -Embedding", + "sourceProcessInfo_fileHashMd5": "8b71524d-b619-2b9a-1967-1156e27b1826", + "sourceProcessInfo_fileHashSha1": "4549fabd13aaf136087a4501682eb2559eaafdbb", + "sourceProcessInfo_fileHashSha256": "83c9bd1ff0dd424a841cd1b22993e09e16d1339501070613236b0d1f8bff92bc", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\smartscreen.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "smartscreen.exe", + "sourceProcessInfo_pid": 14528, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 1:45:28 PM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:50:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "to-do.microsoft.com", + "alertInfo_dnsResponse": "type: 5 todo-web-production-traffic-manager.trafficmanager.net;type: 5 todo-web-production-westindia.azurewebsites.net;type: 5 waws-prod-bm1-003.sip.azurewebsites.windows.net;type: 5 waws-prod-bm1-003.cloudapp.net;104.211.184.197;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "C43C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "C33C0EF580778F51", + "sourceProcessInfo_storyline": "6BDB12F580778F51", + "sourceProcessInfo_uniqueId": "6ADB12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736761020077216300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 6:33:57 AM", + "alertInfo_dvEventId": "01H65W245BAGADGRFVC0V5ESDN_15", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 6:34:07 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 6:34:07 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule", + "sourceParentProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceParentProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceParentProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "svchost.exe", + "sourceParentProcessInfo_pid": 1752, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\AppHostRegistrationVerifier.exe", + "sourceProcessInfo_fileHashMd5": "5a7831fe-6c45-2547-ada5-ad795320a4a5", + "sourceProcessInfo_fileHashSha1": "b6dd065e459c602341cce8c9dd85d70627fcddaf", + "sourceProcessInfo_fileHashSha256": "a50beece3cab3c18fee40596c3a96501183198d6d19e24041a506180c0924d5d", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\AppHostRegistrationVerifier.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "AppHostRegistrationVerifier.exe", + "sourceProcessInfo_pid": 9556, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 6:33:34 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "teams.events.data.microsoft.com", + "alertInfo_dnsResponse": "type: 5 teams-events-data.trafficmanager.net;type: 5 onedscolprdcus03.centralus.cloudapp.azure.com;64:ff9b::d59:b21b;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "C9B312F580778F51", + "sourceParentProcessInfo_uniqueId": "CCB312F580778F51", + "sourceProcessInfo_storyline": "C9B312F580778F51", + "sourceProcessInfo_uniqueId": "E8B312F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738576808232200, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:11 AM", + "alertInfo_dvEventId": "01H65SG9CAMBQHFPH0TJD6EYXN_418", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:32 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:32 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Program Files\\WindowsApps\\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\\msteams.exe\" ms-teams:system-initiated", + "sourceParentProcessInfo_fileHashMd5": "1626f236-c0dc-28d5-92a1-0a359ebe3460", + "sourceParentProcessInfo_fileHashSha1": "0fc1714b93869441cba7d44368ec411bac434e68", + "sourceParentProcessInfo_fileHashSha256": "8cca5e46f6e9dfe566795c4e76aae4d44de8885f43bed759ef6bcad2516ac285", + "sourceParentProcessInfo_filePath": "C:\\Program Files\\WindowsApps\\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\\msteams.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "msteams.exe", + "sourceParentProcessInfo_pid": 9452, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:36:24 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Program Files\\WindowsApps\\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\\msteamsupdate.exe\" -CheckUpdate -AppSessionGUID 5f23fd1b-805c-4d0a-a246-a6baae250641", + "sourceProcessInfo_fileHashMd5": "2f74f9b2-08d2-c0b4-1892-ff9f9961c4c0", + "sourceProcessInfo_fileHashSha1": "f23bf2ad9ad69ae38fd7575fcced6f37c7b2142e", + "sourceProcessInfo_fileHashSha256": "30018ca29efe5fbeaa03253ea4827fefca031dff1c002f5f7844483abf90c27e", + "sourceProcessInfo_filePath": "C:\\Program Files\\WindowsApps\\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\\msteamsupdate.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "msteamsupdate.exe", + "sourceProcessInfo_pid": 10628, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:36:24 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "disc601.prod.do.dsp.mp.microsoft.com", + "alertInfo_dnsResponse": "type: 5 disc601.prod.do.dsp.mp.microsoft.com.edgekey.net;type: 5 e12358.d.akamaiedge.net;type: 6 n0d.akamaiedge.net;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "4E4B0EF580778F51", + "sourceProcessInfo_uniqueId": "4D4B0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738586681624300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:14 AM", + "alertInfo_dvEventId": "01H65SGAGCE4JDGCGC1GCKNT9S_2", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:33 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:33 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\svchost.exe -k NetworkService -p", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 8620, + "sourceProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:33:11 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\NETWORK SERVICE", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "edgedl.me.gvt1.com", + "alertInfo_dnsResponse": "34.104.35.123;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "09AB12F580778F51", + "sourceProcessInfo_uniqueId": "08AB12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738647784248300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:14 AM", + "alertInfo_dvEventId": "01H65SGAGCE4JDGCGC1GCKNT9S_14", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:40 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:40 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\svchost.exe -k netsvcs -p -s BITS", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 10972, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:28:16 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "spclient.wg.spotify.com", + "alertInfo_dnsResponse": "type: 5 edge-web.dual-gslb.spotify.com;35.186.224.25;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "7AB212F580778F51", + "sourceProcessInfo_uniqueId": "79B212F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738650518934500, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:11 AM", + "alertInfo_dvEventId": "01H65SG9CAMBQHFPH0TJD6EYXN_388", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:41 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:41 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup -s WpnUserService", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 17308, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:36:13 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "clients1.google.com", + "alertInfo_dnsResponse": "type: 5 clients.l.google.com;142.251.42.78;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "A9B712F580778F51", + "sourceParentProcessInfo_uniqueId": "A8B712F580778F51", + "sourceProcessInfo_storyline": "A9B712F580778F51", + "sourceProcessInfo_uniqueId": "AFB712F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738692386479400, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:14 AM", + "alertInfo_dvEventId": "01H65SGAGCE4JDGCGC1GCKNT9S_41", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:46 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:46 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", + "sourceParentProcessInfo_fileHashMd5": "a4055576-b3c2-8c82-dfb0-e8a4c5249665", + "sourceParentProcessInfo_fileHashSha1": "4aead115343858d095687c129e198f26f77fb3f0", + "sourceParentProcessInfo_fileHashSha256": "30173761d733d6431312118566947a48142b10fa4dec784af6316eb15b80b769", + "sourceParentProcessInfo_filePath": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", + "sourceParentProcessInfo_fileSignerIdentity": "GOOGLE LLC", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "chrome.exe", + "sourceParentProcessInfo_pid": 5084, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:38:34 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1876,i,7828680769750590995,7072517024340962698,262144 /prefetch:8", + "sourceProcessInfo_fileHashMd5": "a4055576-b3c2-8c82-dfb0-e8a4c5249665", + "sourceProcessInfo_fileHashSha1": "4aead115343858d095687c129e198f26f77fb3f0", + "sourceProcessInfo_fileHashSha256": "30173761d733d6431312118566947a48142b10fa4dec784af6316eb15b80b769", + "sourceProcessInfo_filePath": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", + "sourceProcessInfo_fileSignerIdentity": "GOOGLE LLC", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "chrome.exe", + "sourceProcessInfo_pid": 11092, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:38:35 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "statics.teams.cdn.live.net", + "alertInfo_dnsResponse": "type: 5 tfl-staticscdn.trafficmanager.net;type: 5 statics.teams.cdn.live.net.edgesuite.net;type: 5 a1996.dscd.akamai.net;2402:3a80:c000:23::2a6a:a208;2402:3a80:c000:23::2a6a:a26a;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "C9B312F580778F51", + "sourceParentProcessInfo_uniqueId": "A0B612F580778F51", + "sourceProcessInfo_storyline": "C9B312F580778F51", + "sourceProcessInfo_uniqueId": "BFB612F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738713316057300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:14 AM", + "alertInfo_dvEventId": "01H65SGAGCE4JDGCGC1GCKNT9S_20", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:48 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:48 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.82\\msedgewebview2.exe\" --embedded-browser-webview=1 --webview-exe-name=msteams.exe --webview-exe-version=23119.303.2080.2726 --user-data-dir=\"C:\\Users\\Crest\\AppData\\Local\\Packages\\MicrosoftTeams_8wekyb3d8bbwe\\LocalCache\\Microsoft\\MSTeams\\EBWebView\" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=MojoIpcz,msWebOOUI --edge-webview-is-background --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msEdgeFluentOverlayScrollbar,msWebView2CodeCache,msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=9452.304.10670547643736121190 /pfhostedapp:e7e952ed836442a682dca713cb7c4d91d21a087a", + "sourceParentProcessInfo_fileHashMd5": "0f259745-8e7a-c81b-049d-45ef5b291246", + "sourceParentProcessInfo_fileHashSha1": "bbd88a2a41c94d4140ccaef71bfb771e0ccc5c32", + "sourceParentProcessInfo_fileHashSha256": "0ce0ef234aba4bf60f1c48a058ce764d52e91078e95312de4db4b0911f4cc7d4", + "sourceParentProcessInfo_filePath": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.82\\msedgewebview2.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "msedgewebview2.exe", + "sourceParentProcessInfo_pid": 11324, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:37:27 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.82\\msedgewebview2.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir=\"C:\\Users\\Crest\\AppData\\Local\\Packages\\MicrosoftTeams_8wekyb3d8bbwe\\LocalCache\\Microsoft\\MSTeams\\EBWebView\" --webview-exe-name=msteams.exe --webview-exe-version=23119.303.2080.2726 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2084 --field-trial-handle=1856,i,10401165809981385728,645714553629917069,262144 --enable-features=msEdgeFluentOverlayScrollbar,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2CodeCache,msWebView2EnableDraggableRegions --disable-features=MojoIpcz,msWebOOUI /prefetch:3 /pfhostedapp:e7e952ed836442a682dca713cb7c4d91d21a087a", + "sourceProcessInfo_fileHashMd5": "0f259745-8e7a-c81b-049d-45ef5b291246", + "sourceProcessInfo_fileHashSha1": "bbd88a2a41c94d4140ccaef71bfb771e0ccc5c32", + "sourceProcessInfo_fileHashSha256": "0ce0ef234aba4bf60f1c48a058ce764d52e91078e95312de4db4b0911f4cc7d4", + "sourceProcessInfo_filePath": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.82\\msedgewebview2.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "msedgewebview2.exe", + "sourceProcessInfo_pid": 5728, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:37:27 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "ocsp.digicert.com", + "alertInfo_dnsResponse": "type: 5 ocsp.edge.digicert.com;type: 5 fp2e7a.wpc.2be4.phicdn.net;type: 5 fp2e7a.wpc.phicdn.net;64:ff9b::98c3:264c;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "B2B112F580778F51", + "sourceParentProcessInfo_uniqueId": "B1B112F580778F51", + "sourceProcessInfo_storyline": "B5B212F580778F51", + "sourceProcessInfo_uniqueId": "B4B212F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738722031821300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:11 AM", + "alertInfo_dvEventId": "01H65SG9CAMBQHFPH0TJD6EYXN_440", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:49 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:49 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "sihost.exe", + "sourceParentProcessInfo_fileHashMd5": "e5a23407-157b-23f3-c244-1d412163e4ee", + "sourceParentProcessInfo_fileHashSha1": "e8d9750e757e5b580c56521a81ed0cc41d327d82", + "sourceParentProcessInfo_fileHashSha256": "51eb6455bdca85d3102a00b1ce89969016efc3ed8b08b24a2aa10e03ba1e2b13", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\sihost.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "sihost.exe", + "sourceParentProcessInfo_pid": 13788, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:36:13 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\StartMenuExperienceHost.exe\" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca", + "sourceProcessInfo_fileHashMd5": "4bd84472-eca2-b69a-0391-f61fa50d0f31", + "sourceProcessInfo_fileHashSha1": "0ca4bcd60601ec0d8602d4f5994cb0393edb892b", + "sourceProcessInfo_fileHashSha256": "c1fc7f6cb2228ee6386d91f27f1a61ae60a63deefb21d78bb810b7f027f1a489", + "sourceProcessInfo_filePath": "C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\StartMenuExperienceHost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "low", + "sourceProcessInfo_name": "StartMenuExperienceHost.exe", + "sourceProcessInfo_pid": 4524, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:36:15 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "ctldl.windowsupdate.com", + "alertInfo_dnsResponse": "type: 5 wu-bg-shim.trafficmanager.net;type: 5 fg.download.windowsupdate.com.c.footprint.net;8.241.152.254;8.241.160.126;8.241.135.126;8.241.154.254;8.241.151.126;type: 2 usa-d.dns.footprint.net;type: 2 apac-a.dns.footprint.net;type: 2 eu-b.dns.footprint.net;", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "B83C0EF580778F51", + "sourceProcessInfo_uniqueId": "B73C0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738767942674200, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:14 AM", + "alertInfo_dvEventId": "01H65SGAGCE4JDGCGC1GCKNT9S_30", + "alertInfo_eventType": "DNS", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:55 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:55 AM", + "ruleInfo_id": 1733163280061426000, + "ruleInfo_name": "DNS", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"DNS Resolved\" OR EventType = \"DNS Unresolved", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k NetworkService -p", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 1576, + "sourceProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\NETWORK SERVICE", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + } +] \ No newline at end of file diff --git a/Sample Data/ASIM/SentinelOne_ASimFileEvent_IngestedLogs.csv b/Sample Data/ASIM/SentinelOne_ASimFileEvent_IngestedLogs.csv new file mode 100644 index 00000000000..bcbe681bc5d --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimFileEvent_IngestedLogs.csv @@ -0,0 +1,17 @@ +TenantId,SourceSystem,MG,ManagementGroupName,TimeGenerated,Computer,RawData,alertInfo_indicatorDescription_s,alertInfo_indicatorName_s,targetProcessInfo_tgtFileOldPath_s,alertInfo_indicatorCategory_s,alertInfo_registryOldValue_g,alertInfo_dstIp_s,alertInfo_dstPort_s,alertInfo_netEventDirection_s,alertInfo_srcIp_s,alertInfo_srcPort_s,containerInfo_id_s,targetProcessInfo_tgtFileId_g,alertInfo_registryOldValue_s,alertInfo_registryOldValueType_s,alertInfo_dnsRequest_s,alertInfo_dnsResponse_s,alertInfo_registryKeyPath_s,alertInfo_registryPath_s,alertInfo_registryValue_g,ruleInfo_description_s,alertInfo_registryValue_s,alertInfo_loginAccountDomain_s,alertInfo_loginAccountSid_s,alertInfo_loginIsAdministratorEquivalent_s,alertInfo_loginIsSuccessful_s,alertInfo_loginType_s,alertInfo_loginsUserName_s,alertInfo_srcMachineIp_s,targetProcessInfo_tgtProcCmdLine_s,targetProcessInfo_tgtProcImagePath_s,targetProcessInfo_tgtProcName_s,targetProcessInfo_tgtProcPid_s,targetProcessInfo_tgtProcSignedStatus_s,targetProcessInfo_tgtProcStorylineId_s,targetProcessInfo_tgtProcUid_s,sourceParentProcessInfo_storyline_g,sourceParentProcessInfo_uniqueId_g,sourceProcessInfo_storyline_g,sourceProcessInfo_uniqueId_g,targetProcessInfo_tgtProcStorylineId_g,targetProcessInfo_tgtProcUid_g,agentDetectionInfo_machineType_s,agentDetectionInfo_name_s,agentDetectionInfo_osFamily_s,agentDetectionInfo_osName_s,agentDetectionInfo_osRevision_s,agentDetectionInfo_uuid_g,agentDetectionInfo_version_s,agentRealtimeInfo_id_s,agentRealtimeInfo_infected_b,agentRealtimeInfo_isActive_b,agentRealtimeInfo_isDecommissioned_b,agentRealtimeInfo_machineType_s,agentRealtimeInfo_name_s,agentRealtimeInfo_os_s,agentRealtimeInfo_uuid_g,alertInfo_alertId_s,alertInfo_analystVerdict_s,alertInfo_createdAt_t,alertInfo_dvEventId_s,alertInfo_eventType_s,alertInfo_hitType_s,alertInfo_incidentStatus_s,alertInfo_isEdr_b,alertInfo_reportedAt_t,alertInfo_source_s,alertInfo_updatedAt_t,ruleInfo_id_s,ruleInfo_name_s,ruleInfo_queryLang_s,ruleInfo_queryType_s,ruleInfo_s1ql_s,ruleInfo_scopeLevel_s,ruleInfo_severity_s,ruleInfo_treatAsThreat_s,sourceParentProcessInfo_commandline_s,sourceParentProcessInfo_fileHashMd5_g,sourceParentProcessInfo_fileHashSha1_s,sourceParentProcessInfo_fileHashSha256_s,sourceParentProcessInfo_filePath_s,sourceParentProcessInfo_fileSignerIdentity_s,sourceParentProcessInfo_integrityLevel_s,sourceParentProcessInfo_name_s,sourceParentProcessInfo_pid_s,sourceParentProcessInfo_pidStarttime_t,sourceParentProcessInfo_storyline_s,sourceParentProcessInfo_subsystem_s,sourceParentProcessInfo_uniqueId_s,sourceParentProcessInfo_user_s,sourceProcessInfo_commandline_s,sourceProcessInfo_fileHashMd5_g,sourceProcessInfo_fileHashSha1_s,sourceProcessInfo_fileHashSha256_s,sourceProcessInfo_filePath_s,sourceProcessInfo_fileSignerIdentity_s,sourceProcessInfo_integrityLevel_s,sourceProcessInfo_name_s,sourceProcessInfo_pid_s,sourceProcessInfo_pidStarttime_t,sourceProcessInfo_storyline_s,sourceProcessInfo_subsystem_s,sourceProcessInfo_uniqueId_s,sourceProcessInfo_user_s,targetProcessInfo_tgtFileCreatedAt_t,targetProcessInfo_tgtFileHashSha1_s,targetProcessInfo_tgtFileHashSha256_s,targetProcessInfo_tgtFileId_s,targetProcessInfo_tgtFileIsSigned_s,targetProcessInfo_tgtFileModifiedAt_t,targetProcessInfo_tgtFilePath_s,targetProcessInfo_tgtProcIntegrityLevel_s,targetProcessInfo_tgtProcessStartTime_t,agentUpdatedVersion_s,agentId_s,hash_s,osFamily_s,threatId_s,creator_s,creatorId_s,inherits_b,isDefault_b,name_s,registrationToken_s,totalAgents_d,type_s,agentDetectionInfo_accountId_s,agentDetectionInfo_accountName_s,agentDetectionInfo_agentDetectionState_s,agentDetectionInfo_agentDomain_s,agentDetectionInfo_agentIpV4_s,agentDetectionInfo_agentIpV6_s,agentDetectionInfo_agentLastLoggedInUserName_s,agentDetectionInfo_agentMitigationMode_s,agentDetectionInfo_agentOsName_s,agentDetectionInfo_agentOsRevision_s,agentDetectionInfo_agentRegisteredAt_t,agentDetectionInfo_agentUuid_g,agentDetectionInfo_agentVersion_s,agentDetectionInfo_externalIp_s,agentDetectionInfo_groupId_s,agentDetectionInfo_groupName_s,agentDetectionInfo_siteId_s,agentDetectionInfo_siteName_s,agentRealtimeInfo_accountId_s,agentRealtimeInfo_accountName_s,agentRealtimeInfo_activeThreats_d,agentRealtimeInfo_agentComputerName_s,agentRealtimeInfo_agentDomain_s,agentRealtimeInfo_agentId_s,agentRealtimeInfo_agentInfected_b,agentRealtimeInfo_agentIsActive_b,agentRealtimeInfo_agentIsDecommissioned_b,agentRealtimeInfo_agentMachineType_s,agentRealtimeInfo_agentMitigationMode_s,agentRealtimeInfo_agentNetworkStatus_s,agentRealtimeInfo_agentOsName_s,agentRealtimeInfo_agentOsRevision_s,agentRealtimeInfo_agentOsType_s,agentRealtimeInfo_agentUuid_g,agentRealtimeInfo_agentVersion_s,agentRealtimeInfo_groupId_s,agentRealtimeInfo_groupName_s,agentRealtimeInfo_networkInterfaces_s,agentRealtimeInfo_operationalState_s,agentRealtimeInfo_rebootRequired_b,agentRealtimeInfo_scanFinishedAt_t,agentRealtimeInfo_scanStartedAt_t,agentRealtimeInfo_scanStatus_s,agentRealtimeInfo_siteId_s,agentRealtimeInfo_siteName_s,agentRealtimeInfo_userActionsNeeded_s,indicators_s,mitigationStatus_s,threatInfo_analystVerdict_s,threatInfo_analystVerdictDescription_s,threatInfo_automaticallyResolved_b,threatInfo_certificateId_s,threatInfo_classification_s,threatInfo_classificationSource_s,threatInfo_cloudFilesHashVerdict_s,threatInfo_collectionId_s,threatInfo_confidenceLevel_s,threatInfo_createdAt_t,threatInfo_detectionEngines_s,threatInfo_detectionType_s,threatInfo_engines_s,threatInfo_externalTicketExists_b,threatInfo_failedActions_b,threatInfo_fileExtension_s,threatInfo_fileExtensionType_s,threatInfo_filePath_s,threatInfo_fileSize_d,threatInfo_fileVerificationType_s,threatInfo_identifiedAt_t,threatInfo_incidentStatus_s,threatInfo_incidentStatusDescription_s,threatInfo_initiatedBy_s,threatInfo_initiatedByDescription_s,threatInfo_isFileless_b,threatInfo_isValidCertificate_b,threatInfo_mitigatedPreemptively_b,threatInfo_mitigationStatus_s,threatInfo_mitigationStatusDescription_s,threatInfo_originatorProcess_s,threatInfo_pendingActions_b,threatInfo_processUser_s,threatInfo_publisherName_s,threatInfo_reachedEventsLimit_b,threatInfo_rebootRequired_b,threatInfo_sha1_s,threatInfo_storyline_s,threatInfo_threatId_s,threatInfo_threatName_s,threatInfo_updatedAt_t,whiteningOptions_s,threatInfo_maliciousProcessArguments_s,threatInfo_fileExtension_g,threatInfo_threatName_g,threatInfo_storyline_g,accountId_s,accountName_s,activityType_d,activityUuid_g,createdAt_t,id_s,primaryDescription_s,secondaryDescription_s,siteId_s,siteName_s,updatedAt_t,userId_s,event_name_s,DataFields_s,description_s,comments_s,activeDirectory_computerMemberOf_s,activeDirectory_lastUserMemberOf_s,activeThreats_d,agentVersion_s,allowRemoteShell_b,appsVulnerabilityStatus_s,computerName_s,consoleMigrationStatus_s,coreCount_d,cpuCount_d,cpuId_s,detectionState_s,domain_s,encryptedApplications_b,externalId_s,externalIp_s,firewallEnabled_b,firstFullModeTime_t,fullDiskScanLastUpdatedAt_t,groupId_s,groupIp_s,groupName_s,inRemoteShellSession_b,infected_b,installerType_s,isActive_b,isDecommissioned_b,isPendingUninstall_b,isUninstalled_b,isUpToDate_b,lastActiveDate_t,lastIpToMgmt_s,lastLoggedInUserName_s,licenseKey_s,locationEnabled_b,locationType_s,locations_s,machineType_s,mitigationMode_s,mitigationModeSuspicious_s,modelName_s,networkInterfaces_s,networkQuarantineEnabled_b,networkStatus_s,operationalState_s,osArch_s,osName_s,osRevision_s,osStartTime_t,osType_s,rangerStatus_s,rangerVersion_s,registeredAt_t,remoteProfilingState_s,scanFinishedAt_t,scanStartedAt_t,scanStatus_s,serialNumber_s,showAlertIcon_b,tags_sentinelone_s,threatRebootRequired_b,totalMemory_d,userActionsNeeded_s,uuid_g,osUsername_s,scanAbortedAt_t,activeDirectory_computerDistinguishedName_s,activeDirectory_lastUserDistinguishedName_s,Type,_ResourceId +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 1:30:05.042 PM",,,,,/var/log/demisto/d1_Test2/d1.log,,,,,,,,,73a7707e-7bab-e79f-9c49-510c60321972,,,,,,,,,,,,,,,,,,,,,,,,727f2a7d-3997-199c-b5d9-e962c2389980,727f2a79-b96b-79ca-c3f2-3f8bf533b533,727f2ab1-dc50-82a1-cf98-4ad46daede5f,727f2ab1-681c-2167-fda1-df29915f20c9,,,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1713059693172741297,false,true,false,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1733340103401284845,Undefined,"7/20/2023, 1:17:11.900 PM",01H5SQ4NMCXWHAQ5FDZVZD1DZD_21,FILERENAME,Events,Unresolved,true,"7/20/2023, 1:17:22.275 PM",STAR,"7/20/2023, 1:17:22.275 PM",1733331490875496472,File Activity,1.0,events,"EventType = ""File Creation"" OR EventType = ""File Deletion"" OR EventType = ""File Modification"" OR EventType = ""File Rename"" OR EventType = ""File Scan""",account,Low,UNDEFINED, /usr/lib/systemd/systemd --switched-root --system --deserialize 22,,d00e622d514a3351de5cede74496dd50c65fbabb,,/usr/lib/systemd/systemd,,unknown,systemd,1,"7/18/2023, 8:55:41.180 AM",,unknown,,, /usr/local/demisto/d1_Test2/d1,,f69e54850b3774d38769e4c401496f88c003d3c8,,/usr/local/demisto/d1_Test2/d1,,unknown,d1,1137,"7/18/2023, 8:56:10.270 AM",,unknown,,,"7/20/2023, 12:55:20.831 PM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",/var/log/demisto/d1_Test2/d1-2023-07-20T13-16-51.917.log,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/27/2023, 6:50:07.211 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,DESKTOP-AB1CD,windows,Windows 11 Pro,22621,20ee9f81-027b-432f-b6c5-d549705f3419,23.1.2.400,1713023112770967412,true,true,false,laptop,DESKTOP-AB1CD,windows,20ee9f81-027b-432f-b6c5-d549705f3419,1738210213570412146,Undefined,"7/27/2023, 6:33:13.641 AM",01H6B0WXM7A30GV66B9RRTPAJK_413,FILEMODIFICATION,Events,Unresolved,true,"7/27/2023, 6:33:24.648 AM",STAR,"7/27/2023, 6:33:24.648 AM",1726010588144703192,Windows-KB2670838.msu.exe,1.0,events,"TgtFileSha1 = ""ccb7898c509c3a1de96d2010d638f6a719f6f400""",account,Critical,Malicious,C:\Windows\system32\userinit.exe,8592ae60-a986-7d35-cb19-8309a342ce1a,3eb1d07db5a6c7912db39ba92928f04db00cc5c1,3c8c6bf586dc8be65789b1186f27ba8ab26d61ccaf51f2ac6a23eaba5126b0bb,C:\Windows\System32\userinit.exe,MICROSOFT WINDOWS,medium,userinit.exe,8884,"7/27/2023, 5:59:32.132 AM",2DED9BC6A067F7A0,sys_win32,2CED9BC6A067F7A0,DESKTOP-AB1CD\Crest,C:\Windows\Explorer.EXE,5c780589-4b39-ba7a-aa9c-53d013ae92c2,b4f089ec1627b1333078df2bafb3b4e9c77dcf88,e89840322edaf4a7855ab296bc298add055c6d6910edc6c93ac866eb264e74a3,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,9032,"7/27/2023, 5:59:32.209 AM",30ED9BC6A067F7A0,sys_win32,2FED9BC6A067F7A0,DESKTOP-AB1CD\Crest,"7/27/2023, 6:34:19.435 AM",ccb7898c509c3a1de96d2010d638f6a719f6f400,f91f02fd27ada64f36f6df59a611fef106ff7734833dea825d0612e73bdfb621,72A59CC6A067F7A0,unsigned,"7/27/2023, 6:34:19.435 AM",C:\Users\Crest\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Windows-KB2670838.msu.exe,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/27/2023, 6:50:07.211 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,DESKTOP-AB1CD,windows,Windows 11 Pro,22621,20ee9f81-027b-432f-b6c5-d549705f3419,23.1.2.400,1713023112770967412,true,true,false,laptop,DESKTOP-AB1CD,windows,20ee9f81-027b-432f-b6c5-d549705f3419,1738210225264132788,Undefined,"7/27/2023, 6:33:13.649 AM",01H6B0WXM7A30GV66B9RRTPAJK_519,FILECREATION,Events,Unresolved,true,"7/27/2023, 6:33:26.041 AM",STAR,"7/27/2023, 6:33:26.041 AM",1725975030124192555,CrimsonRAT.exe,1.0,events,"TgtFileSha1 = ""ec0efbe8fd2fa5300164e9e4eded0d40da549c60""",account,Critical,Malicious,C:\Windows\system32\userinit.exe,8592ae60-a986-7d35-cb19-8309a342ce1a,3eb1d07db5a6c7912db39ba92928f04db00cc5c1,3c8c6bf586dc8be65789b1186f27ba8ab26d61ccaf51f2ac6a23eaba5126b0bb,C:\Windows\System32\userinit.exe,MICROSOFT WINDOWS,medium,userinit.exe,8884,"7/27/2023, 5:59:32.132 AM",2DED9BC6A067F7A0,sys_win32,2CED9BC6A067F7A0,DESKTOP-AB1CD\Crest,C:\Windows\Explorer.EXE,5c780589-4b39-ba7a-aa9c-53d013ae92c2,b4f089ec1627b1333078df2bafb3b4e9c77dcf88,e89840322edaf4a7855ab296bc298add055c6d6910edc6c93ac866eb264e74a3,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,9032,"7/27/2023, 5:59:32.209 AM",30ED9BC6A067F7A0,sys_win32,2FED9BC6A067F7A0,DESKTOP-AB1CD\Crest,"7/27/2023, 6:34:20.505 AM",ec0efbe8fd2fa5300164e9e4eded0d40da549c60,dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba,A9A59CC6A067F7A0,,"7/27/2023, 6:34:20.505 AM",C:\Users\Crest\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\CrimsonRAT.exe,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/27/2023, 6:50:07.211 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,DESKTOP-AB1CD,windows,Windows 11 Pro,22621,20ee9f81-027b-432f-b6c5-d549705f3419,23.1.2.400,1713023112770967412,true,true,false,laptop,DESKTOP-AB1CD,windows,20ee9f81-027b-432f-b6c5-d549705f3419,1738210244927031908,Undefined,"7/27/2023, 6:33:13.624 AM",01H6B0WXM7A30GV66B9RRTPAJK_67,FILECREATION,Events,Unresolved,true,"7/27/2023, 6:33:28.385 AM",STAR,"7/27/2023, 6:33:28.385 AM",1726067642318496051,Emotet.zip (,1.0,events,"TgtFileSha1 = ""acb5bc4b83a7d383c161917d2de137fd6358aabd""",account,Critical,Malicious,C:\Windows\system32\userinit.exe,8592ae60-a986-7d35-cb19-8309a342ce1a,3eb1d07db5a6c7912db39ba92928f04db00cc5c1,3c8c6bf586dc8be65789b1186f27ba8ab26d61ccaf51f2ac6a23eaba5126b0bb,C:\Windows\System32\userinit.exe,MICROSOFT WINDOWS,medium,userinit.exe,8884,"7/27/2023, 5:59:32.132 AM",2DED9BC6A067F7A0,sys_win32,2CED9BC6A067F7A0,DESKTOP-AB1CD\Crest,C:\Windows\Explorer.EXE,5c780589-4b39-ba7a-aa9c-53d013ae92c2,b4f089ec1627b1333078df2bafb3b4e9c77dcf88,e89840322edaf4a7855ab296bc298add055c6d6910edc6c93ac866eb264e74a3,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,9032,"7/27/2023, 5:59:32.209 AM",30ED9BC6A067F7A0,sys_win32,2FED9BC6A067F7A0,DESKTOP-AB1CD\Crest,"7/27/2023, 6:34:17.094 AM",acb5bc4b83a7d383c161917d2de137fd6358aabd,f62125428644746f081ca587ffa9449513dd786d793e83003c1f9607ca741c89,B3A49CC6A067F7A0,,"7/27/2023, 6:34:17.094 AM",Anonymized Data,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 10:10:03.752 AM",,,,,/run/NetworkManager/resolv.conf.tmp,,,,,,,,,7365cb43-e8a5-6056-ad37-b8eb60de75a2,,,,,,,,,,,,,,,,,,,,,,,,73c80b06-1061-e164-bdde-acf15170e205,73c80b04-5237-eb0f-0727-54a158641580,73c80b24-6ec0-90ed-1d5c-19bda9503b05,73c80b24-0395-912e-2db7-d931a51e0955,,,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1713059693172741297,false,true,false,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1733963468448059912,Undefined,"7/21/2023, 9:55:35.864 AM",01H5VY0D3160GH2Y9EJRN156NV_63,FILERENAME,Events,Unresolved,true,"7/21/2023, 9:55:53.178 AM",STAR,"7/21/2023, 9:55:53.178 AM",1733175396878455794,File Activity Test,1.0,events,"EventType = ""File Creation"" OR EventType = ""File Deletion"" OR EventType = ""File Modification"" OR EventType = ""File Rename"" OR EventType = ""File Scan""",site,Low,UNDEFINED, /usr/lib/systemd/systemd --switched-root --system --deserialize 22,,d00e622d514a3351de5cede74496dd50c65fbabb,,/usr/lib/systemd/systemd,,unknown,systemd,1,"7/21/2023, 6:39:14.230 AM",,unknown,,, /usr/sbin/NetworkManager --no-daemon,,1cfe129a867e17e356ddc6d5036d8f031669844d,,/usr/sbin/NetworkManager,,unknown,NetworkManager,764,"7/21/2023, 6:39:40.910 AM",,unknown,,,"7/21/2023, 9:55:15.954 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",/run/NetworkManager/resolv.conf,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 10:10:03.752 AM",,,,,/run/NetworkManager/resolv.conf.tmp,,,,,,,,,7365cb43-e8a5-6056-ad37-b8eb60de75a2,,,,,,,,,,,,,,,,,,,,,,,,73c80b06-1061-e164-bdde-acf15170e205,73c80b04-5237-eb0f-0727-54a158641580,73c80b24-6ec0-90ed-1d5c-19bda9503b05,73c80b24-0395-912e-2db7-d931a51e0955,,,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1713059693172741297,false,true,false,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1733963482071160962,Undefined,"7/21/2023, 9:55:35.865 AM",01H5VY0D3160GH2Y9EJRN156NV_63,FILERENAME,Events,Unresolved,true,"7/21/2023, 9:55:54.803 AM",STAR,"7/21/2023, 9:55:54.803 AM",1733331490875496472,File Activity,1.0,events,"EventType = ""File Creation"" OR EventType = ""File Deletion"" OR EventType = ""File Modification"" OR EventType = ""File Rename"" OR EventType = ""File Scan""",account,Low,UNDEFINED, /usr/lib/systemd/systemd --switched-root --system --deserialize 22,,d00e622d514a3351de5cede74496dd50c65fbabb,,/usr/lib/systemd/systemd,,unknown,systemd,1,"7/21/2023, 6:39:14.230 AM",,unknown,,, /usr/sbin/NetworkManager --no-daemon,,1cfe129a867e17e356ddc6d5036d8f031669844d,,/usr/sbin/NetworkManager,,unknown,NetworkManager,764,"7/21/2023, 6:39:40.910 AM",,unknown,,,"7/21/2023, 9:55:15.954 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",/run/NetworkManager/resolv.conf,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 6:00:15.610 AM",,,,,/var/lib/net-snmp/snmpd.conf,,,,,,,,,73bff444-0620-5aee-9e8c-0f5ea67bfefb,,,,,,,,,,,,,,,,,,,,,,,,727f2a7d-3997-199c-b5d9-e962c2389980,727f2a79-b96b-79ca-c3f2-3f8bf533b533,73bff5ea-3e85-27cf-caeb-92d05aaa3fe4,73bff73b-5235-2b64-bf6d-c204633f03e5,,,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1713059693172741297,false,true,false,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1733837854154317394,Undefined,"7/21/2023, 5:46:06.516 AM",01H5VFQJVC21222HX0VDG1D0KZ_57,FILERENAME,Events,Unresolved,true,"7/21/2023, 5:46:18.788 AM",STAR,"7/21/2023, 5:46:18.788 AM",1733331490875496472,File Activity,1.0,events,"EventType = ""File Creation"" OR EventType = ""File Deletion"" OR EventType = ""File Modification"" OR EventType = ""File Rename"" OR EventType = ""File Scan""",account,Low,UNDEFINED, /usr/lib/systemd/systemd --switched-root --system --deserialize 22,,d00e622d514a3351de5cede74496dd50c65fbabb,,/usr/lib/systemd/systemd,,unknown,systemd,1,"7/18/2023, 8:55:41.180 AM",,unknown,,, /usr/sbin/snmpd -LS0-6d -f,,f33063ea7de94571a4434561e1a25e98c5190513,,/usr/sbin/snmpd,,unknown,snmpd,59923,"7/21/2023, 5:45:09.970 AM",,unknown,,,"7/21/2023, 5:44:55.045 AM",,,,unsigned,"1/1/1970, 12:00:00.000 AM",/var/lib/net-snmp/snmpd.0.conf,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:30:04.449 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO07,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLO07,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736752240802854154,Undefined,"7/25/2023, 6:16:26.266 AM",01H65V20HBQGX37555XC4A34RQ_222,FILEMODIFICATION,Events,Unresolved,true,"7/25/2023, 6:16:40.750 AM",STAR,"7/25/2023, 6:16:40.750 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLO07""",account,Medium,UNDEFINED,"""C:\Windows\uus\AMD64\wuaucltcore.exe"" /DeploymentHandlerFullPath \\?\C:\Windows\UUS\AMD64\UpdateDeploy.dll /ClassId a6a6d102-c473-4702-bc7f-3e1e37137816 /RunHandlerComServer",2d56afae-0889-13ee-6eba-53cfc5b32f01,fd6f764c7308d5fd33afbc1d0fc44616976dc7ad,26626c962f11296b599166c0ba57ce0919909c316531425a542874838516392d,C:\Windows\UUS\amd64\wuaucltcore.exe,MICROSOFT WINDOWS,system,wuaucltcore.exe,8616,"7/25/2023, 6:15:48.228 AM",26D712F580778F51,sys_win32,25D712F580778F51,NT AUTHORITY\SYSTEM,"""C:\Windows\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exe""",dbacc2da-d34e-574b-da86-f4c54cd709a5,aa7e29ece94fbaacd94a7f34896b3f9671a18d18,6985f93749efde6ec7e228f87d0b14a4f61aecd04ba7889a5a25a2ae7244b775,C:\Windows\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exe,MICROSOFT WINDOWS PUBLISHER,system,UpdatePlatform.amd64fre.exe,15544,"7/25/2023, 6:15:48.825 AM",26D712F580778F51,sys_win32,28D712F580778F51,NT AUTHORITY\SYSTEM,"7/21/2185, 11:34:33.709 PM",a6fcade03347ac64bdefabe64e25cebdbefe3498,b48cd4860107c7b5ad8fa80cb78b67dfff63796e99a237c4405660f9235e4de6,5CD812F580778F51,,"7/21/2185, 11:34:33.709 PM",C:\Windows\SystemTemp\CDF02ABE-F59C-4A41-AC3F-F104625D635E\Powershell\MSFT_MpPerformanceRecording.psm1,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:30:04.449 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO07,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLO07,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736752270305590149,Undefined,"7/25/2023, 6:16:26.308 AM",01H65V20HBQGX37555XC4A34RQ_431,FILEMODIFICATION,Events,Unresolved,true,"7/25/2023, 6:16:44.267 AM",STAR,"7/25/2023, 6:16:44.267 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLO07""",account,Medium,UNDEFINED,"""C:\Windows\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exe""",dbacc2da-d34e-574b-da86-f4c54cd709a5,aa7e29ece94fbaacd94a7f34896b3f9671a18d18,6985f93749efde6ec7e228f87d0b14a4f61aecd04ba7889a5a25a2ae7244b775,C:\Windows\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exe,MICROSOFT WINDOWS PUBLISHER,system,UpdatePlatform.amd64fre.exe,15544,"7/25/2023, 6:15:48.825 AM",26D712F580778F51,sys_win32,28D712F580778F51,NT AUTHORITY\SYSTEM,C:\Windows\SystemTemp\CDF02ABE-F59C-4A41-AC3F-F104625D635E\MpSigStub.exe /stub 1.1.20300.1 /payload 4.18.23050.9 /program C:\Windows\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exe,d00d22fc-9d25-6ead-476f-0afd7e69ddae,a7e6f93498811cdfe189b3e036d864735fbf91e4,03410cb89092b20188e30aae345a92ab1efa4f21b5229e3b1a7c57b424e976f0,C:\Windows\SystemTemp\CDF02ABE-F59C-4A41-AC3F-F104625D635E\MpSigStub.exe,MICROSOFT CORPORATION,system,MpSigStub.exe,16296,"7/25/2023, 6:15:50.959 AM",26D712F580778F51,sys_win32,64D812F580778F51,NT AUTHORITY\SYSTEM,"7/21/2185, 11:34:33.709 PM",aec3290fd5e3bd7e2502cc845f18265f813eb870,159e76a4a4077222b3c201f07401f3f97b293738511e0fd97b2ce18536de461b,ABD912F580778F51,signed,"7/21/2185, 11:34:33.709 PM",C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23050.9-0\mpextms.exe,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:30:04.449 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO07,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLO07,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736752758036066424,Undefined,"7/25/2023, 6:17:24.096 AM",01H65V3V1DZ8YA39PZ5EWX1NJ3_41,FILEDELETION,Events,Unresolved,true,"7/25/2023, 6:17:42.409 AM",STAR,"7/25/2023, 6:17:42.409 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLO07""",account,Medium,UNDEFINED,"""C:\Windows\SystemTemp\mpam-db6b0d9f.exe"" /q WD",ffc35934-b31a-0d62-eeb0-8f8aa40b5982,1013c718063b124fb306b245c183ed094430d374,3a79ba90f0acef5f3fbfc0b654381eef938acbea0814ed1e375f9cdbccf63e78,C:\Windows\SystemTemp\mpam-db6b0d9f.exe,MICROSOFT CORPORATION,system,mpam-db6b0d9f.exe,16380,"7/25/2023, 6:16:33.761 AM",F83C0EF580778F51,sys_win32,65DA12F580778F51,NT AUTHORITY\SYSTEM,C:\Windows\SystemTemp\E0D919E5-665D-4048-8C24-3DEF4B640D1E\MpSigStub.exe /stub 1.1.23060.3001 /payload 1.393.1315.0 /program C:\Windows\SystemTemp\mpam-db6b0d9f.exe /q WD,8b6eac30-eab7-9e24-df5e-43d8bec9e243,5ce942034143949709b779de297bbb355102e050,dbb282f630dc503b55b37da93abc67212795beb046335f1166a935ce07b16086,C:\Windows\SystemTemp\E0D919E5-665D-4048-8C24-3DEF4B640D1E\MpSigStub.exe,MICROSOFT CORPORATION,system,MpSigStub.exe,12528,"7/25/2023, 6:16:34.479 AM",F83C0EF580778F51,sys_win32,6ADA12F580778F51,NT AUTHORITY\SYSTEM,"7/21/2185, 11:34:33.709 PM",acd087a51035cafe4a68181deede8ae260ea92ca,a8e1aeb9c2684628125c0aef8fdcbe4e6894c3842f59c4eeee7bb12e9e1fa944,CC4B0EF580778F51,,"7/21/2185, 11:34:33.709 PM",C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B7471214-A63A-4C99-B4C3-17663864BCB8}\mpengine.dll,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:30:04.449 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO07,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLO07,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736752762683355536,Undefined,"7/25/2023, 6:17:24.098 AM",01H65V3V1DZ8YA39PZ5EWX1NJ3_51,FILEDELETION,Events,Unresolved,true,"7/25/2023, 6:17:42.962 AM",STAR,"7/25/2023, 6:17:42.962 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLO07""",account,Medium,UNDEFINED,"""C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23050.5-0\MpCmdRun.exe"" SignatureUpdate -ScheduleJob -RestrictPrivileges",94e52781-2df3-b448-e18f-5cb7b38e0216,808c44d9accddd45b0c86ffe8acc533dda1c07ff,b370f2d32704cd1bdea8f1836f68a3af72cb9385eb8719dd84be9a6b3018d17a,C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23050.5-0\MpCmdRun.exe,MICROSOFT WINDOWS,system,MpCmdRun.exe,17220,"7/25/2023, 6:05:35.311 AM",F83C0EF580778F51,sys_win32,25D612F580778F51,NT AUTHORITY\SYSTEM,"""C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23050.9-0\MpCmdRun.exe"" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges",86dc797f-060f-9739-842e-13b668079be2,b95ff405a0dd527fd8ffa8916b26108692ac28da,a43bf3d7f0991a3aac1bc93e7f7ea49e21737b3915367b9d12a3d27702212704,C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23050.9-0\MpCmdRun.exe,MICROSOFT WINDOWS,system,MpCmdRun.exe,13172,"7/25/2023, 6:16:29.189 AM",F83C0EF580778F51,sys_win32,4ADA12F580778F51,NT AUTHORITY\SYSTEM,"7/25/2023, 6:16:29.323 AM",1013c718063b124fb306b245c183ed094430d374,3a79ba90f0acef5f3fbfc0b654381eef938acbea0814ed1e375f9cdbccf63e78,4CDA12F580778F51,signed,"7/25/2023, 6:16:29.323 AM",C:\Windows\SystemTemp\mpam-db6b0d9f.exe,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:30:04.449 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO07,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLO07,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736752765501927943,Undefined,"7/25/2023, 6:17:24.098 AM",01H65V3V1DZ8YA39PZ5EWX1NJ3_48,FILEDELETION,Events,Unresolved,true,"7/25/2023, 6:17:43.299 AM",STAR,"7/25/2023, 6:17:43.299 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLO07""",account,Medium,UNDEFINED,"""C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23050.9-0\MpCmdRun.exe"" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges",86dc797f-060f-9739-842e-13b668079be2,b95ff405a0dd527fd8ffa8916b26108692ac28da,a43bf3d7f0991a3aac1bc93e7f7ea49e21737b3915367b9d12a3d27702212704,C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23050.9-0\MpCmdRun.exe,MICROSOFT WINDOWS,system,MpCmdRun.exe,13172,"7/25/2023, 6:16:29.189 AM",F83C0EF580778F51,sys_win32,4ADA12F580778F51,NT AUTHORITY\SYSTEM,"""C:\Windows\SystemTemp\mpam-db6b0d9f.exe"" /q WD",ffc35934-b31a-0d62-eeb0-8f8aa40b5982,1013c718063b124fb306b245c183ed094430d374,3a79ba90f0acef5f3fbfc0b654381eef938acbea0814ed1e375f9cdbccf63e78,C:\Windows\SystemTemp\mpam-db6b0d9f.exe,MICROSOFT CORPORATION,system,mpam-db6b0d9f.exe,16380,"7/25/2023, 6:16:33.761 AM",F83C0EF580778F51,sys_win32,65DA12F580778F51,NT AUTHORITY\SYSTEM,"7/25/2023, 6:16:34.290 AM",5f1403aeba45dbc96d89c4dd16b2b02c1acd3b58,24e14fd2287f14dc27336fa4bb0edf77823f8a63979f76c1b754f1a958ed17d9,69DA12F580778F51,signed,"7/25/2023, 6:16:34.291 AM",C:\Windows\SystemTemp\E0D919E5-665D-4048-8C24-3DEF4B640D1E\mpavdlta.vdm,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/26/2023, 5:10:04.255 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO07,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,true,laptop,CLO07,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1737433999490006774,Undefined,"7/26/2023, 4:50:56.094 AM",01H688J6CXA4PKEDVB5RE122AT_35,FILEDELETION,Events,Unresolved,true,"7/26/2023, 4:51:12.719 AM",STAR,"7/26/2023, 4:51:12.719 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLO07""",account,Medium,UNDEFINED,Anonymized Data,c574c38d-9c6c-b239-6115-ee765103ccf9,1d136ade3825e5995863522a3893c7cd03576aa8,4c874b8ff8493be0f3fd9363fb7bb59e7b36ff6b98d37e9bb5c42158ed5f867b,C:\Program Files\LibreOffice\program\soffice.exe,THE DOCUMENT FOUNDATION,medium,soffice.exe,16528,"7/26/2023, 4:49:56.421 AM",840614F580778F51,sys_win32,830614F580778F51,CLO07\Crest,Anonymized Data,ad6bf6b4-a972-64fd-c147-e01208cef496,0d6bd79e1270fcca6d6281ae85c45641b98ac330,f32600df28791670ebc171516bce954c6a7dfb3068eb163cebf86f5137700c2c,C:\Program Files\LibreOffice\program\soffice.bin,THE DOCUMENT FOUNDATION,medium,soffice.bin,11392,"7/26/2023, 4:49:56.456 AM",860614F580778F51,sys_win32,850614F580778F51,CLO07\Crest,"7/26/2023, 4:49:57.276 AM",356a192b7913b04c54574d18c28d46e6395428ab,6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b,8A0614F580778F51,,"7/26/2023, 4:49:57.276 AM",C:\Users\Crest\AppData\Roaming\LibreOffice\4\user\extensions\tmp\stamp.sys,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/26/2023, 5:10:04.255 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO07,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,true,laptop,CLO07,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1737434458179132195,Undefined,"7/26/2023, 4:51:56.257 AM",01H688M11R9VGSZ6SCGEF72BC8_307,FILEMODIFICATION,Events,Unresolved,true,"7/26/2023, 4:52:07.399 AM",STAR,"7/26/2023, 4:52:07.399 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLO07""",account,Medium,UNDEFINED,C:\Windows\Explorer.EXE,357b678c-68d3-d5ee-86e1-b706fbfd994b,a4e4e2bc502e4ab249b219da357d1aad163ab175,8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,2184,"7/26/2023, 4:43:13.069 AM",20EC12F580778F51,sys_win32,1FEC12F580778F51,CLO07\Crest,"C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding",357b678c-68d3-d5ee-86e1-b706fbfd994b,a4e4e2bc502e4ab249b219da357d1aad163ab175,8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,3752,"7/26/2023, 4:51:18.156 AM",240814F580778F51,sys_win32,230814F580778F51,CLO07\Crest,"7/26/2023, 4:51:40.873 AM",e6b4c40c98eb9023ad522ef8664f6a8256c65a64,a36ba35cf5b5386e7c76e5b9673b999c7bf4e2a30e6408b85102aa61f3be4523,7A0814F580778F51,signed,"7/26/2023, 4:51:40.874 AM",C:\Windows\Installer\MSI62BC.tmp,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/26/2023, 5:10:04.255 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO07,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,true,laptop,CLO07,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1737436495713459493,Undefined,"7/26/2023, 4:55:56.747 AM",01H688VBDBEK7BMHE6RB25DPQ7_41,FILEMODIFICATION,Events,Unresolved,true,"7/26/2023, 4:56:10.292 AM",STAR,"7/26/2023, 4:56:10.292 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLO07""",account,Medium,UNDEFINED,"C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding",357b678c-68d3-d5ee-86e1-b706fbfd994b,a4e4e2bc502e4ab249b219da357d1aad163ab175,8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,3752,"7/26/2023, 4:51:18.156 AM",240814F580778F51,sys_win32,230814F580778F51,CLO07\Crest,C:\Windows\System32\MsiExec.exe -Embedding A970964D09FC76D0369C3F0735F8F6CB A,302be4b7-434e-6797-6902-9c8570825cc0,f3d7fee4ced78e37f49ce4e38ac681f07bca6ae0,5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1,C:\Windows\System32\msiexec.exe,MICROSOFT WINDOWS,high,msiexec.exe,1524,"7/26/2023, 4:54:54.008 AM",3F0C14F580778F51,sys_win32,3E0C14F580778F51,CLO07\Crest,"7/21/2185, 11:34:33.709 PM",b85d02ba0e8de4aeded1a2f5679505cd403bd201,f6fb39a8578f19616570d5a3dc7212c84a9da232b30a03376bbf08f4264fedf2,480C14F580778F51,signed,"7/21/2185, 11:34:33.709 PM",C:\Users\Crest\AppData\Local\Temp\sen617C.tmp,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/26/2023, 5:00:31.604 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO07,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,true,laptop,CLO07,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1737430320011352678,Undefined,"7/26/2023, 4:43:33.000 AM",01H6884MR8FZHK9TYD68PC12V2_59,FILEDELETION,Events,Unresolved,true,"7/26/2023, 4:43:54.090 AM",STAR,"7/26/2023, 4:43:54.090 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLO07""",account,Medium,UNDEFINED,"""C:\Program Files\WindowsApps\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\msteams.exe"" ms-teams:system-initiated",1626f236-c0dc-28d5-92a1-0a359ebe3460,0fc1714b93869441cba7d44368ec411bac434e68,8cca5e46f6e9dfe566795c4e76aae4d44de8885f43bed759ef6bcad2516ac285,C:\Program Files\WindowsApps\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\msteams.exe,MICROSOFT CORPORATION,medium,msteams.exe,12792,"7/25/2023, 5:42:29.630 AM",38BD12F580778F51,sys_win32,3EBD12F580778F51,CLO07\Crest,"""C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.82\msedgewebview2.exe"" --embedded-browser-webview=1 --webview-exe-name=msteams.exe --webview-exe-version=23119.303.2080.2726 --user-data-dir=""C:\Users\Crest\AppData\Local\Packages\MicrosoftTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView"" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=MojoIpcz,msWebOOUI --edge-webview-is-background --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msEdgeFluentOverlayScrollbar,msWebView2CodeCache,msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=12792.17304.14378710367050045082 /pfhostedapp:e7e952ed836442a682dca713cb7c4d91d21a087a",0f259745-8e7a-c81b-049d-45ef5b291246,bbd88a2a41c94d4140ccaef71bfb771e0ccc5c32,0ce0ef234aba4bf60f1c48a058ce764d52e91078e95312de4db4b0911f4cc7d4,C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.82\msedgewebview2.exe,MICROSOFT CORPORATION,medium,msedgewebview2.exe,3316,"7/25/2023, 5:42:30.143 AM",38BD12F580778F51,sys_win32,48BD12F580778F51,CLO07\Crest,"7/25/2023, 5:42:30.637 AM",,,81BD12F580778F51,,"7/25/2023, 5:43:42.536 AM",C:\Users\Crest\AppData\Local\Temp\48d577fd-6e2f-441b-af70-03ea7c1fe9b5.tmp,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, \ No newline at end of file diff --git a/Sample Data/ASIM/SentinelOne_ASimFileEvent_RawLogs.json b/Sample Data/ASIM/SentinelOne_ASimFileEvent_RawLogs.json new file mode 100644 index 00000000000..5fdf9bd38af --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimFileEvent_RawLogs.json @@ -0,0 +1,4834 @@ +[ + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/20/2023, 1:30:05.042 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "/var/log/demisto/d1_Test2/d1.log", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "0f81ec00-9e52-48e6-b899-eb3bbeede741", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733340103401284900, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/20/2023, 1:17:11.900 PM", + "alertInfo_dvEventId": "01H5SQ4NMCXWHAQ5FDZVZD1DZD_21", + "alertInfo_eventType": "FILERENAME", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/20/2023, 1:17:22.275 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/20/2023, 1:17:22.275 PM", + "ruleInfo_id": 1733331490875496400, + "ruleInfo_name": "File Activity", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"File Creation\" OR EventType = \"File Deletion\" OR EventType = \"File Modification\" OR EventType = \"File Rename\" OR EventType = \"File Scan", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/lib/systemd/systemd --switched-root --system --deserialize 22", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "d00e622d514a3351de5cede74496dd50c65fbabb", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/lib/systemd/systemd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "systemd", + "sourceParentProcessInfo_pid": 1, + "sourceParentProcessInfo_pidStarttime": "7/18/2023, 8:55:41.180 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/local/demisto/d1_Test2/d1", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f69e54850b3774d38769e4c401496f88c003d3c8", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/local/demisto/d1_Test2/d1", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "d1", + "sourceProcessInfo_pid": 1137, + "sourceProcessInfo_pidStarttime": "7/18/2023, 8:56:10.270 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "7/20/2023, 12:55:20.831 PM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "/var/log/demisto/d1_Test2/d1-2023-07-20T13-16-51.917.log", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/27/2023, 6:50:07.211 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "AC644457DCBAD901", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "72A59CC6A067F7A0", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "433C0EF580778F52", + "targetProcessInfo_tgtProcUid": "433C0EF580778F53", + "sourceParentProcessInfo_storyline": "2DED9BC6A067F7A0", + "sourceParentProcessInfo_uniqueId": "2CED9BC6A067F7A0", + "sourceProcessInfo_storyline": "30ED9BC6A067F7A0", + "sourceProcessInfo_uniqueId": "2FED9BC6A067F7A0", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "DESKTOP-AB1CD", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "20ee9f81-027b-432f-b6c5-d549705f3419", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1713023112770967300, + "agentRealtimeInfo_infected": true, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "DESKTOP-AB1CD", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "20ee9f81-027b-432f-b6c5-d549705f3419", + "alertInfo_alertId": 1738210213570412000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/27/2023, 6:33:13.641 AM", + "alertInfo_dvEventId": "01H6B0WXM7A30GV66B9RRTPAJK_413", + "alertInfo_eventType": "FILEMODIFICATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/27/2023, 6:33:24.648 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/27/2023, 6:33:24.648 AM", + "ruleInfo_id": 1726010588144703200, + "ruleInfo_name": "Windows-KB2670838.msu.exe", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "TgtFileSha1 = \"ccb7898c509c3a1de96d2010d638f6a719f6f400", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Critical", + "ruleInfo_treatAsThreat": "Malicious", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\userinit.exe", + "sourceParentProcessInfo_fileHashMd5": "8592ae60-a986-7d35-cb19-8309a342ce1a", + "sourceParentProcessInfo_fileHashSha1": "3eb1d07db5a6c7912db39ba92928f04db00cc5c1", + "sourceParentProcessInfo_fileHashSha256": "3c8c6bf586dc8be65789b1186f27ba8ab26d61ccaf51f2ac6a23eaba5126b0bb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\userinit.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "userinit.exe", + "sourceParentProcessInfo_pid": 8884, + "sourceParentProcessInfo_pidStarttime": "7/27/2023, 5:59:32.132 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "DESKTOP-AB1CD\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\Explorer.EXE", + "sourceProcessInfo_fileHashMd5": "5c780589-4b39-ba7a-aa9c-53d013ae92c2", + "sourceProcessInfo_fileHashSha1": "b4f089ec1627b1333078df2bafb3b4e9c77dcf88", + "sourceProcessInfo_fileHashSha256": "e89840322edaf4a7855ab296bc298add055c6d6910edc6c93ac866eb264e74a3", + "sourceProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "explorer.exe", + "sourceProcessInfo_pid": 9032, + "sourceProcessInfo_pidStarttime": "7/27/2023, 5:59:32.209 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "DESKTOP-AB1CD\\Crest", + "targetProcessInfo_tgtFileCreatedAt": "7/27/2023, 6:34:19.435 AM", + "targetProcessInfo_tgtFileHashSha1": "ccb7898c509c3a1de96d2010d638f6a719f6f400", + "targetProcessInfo_tgtFileHashSha256": "f91f02fd27ada64f36f6df59a611fef106ff7734833dea825d0612e73bdfb621", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "7/27/2023, 6:34:19.435 AM", + "targetProcessInfo_tgtFilePath": "C:\\Users\\Crest\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Joke\\Windows-KB2670838.msu.exe", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/27/2023, 6:50:07.211 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "A9A59CC6A067F7A0", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "2DED9BC6A067F7A0", + "sourceParentProcessInfo_uniqueId": "2CED9BC6A067F7A0", + "sourceProcessInfo_storyline": "30ED9BC6A067F7A0", + "sourceProcessInfo_uniqueId": "2FED9BC6A067F7A0", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "DESKTOP-AB1CD", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "20ee9f81-027b-432f-b6c5-d549705f3419", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1713023112770967300, + "agentRealtimeInfo_infected": true, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "DESKTOP-AB1CD", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "20ee9f81-027b-432f-b6c5-d549705f3419", + "alertInfo_alertId": 1738210225264132900, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/27/2023, 6:33:13.649 AM", + "alertInfo_dvEventId": "01H6B0WXM7A30GV66B9RRTPAJK_519", + "alertInfo_eventType": "FILECREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/27/2023, 6:33:26.041 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/27/2023, 6:33:26.041 AM", + "ruleInfo_id": 1725975030124192500, + "ruleInfo_name": "CrimsonRAT.exe", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "TgtFileSha1 = \"ec0efbe8fd2fa5300164e9e4eded0d40da549c60", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Critical", + "ruleInfo_treatAsThreat": "Malicious", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\userinit.exe", + "sourceParentProcessInfo_fileHashMd5": "8592ae60-a986-7d35-cb19-8309a342ce1a", + "sourceParentProcessInfo_fileHashSha1": "3eb1d07db5a6c7912db39ba92928f04db00cc5c1", + "sourceParentProcessInfo_fileHashSha256": "3c8c6bf586dc8be65789b1186f27ba8ab26d61ccaf51f2ac6a23eaba5126b0bb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\userinit.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "userinit.exe", + "sourceParentProcessInfo_pid": 8884, + "sourceParentProcessInfo_pidStarttime": "7/27/2023, 5:59:32.132 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "DESKTOP-AB1CD\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\Explorer.EXE", + "sourceProcessInfo_fileHashMd5": "5c780589-4b39-ba7a-aa9c-53d013ae92c2", + "sourceProcessInfo_fileHashSha1": "b4f089ec1627b1333078df2bafb3b4e9c77dcf88", + "sourceProcessInfo_fileHashSha256": "e89840322edaf4a7855ab296bc298add055c6d6910edc6c93ac866eb264e74a3", + "sourceProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "explorer.exe", + "sourceProcessInfo_pid": 9032, + "sourceProcessInfo_pidStarttime": "7/27/2023, 5:59:32.209 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "DESKTOP-AB1CD\\Crest", + "targetProcessInfo_tgtFileCreatedAt": "7/27/2023, 6:34:20.505 AM", + "targetProcessInfo_tgtFileHashSha1": "ec0efbe8fd2fa5300164e9e4eded0d40da549c60", + "targetProcessInfo_tgtFileHashSha256": "dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt": "7/27/2023, 6:34:20.505 AM", + "targetProcessInfo_tgtFilePath": "C:\\Users\\Crest\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\RAT\\CrimsonRAT.exe", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/27/2023, 6:50:07.211 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "B3A49CC6A067F7A0", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "2DED9BC6A067F7A0", + "sourceParentProcessInfo_uniqueId": "2CED9BC6A067F7A0", + "sourceProcessInfo_storyline": "30ED9BC6A067F7A0", + "sourceProcessInfo_uniqueId": "2FED9BC6A067F7A0", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "DESKTOP-AB1CD", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "20ee9f81-027b-432f-b6c5-d549705f3419", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1713023112770967300, + "agentRealtimeInfo_infected": true, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "DESKTOP-AB1CD", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "20ee9f81-027b-432f-b6c5-d549705f3419", + "alertInfo_alertId": 1738210244927031800, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/27/2023, 6:33:13.624 AM", + "alertInfo_dvEventId": "01H6B0WXM7A30GV66B9RRTPAJK_67", + "alertInfo_eventType": "FILECREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/27/2023, 6:33:28.385 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/27/2023, 6:33:28.385 AM", + "ruleInfo_id": 1726067642318496000, + "ruleInfo_name": "Emotet.zip (", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "TgtFileSha1 = \"acb5bc4b83a7d383c161917d2de137fd6358aabd", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Critical", + "ruleInfo_treatAsThreat": "Malicious", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\userinit.exe", + "sourceParentProcessInfo_fileHashMd5": "8592ae60-a986-7d35-cb19-8309a342ce1a", + "sourceParentProcessInfo_fileHashSha1": "3eb1d07db5a6c7912db39ba92928f04db00cc5c1", + "sourceParentProcessInfo_fileHashSha256": "3c8c6bf586dc8be65789b1186f27ba8ab26d61ccaf51f2ac6a23eaba5126b0bb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\userinit.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "userinit.exe", + "sourceParentProcessInfo_pid": 8884, + "sourceParentProcessInfo_pidStarttime": "7/27/2023, 5:59:32.132 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "DESKTOP-AB1CD\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\Explorer.EXE", + "sourceProcessInfo_fileHashMd5": "5c780589-4b39-ba7a-aa9c-53d013ae92c2", + "sourceProcessInfo_fileHashSha1": "b4f089ec1627b1333078df2bafb3b4e9c77dcf88", + "sourceProcessInfo_fileHashSha256": "e89840322edaf4a7855ab296bc298add055c6d6910edc6c93ac866eb264e74a3", + "sourceProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "explorer.exe", + "sourceProcessInfo_pid": 9032, + "sourceProcessInfo_pidStarttime": "7/27/2023, 5:59:32.209 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "DESKTOP-AB1CD\\Crest", + "targetProcessInfo_tgtFileCreatedAt": "7/27/2023, 6:34:17.094 AM", + "targetProcessInfo_tgtFileHashSha1": "acb5bc4b83a7d383c161917d2de137fd6358aabd", + "targetProcessInfo_tgtFileHashSha256": "f62125428644746f081ca587ffa9449513dd786d793e83003c1f9607ca741c89", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt": "7/27/2023, 6:34:17.094 AM", + "targetProcessInfo_tgtFilePath": "Anonymized Data", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 10:10:03.752 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "/run/NetworkManager/resolv.conf.tmp", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733963468448060000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 9:55:35.864 AM", + "alertInfo_dvEventId": "01H5VY0D3160GH2Y9EJRN156NV_63", + "alertInfo_eventType": "FILERENAME", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 9:55:53.178 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 9:55:53.178 AM", + "ruleInfo_id": 1733175396878455800, + "ruleInfo_name": "File Activity Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"File Creation\" OR EventType = \"File Deletion\" OR EventType = \"File Modification\" OR EventType = \"File Rename\" OR EventType = \"File Scan", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/lib/systemd/systemd --switched-root --system --deserialize 22", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "d00e622d514a3351de5cede74496dd50c65fbabb", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/lib/systemd/systemd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "systemd", + "sourceParentProcessInfo_pid": 1, + "sourceParentProcessInfo_pidStarttime": "7/21/2023, 6:39:14.230 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/NetworkManager --no-daemon", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "1cfe129a867e17e356ddc6d5036d8f031669844d", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/NetworkManager", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "NetworkManager", + "sourceProcessInfo_pid": 764, + "sourceProcessInfo_pidStarttime": "7/21/2023, 6:39:40.910 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "7/21/2023, 9:55:15.954 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "/run/NetworkManager/resolv.conf", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 10:10:03.752 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "/run/NetworkManager/resolv.conf.tmp", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733963482071161000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 9:55:35.865 AM", + "alertInfo_dvEventId": "01H5VY0D3160GH2Y9EJRN156NV_63", + "alertInfo_eventType": "FILERENAME", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 9:55:54.803 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 9:55:54.803 AM", + "ruleInfo_id": 1733331490875496400, + "ruleInfo_name": "File Activity", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"File Creation\" OR EventType = \"File Deletion\" OR EventType = \"File Modification\" OR EventType = \"File Rename\" OR EventType = \"File Scan", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/lib/systemd/systemd --switched-root --system --deserialize 22", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "d00e622d514a3351de5cede74496dd50c65fbabb", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/lib/systemd/systemd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "systemd", + "sourceParentProcessInfo_pid": 1, + "sourceParentProcessInfo_pidStarttime": "7/21/2023, 6:39:14.230 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/NetworkManager --no-daemon", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "1cfe129a867e17e356ddc6d5036d8f031669844d", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/NetworkManager", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "NetworkManager", + "sourceProcessInfo_pid": 764, + "sourceProcessInfo_pidStarttime": "7/21/2023, 6:39:40.910 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "7/21/2023, 9:55:15.954 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "/run/NetworkManager/resolv.conf", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 6:00:15.610 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "/var/lib/net-snmp/snmpd.conf", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733837854154317300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 5:46:06.516 AM", + "alertInfo_dvEventId": "01H5VFQJVC21222HX0VDG1D0KZ_57", + "alertInfo_eventType": "FILERENAME", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 5:46:18.788 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 5:46:18.788 AM", + "ruleInfo_id": 1733331490875496400, + "ruleInfo_name": "File Activity", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"File Creation\" OR EventType = \"File Deletion\" OR EventType = \"File Modification\" OR EventType = \"File Rename\" OR EventType = \"File Scan", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/lib/systemd/systemd --switched-root --system --deserialize 22", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "d00e622d514a3351de5cede74496dd50c65fbabb", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/lib/systemd/systemd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "systemd", + "sourceParentProcessInfo_pid": 1, + "sourceParentProcessInfo_pidStarttime": "7/18/2023, 8:55:41.180 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/snmpd -LS0-6d -f", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "f33063ea7de94571a4434561e1a25e98c5190513", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/snmpd", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "snmpd", + "sourceProcessInfo_pid": 59923, + "sourceProcessInfo_pidStarttime": "7/21/2023, 5:45:09.970 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt": "7/21/2023, 5:44:55.045 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "/var/lib/net-snmp/snmpd.0.conf", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 6:30:04.449 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "5CD812F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "26D712F580778F51", + "sourceParentProcessInfo_uniqueId": "25D712F580778F51", + "sourceProcessInfo_storyline": "26D712F580778F51", + "sourceProcessInfo_uniqueId": "28D712F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO07", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO07", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736752240802854100, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 6:16:26.266 AM", + "alertInfo_dvEventId": "01H65V20HBQGX37555XC4A34RQ_222", + "alertInfo_eventType": "FILEMODIFICATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 6:16:40.750 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 6:16:40.750 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO07", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\uus\\AMD64\\wuaucltcore.exe\" /DeploymentHandlerFullPath \\\\?\\C:\\Windows\\UUS\\AMD64\\UpdateDeploy.dll /ClassId a6a6d102-c473-4702-bc7f-3e1e37137816 /RunHandlerComServer", + "sourceParentProcessInfo_fileHashMd5": "2d56afae-0889-13ee-6eba-53cfc5b32f01", + "sourceParentProcessInfo_fileHashSha1": "fd6f764c7308d5fd33afbc1d0fc44616976dc7ad", + "sourceParentProcessInfo_fileHashSha256": "26626c962f11296b599166c0ba57ce0919909c316531425a542874838516392d", + "sourceParentProcessInfo_filePath": "C:\\Windows\\UUS\\amd64\\wuaucltcore.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "wuaucltcore.exe", + "sourceParentProcessInfo_pid": 8616, + "sourceParentProcessInfo_pidStarttime": "7/25/2023, 6:15:48.228 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\SoftwareDistribution\\Download\\Install\\UpdatePlatform.amd64fre.exe", + "sourceProcessInfo_fileHashMd5": "dbacc2da-d34e-574b-da86-f4c54cd709a5", + "sourceProcessInfo_fileHashSha1": "aa7e29ece94fbaacd94a7f34896b3f9671a18d18", + "sourceProcessInfo_fileHashSha256": "6985f93749efde6ec7e228f87d0b14a4f61aecd04ba7889a5a25a2ae7244b775", + "sourceProcessInfo_filePath": "C:\\Windows\\SoftwareDistribution\\Download\\Install\\UpdatePlatform.amd64fre.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "UpdatePlatform.amd64fre.exe", + "sourceProcessInfo_pid": 15544, + "sourceProcessInfo_pidStarttime": "7/25/2023, 6:15:48.825 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "7/21/2185, 11:34:33.709 PM", + "targetProcessInfo_tgtFileHashSha1": "a6fcade03347ac64bdefabe64e25cebdbefe3498", + "targetProcessInfo_tgtFileHashSha256": "b48cd4860107c7b5ad8fa80cb78b67dfff63796e99a237c4405660f9235e4de6", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt": "7/21/2185, 11:34:33.709 PM", + "targetProcessInfo_tgtFilePath": "C:\\Windows\\SystemTemp\\CDF02ABE-F59C-4A41-AC3F-F104625D635E\\Powershell\\MSFT_MpPerformanceRecording.psm1", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 6:30:04.449 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "ABD912F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "26D712F580778F51", + "sourceParentProcessInfo_uniqueId": "28D712F580778F51", + "sourceProcessInfo_storyline": "26D712F580778F51", + "sourceProcessInfo_uniqueId": "64D812F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO07", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO07", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736752270305590300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 6:16:26.308 AM", + "alertInfo_dvEventId": "01H65V20HBQGX37555XC4A34RQ_431", + "alertInfo_eventType": "FILEMODIFICATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 6:16:44.267 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 6:16:44.267 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO07", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\SoftwareDistribution\\Download\\Install\\UpdatePlatform.amd64fre.exe", + "sourceParentProcessInfo_fileHashMd5": "dbacc2da-d34e-574b-da86-f4c54cd709a5", + "sourceParentProcessInfo_fileHashSha1": "aa7e29ece94fbaacd94a7f34896b3f9671a18d18", + "sourceParentProcessInfo_fileHashSha256": "6985f93749efde6ec7e228f87d0b14a4f61aecd04ba7889a5a25a2ae7244b775", + "sourceParentProcessInfo_filePath": "C:\\Windows\\SoftwareDistribution\\Download\\Install\\UpdatePlatform.amd64fre.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "UpdatePlatform.amd64fre.exe", + "sourceParentProcessInfo_pid": 15544, + "sourceParentProcessInfo_pidStarttime": "7/25/2023, 6:15:48.825 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\SystemTemp\\CDF02ABE-F59C-4A41-AC3F-F104625D635E\\MpSigStub.exe /stub 1.1.20300.1 /payload 4.18.23050.9 /program C:\\Windows\\SoftwareDistribution\\Download\\Install\\UpdatePlatform.amd64fre.exe", + "sourceProcessInfo_fileHashMd5": "d00d22fc-9d25-6ead-476f-0afd7e69ddae", + "sourceProcessInfo_fileHashSha1": "a7e6f93498811cdfe189b3e036d864735fbf91e4", + "sourceProcessInfo_fileHashSha256": "03410cb89092b20188e30aae345a92ab1efa4f21b5229e3b1a7c57b424e976f0", + "sourceProcessInfo_filePath": "C:\\Windows\\SystemTemp\\CDF02ABE-F59C-4A41-AC3F-F104625D635E\\MpSigStub.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "MpSigStub.exe", + "sourceProcessInfo_pid": 16296, + "sourceProcessInfo_pidStarttime": "7/25/2023, 6:15:50.959 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "7/21/2185, 11:34:33.709 PM", + "targetProcessInfo_tgtFileHashSha1": "aec3290fd5e3bd7e2502cc845f18265f813eb870", + "targetProcessInfo_tgtFileHashSha256": "159e76a4a4077222b3c201f07401f3f97b293738511e0fd97b2ce18536de461b", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "7/21/2185, 11:34:33.709 PM", + "targetProcessInfo_tgtFilePath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.23050.9-0\\mpextms.exe", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 6:30:04.449 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "CC4B0EF580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "F83C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "65DA12F580778F51", + "sourceProcessInfo_storyline": "F83C0EF580778F51", + "sourceProcessInfo_uniqueId": "6ADA12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO07", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO07", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736752758036066300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 6:17:24.096 AM", + "alertInfo_dvEventId": "01H65V3V1DZ8YA39PZ5EWX1NJ3_41", + "alertInfo_eventType": "FILEDELETION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 6:17:42.409 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 6:17:42.409 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO07", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\SystemTemp\\mpam-db6b0d9f.exe\" /q WD", + "sourceParentProcessInfo_fileHashMd5": "ffc35934-b31a-0d62-eeb0-8f8aa40b5982", + "sourceParentProcessInfo_fileHashSha1": "1013c718063b124fb306b245c183ed094430d374", + "sourceParentProcessInfo_fileHashSha256": "3a79ba90f0acef5f3fbfc0b654381eef938acbea0814ed1e375f9cdbccf63e78", + "sourceParentProcessInfo_filePath": "C:\\Windows\\SystemTemp\\mpam-db6b0d9f.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "mpam-db6b0d9f.exe", + "sourceParentProcessInfo_pid": 16380, + "sourceParentProcessInfo_pidStarttime": "7/25/2023, 6:16:33.761 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\SystemTemp\\E0D919E5-665D-4048-8C24-3DEF4B640D1E\\MpSigStub.exe /stub 1.1.23060.3001 /payload 1.393.1315.0 /program C:\\Windows\\SystemTemp\\mpam-db6b0d9f.exe /q WD", + "sourceProcessInfo_fileHashMd5": "8b6eac30-eab7-9e24-df5e-43d8bec9e243", + "sourceProcessInfo_fileHashSha1": "5ce942034143949709b779de297bbb355102e050", + "sourceProcessInfo_fileHashSha256": "dbb282f630dc503b55b37da93abc67212795beb046335f1166a935ce07b16086", + "sourceProcessInfo_filePath": "C:\\Windows\\SystemTemp\\E0D919E5-665D-4048-8C24-3DEF4B640D1E\\MpSigStub.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "MpSigStub.exe", + "sourceProcessInfo_pid": 12528, + "sourceProcessInfo_pidStarttime": "7/25/2023, 6:16:34.479 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "7/21/2185, 11:34:33.709 PM", + "targetProcessInfo_tgtFileHashSha1": "acd087a51035cafe4a68181deede8ae260ea92ca", + "targetProcessInfo_tgtFileHashSha256": "a8e1aeb9c2684628125c0aef8fdcbe4e6894c3842f59c4eeee7bb12e9e1fa944", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt": "7/21/2185, 11:34:33.709 PM", + "targetProcessInfo_tgtFilePath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{B7471214-A63A-4C99-B4C3-17663864BCB8}\\mpengine.dll", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 6:30:04.449 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "4CDA12F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "F83C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "25D612F580778F51", + "sourceProcessInfo_storyline": "F83C0EF580778F51", + "sourceProcessInfo_uniqueId": "4ADA12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO07", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO07", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736752762683355600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 6:17:24.098 AM", + "alertInfo_dvEventId": "01H65V3V1DZ8YA39PZ5EWX1NJ3_51", + "alertInfo_eventType": "FILEDELETION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 6:17:42.962 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 6:17:42.962 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO07", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.23050.5-0\\MpCmdRun.exe\" SignatureUpdate -ScheduleJob -RestrictPrivileges", + "sourceParentProcessInfo_fileHashMd5": "94e52781-2df3-b448-e18f-5cb7b38e0216", + "sourceParentProcessInfo_fileHashSha1": "808c44d9accddd45b0c86ffe8acc533dda1c07ff", + "sourceParentProcessInfo_fileHashSha256": "b370f2d32704cd1bdea8f1836f68a3af72cb9385eb8719dd84be9a6b3018d17a", + "sourceParentProcessInfo_filePath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.23050.5-0\\MpCmdRun.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "MpCmdRun.exe", + "sourceParentProcessInfo_pid": 17220, + "sourceParentProcessInfo_pidStarttime": "7/25/2023, 6:05:35.311 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.23050.9-0\\MpCmdRun.exe\" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges", + "sourceProcessInfo_fileHashMd5": "86dc797f-060f-9739-842e-13b668079be2", + "sourceProcessInfo_fileHashSha1": "b95ff405a0dd527fd8ffa8916b26108692ac28da", + "sourceProcessInfo_fileHashSha256": "a43bf3d7f0991a3aac1bc93e7f7ea49e21737b3915367b9d12a3d27702212704", + "sourceProcessInfo_filePath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.23050.9-0\\MpCmdRun.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "MpCmdRun.exe", + "sourceProcessInfo_pid": 13172, + "sourceProcessInfo_pidStarttime": "7/25/2023, 6:16:29.189 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "7/25/2023, 6:16:29.323 AM", + "targetProcessInfo_tgtFileHashSha1": "1013c718063b124fb306b245c183ed094430d374", + "targetProcessInfo_tgtFileHashSha256": "3a79ba90f0acef5f3fbfc0b654381eef938acbea0814ed1e375f9cdbccf63e78", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "7/25/2023, 6:16:29.323 AM", + "targetProcessInfo_tgtFilePath": "C:\\Windows\\SystemTemp\\mpam-db6b0d9f.exe", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 6:30:04.449 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "69DA12F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "F83C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "4ADA12F580778F51", + "sourceProcessInfo_storyline": "F83C0EF580778F51", + "sourceProcessInfo_uniqueId": "65DA12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO07", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO07", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736752765501928000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 6:17:24.098 AM", + "alertInfo_dvEventId": "01H65V3V1DZ8YA39PZ5EWX1NJ3_48", + "alertInfo_eventType": "FILEDELETION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 6:17:43.299 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 6:17:43.299 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO07", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.23050.9-0\\MpCmdRun.exe\" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges", + "sourceParentProcessInfo_fileHashMd5": "86dc797f-060f-9739-842e-13b668079be2", + "sourceParentProcessInfo_fileHashSha1": "b95ff405a0dd527fd8ffa8916b26108692ac28da", + "sourceParentProcessInfo_fileHashSha256": "a43bf3d7f0991a3aac1bc93e7f7ea49e21737b3915367b9d12a3d27702212704", + "sourceParentProcessInfo_filePath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.23050.9-0\\MpCmdRun.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "MpCmdRun.exe", + "sourceParentProcessInfo_pid": 13172, + "sourceParentProcessInfo_pidStarttime": "7/25/2023, 6:16:29.189 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\SystemTemp\\mpam-db6b0d9f.exe\" /q WD", + "sourceProcessInfo_fileHashMd5": "ffc35934-b31a-0d62-eeb0-8f8aa40b5982", + "sourceProcessInfo_fileHashSha1": "1013c718063b124fb306b245c183ed094430d374", + "sourceProcessInfo_fileHashSha256": "3a79ba90f0acef5f3fbfc0b654381eef938acbea0814ed1e375f9cdbccf63e78", + "sourceProcessInfo_filePath": "C:\\Windows\\SystemTemp\\mpam-db6b0d9f.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "mpam-db6b0d9f.exe", + "sourceProcessInfo_pid": 16380, + "sourceProcessInfo_pidStarttime": "7/25/2023, 6:16:33.761 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "7/25/2023, 6:16:34.290 AM", + "targetProcessInfo_tgtFileHashSha1": "5f1403aeba45dbc96d89c4dd16b2b02c1acd3b58", + "targetProcessInfo_tgtFileHashSha256": "24e14fd2287f14dc27336fa4bb0edf77823f8a63979f76c1b754f1a958ed17d9", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "7/25/2023, 6:16:34.291 AM", + "targetProcessInfo_tgtFilePath": "C:\\Windows\\SystemTemp\\E0D919E5-665D-4048-8C24-3DEF4B640D1E\\mpavdlta.vdm", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/26/2023, 5:10:04.255 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "8A0614F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "840614F580778F51", + "sourceParentProcessInfo_uniqueId": "830614F580778F51", + "sourceProcessInfo_storyline": "860614F580778F51", + "sourceProcessInfo_uniqueId": "850614F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO07", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": true, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO07", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1737433999490006800, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/26/2023, 4:50:56.094 AM", + "alertInfo_dvEventId": "01H688J6CXA4PKEDVB5RE122AT_35", + "alertInfo_eventType": "FILEDELETION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/26/2023, 4:51:12.719 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/26/2023, 4:51:12.719 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO07", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "Anonymized Data", + "sourceParentProcessInfo_fileHashMd5": "c574c38d-9c6c-b239-6115-ee765103ccf9", + "sourceParentProcessInfo_fileHashSha1": "1d136ade3825e5995863522a3893c7cd03576aa8", + "sourceParentProcessInfo_fileHashSha256": "4c874b8ff8493be0f3fd9363fb7bb59e7b36ff6b98d37e9bb5c42158ed5f867b", + "sourceParentProcessInfo_filePath": "C:\\Program Files\\LibreOffice\\program\\soffice.exe", + "sourceParentProcessInfo_fileSignerIdentity": "THE DOCUMENT FOUNDATION", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "soffice.exe", + "sourceParentProcessInfo_pid": 16528, + "sourceParentProcessInfo_pidStarttime": "7/26/2023, 4:49:56.421 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO07\\Crest", + "sourceProcessInfo_commandline": "Anonymized Data", + "sourceProcessInfo_fileHashMd5": "ad6bf6b4-a972-64fd-c147-e01208cef496", + "sourceProcessInfo_fileHashSha1": "0d6bd79e1270fcca6d6281ae85c45641b98ac330", + "sourceProcessInfo_fileHashSha256": "f32600df28791670ebc171516bce954c6a7dfb3068eb163cebf86f5137700c2c", + "sourceProcessInfo_filePath": "C:\\Program Files\\LibreOffice\\program\\soffice.bin", + "sourceProcessInfo_fileSignerIdentity": "THE DOCUMENT FOUNDATION", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "soffice.bin", + "sourceProcessInfo_pid": 11392, + "sourceProcessInfo_pidStarttime": "7/26/2023, 4:49:56.456 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO07\\Crest", + "targetProcessInfo_tgtFileCreatedAt": "7/26/2023, 4:49:57.276 AM", + "targetProcessInfo_tgtFileHashSha1": "356a192b7913b04c54574d18c28d46e6395428ab", + "targetProcessInfo_tgtFileHashSha256": "6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt": "7/26/2023, 4:49:57.276 AM", + "targetProcessInfo_tgtFilePath": "C:\\Users\\Crest\\AppData\\Roaming\\LibreOffice\\4\\user\\extensions\\tmp\\stamp.sys", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/26/2023, 5:10:04.255 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "7A0814F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "20EC12F580778F51", + "sourceParentProcessInfo_uniqueId": "1FEC12F580778F51", + "sourceProcessInfo_storyline": "240814F580778F51", + "sourceProcessInfo_uniqueId": "230814F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO07", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": true, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO07", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1737434458179132200, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/26/2023, 4:51:56.257 AM", + "alertInfo_dvEventId": "01H688M11R9VGSZ6SCGEF72BC8_307", + "alertInfo_eventType": "FILEMODIFICATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/26/2023, 4:52:07.399 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/26/2023, 4:52:07.399 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO07", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\Explorer.EXE", + "sourceParentProcessInfo_fileHashMd5": "357b678c-68d3-d5ee-86e1-b706fbfd994b", + "sourceParentProcessInfo_fileHashSha1": "a4e4e2bc502e4ab249b219da357d1aad163ab175", + "sourceParentProcessInfo_fileHashSha256": "8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "explorer.exe", + "sourceParentProcessInfo_pid": 2184, + "sourceParentProcessInfo_pidStarttime": "7/26/2023, 4:43:13.069 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO07\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding", + "sourceProcessInfo_fileHashMd5": "357b678c-68d3-d5ee-86e1-b706fbfd994b", + "sourceProcessInfo_fileHashSha1": "a4e4e2bc502e4ab249b219da357d1aad163ab175", + "sourceProcessInfo_fileHashSha256": "8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b", + "sourceProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "explorer.exe", + "sourceProcessInfo_pid": 3752, + "sourceProcessInfo_pidStarttime": "7/26/2023, 4:51:18.156 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO07\\Crest", + "targetProcessInfo_tgtFileCreatedAt": "7/26/2023, 4:51:40.873 AM", + "targetProcessInfo_tgtFileHashSha1": "e6b4c40c98eb9023ad522ef8664f6a8256c65a64", + "targetProcessInfo_tgtFileHashSha256": "a36ba35cf5b5386e7c76e5b9673b999c7bf4e2a30e6408b85102aa61f3be4523", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "7/26/2023, 4:51:40.874 AM", + "targetProcessInfo_tgtFilePath": "C:\\Windows\\Installer\\MSI62BC.tmp", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/26/2023, 5:10:04.255 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "480C14F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "240814F580778F51", + "sourceParentProcessInfo_uniqueId": "230814F580778F51", + "sourceProcessInfo_storyline": "3F0C14F580778F51", + "sourceProcessInfo_uniqueId": "3E0C14F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO07", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": true, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO07", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1737436495713459500, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/26/2023, 4:55:56.747 AM", + "alertInfo_dvEventId": "01H688VBDBEK7BMHE6RB25DPQ7_41", + "alertInfo_eventType": "FILEMODIFICATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/26/2023, 4:56:10.292 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/26/2023, 4:56:10.292 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO07", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding", + "sourceParentProcessInfo_fileHashMd5": "357b678c-68d3-d5ee-86e1-b706fbfd994b", + "sourceParentProcessInfo_fileHashSha1": "a4e4e2bc502e4ab249b219da357d1aad163ab175", + "sourceParentProcessInfo_fileHashSha256": "8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "explorer.exe", + "sourceParentProcessInfo_pid": 3752, + "sourceParentProcessInfo_pidStarttime": "7/26/2023, 4:51:18.156 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO07\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\MsiExec.exe -Embedding A970964D09FC76D0369C3F0735F8F6CB A", + "sourceProcessInfo_fileHashMd5": "302be4b7-434e-6797-6902-9c8570825cc0", + "sourceProcessInfo_fileHashSha1": "f3d7fee4ced78e37f49ce4e38ac681f07bca6ae0", + "sourceProcessInfo_fileHashSha256": "5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\msiexec.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "high", + "sourceProcessInfo_name": "msiexec.exe", + "sourceProcessInfo_pid": 1524, + "sourceProcessInfo_pidStarttime": "7/26/2023, 4:54:54.008 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO07\\Crest", + "targetProcessInfo_tgtFileCreatedAt": "7/21/2185, 11:34:33.709 PM", + "targetProcessInfo_tgtFileHashSha1": "b85d02ba0e8de4aeded1a2f5679505cd403bd201", + "targetProcessInfo_tgtFileHashSha256": "f6fb39a8578f19616570d5a3dc7212c84a9da232b30a03376bbf08f4264fedf2", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "7/21/2185, 11:34:33.709 PM", + "targetProcessInfo_tgtFilePath": "C:\\Users\\Crest\\AppData\\Local\\Temp\\sen617C.tmp", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/26/2023, 5:00:31.604 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "81BD12F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "38BD12F580778F51", + "sourceParentProcessInfo_uniqueId": "3EBD12F580778F51", + "sourceProcessInfo_storyline": "38BD12F580778F51", + "sourceProcessInfo_uniqueId": "48BD12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO07", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": true, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO07", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1737430320011352600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/26/2023, 4:43:33.000 AM", + "alertInfo_dvEventId": "01H6884MR8FZHK9TYD68PC12V2_59", + "alertInfo_eventType": "FILEDELETION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/26/2023, 4:43:54.090 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/26/2023, 4:43:54.090 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO07", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Program Files\\WindowsApps\\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\\msteams.exe\" ms-teams:system-initiated", + "sourceParentProcessInfo_fileHashMd5": "1626f236-c0dc-28d5-92a1-0a359ebe3460", + "sourceParentProcessInfo_fileHashSha1": "0fc1714b93869441cba7d44368ec411bac434e68", + "sourceParentProcessInfo_fileHashSha256": "8cca5e46f6e9dfe566795c4e76aae4d44de8885f43bed759ef6bcad2516ac285", + "sourceParentProcessInfo_filePath": "C:\\Program Files\\WindowsApps\\MicrosoftTeams_23119.303.2080.2726_x64__8wekyb3d8bbwe\\msteams.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "msteams.exe", + "sourceParentProcessInfo_pid": 12792, + "sourceParentProcessInfo_pidStarttime": "7/25/2023, 5:42:29.630 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO07\\Crest", + "sourceProcessInfo_commandline": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.82\\msedgewebview2.exe\" --embedded-browser-webview=1 --webview-exe-name=msteams.exe --webview-exe-version=23119.303.2080.2726 --user-data-dir=\"C:\\Users\\Crest\\AppData\\Local\\Packages\\MicrosoftTeams_8wekyb3d8bbwe\\LocalCache\\Microsoft\\MSTeams\\EBWebView\" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=MojoIpcz,msWebOOUI --edge-webview-is-background --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msEdgeFluentOverlayScrollbar,msWebView2CodeCache,msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=12792.17304.14378710367050045082 /pfhostedapp:e7e952ed836442a682dca713cb7c4d91d21a087a", + "sourceProcessInfo_fileHashMd5": "0f259745-8e7a-c81b-049d-45ef5b291246", + "sourceProcessInfo_fileHashSha1": "bbd88a2a41c94d4140ccaef71bfb771e0ccc5c32", + "sourceProcessInfo_fileHashSha256": "0ce0ef234aba4bf60f1c48a058ce764d52e91078e95312de4db4b0911f4cc7d4", + "sourceProcessInfo_filePath": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.82\\msedgewebview2.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "msedgewebview2.exe", + "sourceProcessInfo_pid": 3316, + "sourceProcessInfo_pidStarttime": "7/25/2023, 5:42:30.143 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO07\\Crest", + "targetProcessInfo_tgtFileCreatedAt": "7/25/2023, 5:42:30.637 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt": "7/25/2023, 5:43:42.536 AM", + "targetProcessInfo_tgtFilePath": "C:\\Users\\Crest\\AppData\\Local\\Temp\\48d577fd-6e2f-441b-af70-03ea7c1fe9b5.tmp", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + } +] \ No newline at end of file diff --git a/Sample Data/ASIM/SentinelOne_ASimNetworkSession_IngestedLogs.csv b/Sample Data/ASIM/SentinelOne_ASimNetworkSession_IngestedLogs.csv new file mode 100644 index 00000000000..b78c519ba01 --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimNetworkSession_IngestedLogs.csv @@ -0,0 +1,21 @@ +TenantId,SourceSystem,MG,ManagementGroupName,TimeGenerated [UTC],Computer,RawData,alertInfo_indicatorDescription_s,alertInfo_indicatorName_s,targetProcessInfo_tgtFileOldPath_s,alertInfo_indicatorCategory_s,alertInfo_registryOldValue_g,alertInfo_dstIp_s,alertInfo_dstPort_s,alertInfo_netEventDirection_s,alertInfo_srcIp_s,alertInfo_srcPort_s,containerInfo_id_s,targetProcessInfo_tgtFileId_g,alertInfo_registryOldValue_s,alertInfo_registryOldValueType_s,alertInfo_dnsRequest_s,alertInfo_dnsResponse_s,alertInfo_registryKeyPath_s,alertInfo_registryPath_s,alertInfo_registryValue_g,ruleInfo_description_s,alertInfo_registryValue_s,alertInfo_loginAccountDomain_s,alertInfo_loginAccountSid_s,alertInfo_loginIsAdministratorEquivalent_s,alertInfo_loginIsSuccessful_s,alertInfo_loginType_s,alertInfo_loginsUserName_s,alertInfo_srcMachineIp_s,targetProcessInfo_tgtProcCmdLine_s,targetProcessInfo_tgtProcImagePath_s,targetProcessInfo_tgtProcName_s,targetProcessInfo_tgtProcPid_s,targetProcessInfo_tgtProcSignedStatus_s,targetProcessInfo_tgtProcStorylineId_s,targetProcessInfo_tgtProcUid_s,sourceParentProcessInfo_storyline_g,sourceParentProcessInfo_uniqueId_g,sourceProcessInfo_storyline_g,sourceProcessInfo_uniqueId_g,targetProcessInfo_tgtProcStorylineId_g,targetProcessInfo_tgtProcUid_g,agentDetectionInfo_machineType_s,agentDetectionInfo_name_s,agentDetectionInfo_osFamily_s,agentDetectionInfo_osName_s,agentDetectionInfo_osRevision_s,agentDetectionInfo_uuid_g,agentDetectionInfo_version_s,agentRealtimeInfo_id_s,agentRealtimeInfo_infected_b,agentRealtimeInfo_isActive_b,agentRealtimeInfo_isDecommissioned_b,agentRealtimeInfo_machineType_s,agentRealtimeInfo_name_s,agentRealtimeInfo_os_s,agentRealtimeInfo_uuid_g,alertInfo_alertId_s,alertInfo_analystVerdict_s,alertInfo_createdAt_t [UTC],alertInfo_dvEventId_s,alertInfo_eventType_s,alertInfo_hitType_s,alertInfo_incidentStatus_s,alertInfo_isEdr_b,alertInfo_reportedAt_t [UTC],alertInfo_source_s,alertInfo_updatedAt_t [UTC],ruleInfo_id_s,ruleInfo_name_s,ruleInfo_queryLang_s,ruleInfo_queryType_s,ruleInfo_s1ql_s,ruleInfo_scopeLevel_s,ruleInfo_severity_s,ruleInfo_treatAsThreat_s,sourceParentProcessInfo_commandline_s,sourceParentProcessInfo_fileHashMd5_g,sourceParentProcessInfo_fileHashSha1_s,sourceParentProcessInfo_fileHashSha256_s,sourceParentProcessInfo_filePath_s,sourceParentProcessInfo_fileSignerIdentity_s,sourceParentProcessInfo_integrityLevel_s,sourceParentProcessInfo_name_s,sourceParentProcessInfo_pid_s,sourceParentProcessInfo_pidStarttime_t [UTC],sourceParentProcessInfo_storyline_s,sourceParentProcessInfo_subsystem_s,sourceParentProcessInfo_uniqueId_s,sourceParentProcessInfo_user_s,sourceProcessInfo_commandline_s,sourceProcessInfo_fileHashMd5_g,sourceProcessInfo_fileHashSha1_s,sourceProcessInfo_fileHashSha256_s,sourceProcessInfo_filePath_s,sourceProcessInfo_fileSignerIdentity_s,sourceProcessInfo_integrityLevel_s,sourceProcessInfo_name_s,sourceProcessInfo_pid_s,sourceProcessInfo_pidStarttime_t [UTC],sourceProcessInfo_storyline_s,sourceProcessInfo_subsystem_s,sourceProcessInfo_uniqueId_s,sourceProcessInfo_user_s,targetProcessInfo_tgtFileCreatedAt_t [UTC],targetProcessInfo_tgtFileHashSha1_s,targetProcessInfo_tgtFileHashSha256_s,targetProcessInfo_tgtFileId_s,targetProcessInfo_tgtFileIsSigned_s,targetProcessInfo_tgtFileModifiedAt_t [UTC],targetProcessInfo_tgtFilePath_s,targetProcessInfo_tgtProcIntegrityLevel_s,targetProcessInfo_tgtProcessStartTime_t [UTC],agentUpdatedVersion_s,agentId_s,hash_s,osFamily_s,threatId_s,creator_s,creatorId_s,inherits_b,isDefault_b,name_s,registrationToken_s,totalAgents_d,type_s,agentDetectionInfo_accountId_s,agentDetectionInfo_accountName_s,agentDetectionInfo_agentDetectionState_s,agentDetectionInfo_agentDomain_s,agentDetectionInfo_agentIpV4_s,agentDetectionInfo_agentIpV6_s,agentDetectionInfo_agentLastLoggedInUserName_s,agentDetectionInfo_agentMitigationMode_s,agentDetectionInfo_agentOsName_s,agentDetectionInfo_agentOsRevision_s,agentDetectionInfo_agentRegisteredAt_t [UTC],agentDetectionInfo_agentUuid_g,agentDetectionInfo_agentVersion_s,agentDetectionInfo_externalIp_s,agentDetectionInfo_groupId_s,agentDetectionInfo_groupName_s,agentDetectionInfo_siteId_s,agentDetectionInfo_siteName_s,agentRealtimeInfo_accountId_s,agentRealtimeInfo_accountName_s,agentRealtimeInfo_activeThreats_d,agentRealtimeInfo_agentComputerName_s,agentRealtimeInfo_agentDomain_s,agentRealtimeInfo_agentId_s,agentRealtimeInfo_agentInfected_b,agentRealtimeInfo_agentIsActive_b,agentRealtimeInfo_agentIsDecommissioned_b,agentRealtimeInfo_agentMachineType_s,agentRealtimeInfo_agentMitigationMode_s,agentRealtimeInfo_agentNetworkStatus_s,agentRealtimeInfo_agentOsName_s,agentRealtimeInfo_agentOsRevision_s,agentRealtimeInfo_agentOsType_s,agentRealtimeInfo_agentUuid_g,agentRealtimeInfo_agentVersion_s,agentRealtimeInfo_groupId_s,agentRealtimeInfo_groupName_s,agentRealtimeInfo_networkInterfaces_s,agentRealtimeInfo_operationalState_s,agentRealtimeInfo_rebootRequired_b,agentRealtimeInfo_scanFinishedAt_t [UTC],agentRealtimeInfo_scanStartedAt_t [UTC],agentRealtimeInfo_scanStatus_s,agentRealtimeInfo_siteId_s,agentRealtimeInfo_siteName_s,agentRealtimeInfo_userActionsNeeded_s,indicators_s,mitigationStatus_s,threatInfo_analystVerdict_s,threatInfo_analystVerdictDescription_s,threatInfo_automaticallyResolved_b,threatInfo_certificateId_s,threatInfo_classification_s,threatInfo_classificationSource_s,threatInfo_cloudFilesHashVerdict_s,threatInfo_collectionId_s,threatInfo_confidenceLevel_s,threatInfo_createdAt_t [UTC],threatInfo_detectionEngines_s,threatInfo_detectionType_s,threatInfo_engines_s,threatInfo_externalTicketExists_b,threatInfo_failedActions_b,threatInfo_fileExtension_s,threatInfo_fileExtensionType_s,threatInfo_filePath_s,threatInfo_fileSize_d,threatInfo_fileVerificationType_s,threatInfo_identifiedAt_t [UTC],threatInfo_incidentStatus_s,threatInfo_incidentStatusDescription_s,threatInfo_initiatedBy_s,threatInfo_initiatedByDescription_s,threatInfo_isFileless_b,threatInfo_isValidCertificate_b,threatInfo_mitigatedPreemptively_b,threatInfo_mitigationStatus_s,threatInfo_mitigationStatusDescription_s,threatInfo_originatorProcess_s,threatInfo_pendingActions_b,threatInfo_processUser_s,threatInfo_publisherName_s,threatInfo_reachedEventsLimit_b,threatInfo_rebootRequired_b,threatInfo_sha1_s,threatInfo_storyline_s,threatInfo_threatId_s,threatInfo_threatName_s,threatInfo_updatedAt_t [UTC],whiteningOptions_s,threatInfo_maliciousProcessArguments_s,threatInfo_fileExtension_g,threatInfo_threatName_g,threatInfo_storyline_g,accountId_s,accountName_s,activityType_d,activityUuid_g,createdAt_t [UTC],id_s,primaryDescription_s,secondaryDescription_s,siteId_s,siteName_s,updatedAt_t [UTC],userId_s,event_name_s,DataFields_s,description_s,comments_s,activeDirectory_computerMemberOf_s,activeDirectory_lastUserMemberOf_s,activeThreats_d,agentVersion_s,allowRemoteShell_b,appsVulnerabilityStatus_s,computerName_s,consoleMigrationStatus_s,coreCount_d,cpuCount_d,cpuId_s,detectionState_s,domain_s,encryptedApplications_b,externalId_s,externalIp_s,firewallEnabled_b,firstFullModeTime_t [UTC],fullDiskScanLastUpdatedAt_t [UTC],groupId_s,groupIp_s,groupName_s,inRemoteShellSession_b,infected_b,installerType_s,isActive_b,isDecommissioned_b,isPendingUninstall_b,isUninstalled_b,isUpToDate_b,lastActiveDate_t [UTC],lastIpToMgmt_s,lastLoggedInUserName_s,licenseKey_s,locationEnabled_b,locationType_s,locations_s,machineType_s,mitigationMode_s,mitigationModeSuspicious_s,modelName_s,networkInterfaces_s,networkQuarantineEnabled_b,networkStatus_s,operationalState_s,osArch_s,osName_s,osRevision_s,osStartTime_t [UTC],osType_s,rangerStatus_s,rangerVersion_s,registeredAt_t [UTC],remoteProfilingState_s,scanFinishedAt_t [UTC],scanStartedAt_t [UTC],scanStatus_s,serialNumber_s,showAlertIcon_b,tags_sentinelone_s,threatRebootRequired_b,totalMemory_d,userActionsNeeded_s,uuid_g,osUsername_s,scanAbortedAt_t [UTC],activeDirectory_computerDistinguishedName_s,activeDirectory_lastUserDistinguishedName_s,Type,_ResourceId +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 5:10:03 AM",,,,,,,,1.1.1.1,21,OUTGOING,2.2.2.1,11,,,,,,,,,,,,,,,,,,,,,,,,,,747ffc62-5417-49b6-b4ea-5109c4ec9e4f,747ffc61-1824-0304-10ba-8cc565a15646,7487986b-0982-122d-e993-6113156f70ed,7488937b-7a34-81e9-e4c7-434a2e49cf39,,,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1713059693172741297,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1736709934432915550,Undefined,"7/25/2023, 4:52:24 AM",01H65P81VTDWS403SH4ZN0JS9T_0,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 4:52:37 AM",STAR,"7/25/2023, 4:52:37 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED, /usr/lib/systemd/systemd --switched-root --system --deserialize 22,,d00e622d514a3351de5cede74496dd50c65fbabb,,/usr/lib/systemd/systemd,,unknown,systemd,1,"7/24/2023, 4:49:44 AM",,unknown,,, /usr/local/demisto/d1_Test2/d1,,27141d28091ab8527a01da1f02a2e8cf5a2bc95a,,/usr/local/demisto/d1_Test2/d1,,unknown,d1,1279,"7/24/2023, 4:50:27 AM",,unknown,,,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,1.1.1.2,22,OUTGOING,2.2.2.2,12,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738442842154293,Undefined,"7/25/2023, 5:49:10 AM",01H65SG50RP78BRBAJ4ZGDQGGF_10,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 5:49:16 AM",STAR,"7/25/2023, 5:49:16 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,2084,"7/17/2023, 10:22:47 AM",D83C0EF580778F51,sys_win32,D73C0EF580778F51,NT AUTHORITY\NETWORK SERVICE,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,1.1.1.3,23,OUTGOING,2.2.2.3,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738444335326608,Undefined,"7/25/2023, 5:49:14 AM",01H65SGAGCE4JDGCGC1GCKNT9S_22,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 5:49:16 AM",STAR,"7/25/2023, 5:49:16 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\System32\svchost.exe -k utcsvc -p,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,4604,"7/17/2023, 10:22:49 AM",553D0EF580778F51,sys_win32,543D0EF580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,1.1.1.4,23,OUTGOING,2.2.2.4,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738445736224238,Undefined,"7/25/2023, 5:49:09 AM",01H65SG2PQ023350V5K0TTCRKP_16,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 5:49:16 AM",STAR,"7/25/2023, 5:49:16 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,sihost.exe,e5a23407-157b-23f3-c244-1d412163e4ee,e8d9750e757e5b580c56521a81ed0cc41d327d82,51eb6455bdca85d3102a00b1ce89969016efc3ed8b08b24a2aa10e03ba1e2b13,C:\Windows\System32\sihost.exe,MICROSOFT WINDOWS,medium,sihost.exe,3160,"7/21/2023, 4:49:44 AM",9C8612F580778F51,sys_win32,9B8612F580778F51,CLO007\Crest,"""C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca",0d7ce0d4-741a-a223-0f5a-618a796f4739,f456a426618804abec06fd5883219c4c6eace180,8b5b969143e22d8f27d919948e30aff8594c15c3c69b42bbafa23551e1dc0c68,C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe,MICROSOFT WINDOWS,low,SearchHost.exe,1160,"7/21/2023, 4:49:46 AM",CD8712F580778F51,sys_win32,CC8712F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,1.1.1.5,23,OUTGOING,2.2.2.5,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738460617615382,Undefined,"7/25/2023, 5:49:14 AM",01H65SGAGCE4JDGCGC1GCKNT9S_32,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 5:49:18 AM",STAR,"7/25/2023, 5:49:18 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k NetworkService -p,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,1576,"7/17/2023, 10:22:47 AM",B83C0EF580778F51,sys_win32,B73C0EF580778F51,NT AUTHORITY\NETWORK SERVICE,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,1.1.1.6,23,OUTGOING,2.2.2.6,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738491395419873,Undefined,"7/25/2023, 5:49:11 AM",01H65SG9CAMBQHFPH0TJD6EYXN_425,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 5:49:22 AM",STAR,"7/25/2023, 5:49:22 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,"""C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.82\msedgewebview2.exe"" --embedded-browser-webview=1 --webview-exe-name=msteams.exe --webview-exe-version=23119.303.2080.2726 --user-data-dir=""C:\Users\Crest\AppData\Local\Packages\MicrosoftTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView"" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=MojoIpcz,msWebOOUI --edge-webview-is-background --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msEdgeFluentOverlayScrollbar,msWebView2CodeCache,msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=9452.304.14872043078598792820 /pfhostedapp:e7e952ed836442a682dca713cb7c4d91d21a087a",0f259745-8e7a-c81b-049d-45ef5b291246,bbd88a2a41c94d4140ccaef71bfb771e0ccc5c32,0ce0ef234aba4bf60f1c48a058ce764d52e91078e95312de4db4b0911f4cc7d4,C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.82\msedgewebview2.exe,MICROSOFT CORPORATION,medium,msedgewebview2.exe,7280,"7/25/2023, 5:36:56 AM",C9B312F580778F51,sys_win32,CFB512F580778F51,CLO007\Crest,"""C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.82\msedgewebview2.exe"" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir=""C:\Users\Crest\AppData\Local\Packages\MicrosoftTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView"" --webview-exe-name=msteams.exe --webview-exe-version=23119.303.2080.2726 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2072 --field-trial-handle=1892,i,4999416576109179693,17961817705433260896,262144 --enable-features=msEdgeFluentOverlayScrollbar,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2CodeCache,msWebView2EnableDraggableRegions --disable-features=MojoIpcz,msWebOOUI /prefetch:3 /pfhostedapp:e7e952ed836442a682dca713cb7c4d91d21a087a",0f259745-8e7a-c81b-049d-45ef5b291246,bbd88a2a41c94d4140ccaef71bfb771e0ccc5c32,0ce0ef234aba4bf60f1c48a058ce764d52e91078e95312de4db4b0911f4cc7d4,C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.82\msedgewebview2.exe,MICROSOFT CORPORATION,medium,msedgewebview2.exe,4144,"7/25/2023, 5:36:56 AM",C9B312F580778F51,sys_win32,EAB512F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,1.1.1.7,23,OUTGOING,2.2.2.7,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738492846649072,Undefined,"7/25/2023, 5:49:10 AM",01H65SG50RP78BRBAJ4ZGDQGGF_8,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 5:49:22 AM",STAR,"7/25/2023, 5:49:22 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k NetworkService -p,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,2692,"7/17/2023, 10:22:48 AM",FC3C0EF580778F51,sys_win32,FB3C0EF580778F51,NT AUTHORITY\NETWORK SERVICE,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,1.1.1.8,23,OUTGOING,2.2.2.8,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738499473649861,Undefined,"7/25/2023, 5:49:14 AM",01H65SGAGCE4JDGCGC1GCKNT9S_3,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 5:49:23 AM",STAR,"7/25/2023, 5:49:23 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\System32\svchost.exe -k NetworkService -p,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,8620,"7/17/2023, 10:33:11 AM",4E4B0EF580778F51,sys_win32,4D4B0EF580778F51,NT AUTHORITY\NETWORK SERVICE,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,1.1.1.9,23,OUTGOING,2.2.2.9,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738500874547448,Undefined,"7/25/2023, 5:49:11 AM",01H65SG9CAMBQHFPH0TJD6EYXN_432,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 5:49:23 AM",STAR,"7/25/2023, 5:49:23 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,sihost.exe,e5a23407-157b-23f3-c244-1d412163e4ee,e8d9750e757e5b580c56521a81ed0cc41d327d82,51eb6455bdca85d3102a00b1ce89969016efc3ed8b08b24a2aa10e03ba1e2b13,C:\Windows\System32\sihost.exe,MICROSOFT WINDOWS,medium,sihost.exe,13788,"7/25/2023, 5:36:13 AM",B2B112F580778F51,sys_win32,B1B112F580778F51,CLO007\Crest,"""C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca",4bd84472-eca2-b69a-0391-f61fa50d0f31,0ca4bcd60601ec0d8602d4f5994cb0393edb892b,c1fc7f6cb2228ee6386d91f27f1a61ae60a63deefb21d78bb810b7f027f1a489,C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe,MICROSOFT WINDOWS,low,StartMenuExperienceHost.exe,4524,"7/25/2023, 5:36:15 AM",B5B212F580778F51,sys_win32,B4B212F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,1.1.1.10,23,OUTGOING,2.2.2.10,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738502325776707,Undefined,"7/25/2023, 5:49:14 AM",01H65SGAGCE4JDGCGC1GCKNT9S_29,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 5:49:23 AM",STAR,"7/25/2023, 5:49:23 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,10972,"7/25/2023, 5:28:16 AM",09AB12F580778F51,sys_win32,08AB12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,1.1.1.11,23,OUTGOING,2.2.2.11,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738511318364930,Undefined,"7/25/2023, 5:49:11 AM",01H65SG9CAMBQHFPH0TJD6EYXN_434,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 5:49:24 AM",STAR,"7/25/2023, 5:49:24 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,1752,"7/17/2023, 10:22:47 AM",C43C0EF580778F51,sys_win32,C33C0EF580778F51,NT AUTHORITY\SYSTEM,"""C:\Windows\system32\wermgr.exe"" -upload",b2eb37f1-bd88-302c-2f15-0217722a8c9f,d8e0c1e1ad99a38f3a84414d5af7b761bf0eb924,a4c41c6c4e1d0fadc9bd3313a3d0e329517f400bd8908dd8c70ac69758e60875,C:\Windows\System32\wermgr.exe,MICROSOFT WINDOWS,system,wermgr.exe,5488,"7/25/2023, 5:37:03 AM",34B612F580778F51,sys_win32,33B612F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:00:06 AM",,,,,,,,1.1.1.12,23,OUTGOING,2.2.2.12,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736738514782860324,Undefined,"7/25/2023, 5:49:14 AM",01H65SGAGCE4JDGCGC1GCKNT9S_9,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 5:49:24 AM",STAR,"7/25/2023, 5:49:24 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,11436,"7/25/2023, 5:34:08 AM",FEAE12F580778F51,sys_win32,FDAE12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:40:04 AM",,,,,,,,1.1.1.13,23,OUTGOING,2.2.2.13,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736756505571408611,Undefined,"7/25/2023, 6:24:58 AM",01H65VHMRC71Y2GK2M458J2WMW_15,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 6:25:09 AM",STAR,"7/25/2023, 6:25:09 AM",1736743171400115521,CWL547,1,events,"EndpointName = ""CLO007""",account,Medium,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:47 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,2084,"7/17/2023, 10:22:47 AM",D83C0EF580778F51,sys_win32,D73C0EF580778F51,NT AUTHORITY\NETWORK SERVICE,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:40:04 AM",,,,,,,,1.1.1.14,23,OUTGOING,2.2.2.14,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736757508513437640,Undefined,"7/25/2023, 6:27:00 AM",01H65VN9YVSBR9FGDK3RJX7NKK_10,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 6:27:09 AM",STAR,"7/25/2023, 6:27:09 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,1752,"7/17/2023, 10:22:47 AM",C43C0EF580778F51,sys_win32,C33C0EF580778F51,NT AUTHORITY\SYSTEM,taskhostw.exe,4887a65f-d4f6-598a-f498-6cbc1c0e5488,0882f3f9947405bb80c2e830adf69af85c9b51c7,82472a84bcbb4009add338200f8e853fe4c5eafe2e2c3a2d711b85bf29b72d54,C:\Windows\System32\taskhostw.exe,MICROSOFT WINDOWS,system,taskhostw.exe,8648,"7/25/2023, 6:26:34 AM",24DB12F580778F51,sys_win32,23DB12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 10:30:03 AM",,,,,,,,1.1.1.15,23,OUTGOING,2.2.2.15,14,,,,,,,,,,,,,,,,,,,,,,,,,,75bf528b-1526-ba0d-f9b8-1974a96d2487,75cd7ac1-1fda-d623-2eeb-83dc0120218e,75bf528b-1526-ba0d-f9b8-1974a96d2487,75cd7ad0-4345-18d1-a5b9-d71c6f5dbfd4,,,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1713059693172741297,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1736872444737646416,Undefined,"7/25/2023, 10:15:22 AM",01H668QFMWS1BRZA6EAHDVWFN0_55,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 10:15:30 AM",STAR,"7/25/2023, 10:15:30 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED," mount -t nfs -o vers=3,nolock 10.50.3.251: /root/nfsdir",,f6d5066df72ae947089cb3762679c54f61d7c97f,,/usr/bin/mount,,unknown,mount,32168,"7/25/2023, 10:15:07 AM",,unknown,,, /sbin/mount.nfs 10.50.3.251: /root/nfsdir,,2894ddd5adc4c4f89d6171feb966ee8db03e3d48,,/sbin/mount.nfs,,unknown,mount.nfs,32169,"7/25/2023, 10:15:07 AM",,unknown,,,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 10:30:03 AM",,,,,,,,1.1.1.16,23,OUTGOING,2.2.2.16,14,,,,,,,,,,,,,,,,,,,,,,,,,,75bf528b-1526-ba0d-f9b8-1974a96d2487,75c81424-5cc1-1e7f-759b-b468bd0aba1c,75bf528b-1526-ba0d-f9b8-1974a96d2487,75c81438-dfdb-a964-e1c3-995f5d9d27d1,,,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1713059693172741297,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1736872477948148980,Undefined,"7/25/2023, 10:15:22 AM",01H668QFMWS1BRZA6EAHDVWFN0_7,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 10:15:34 AM",STAR,"7/25/2023, 10:15:34 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED," mount -t nfs -o vers=3,nolock 10.50.3.251:/ns2/bucket4/ /root/nfsdir",,f6d5066df72ae947089cb3762679c54f61d7c97f,,/usr/bin/mount,,unknown,mount,32151,"7/25/2023, 10:14:44 AM",,unknown,,, /sbin/mount.nfs 10.50.3.251:/ns2/bucket4/ /root/nfsdir,,2894ddd5adc4c4f89d6171feb966ee8db03e3d48,,/sbin/mount.nfs,,unknown,mount.nfs,32152,"7/25/2023, 10:14:44 AM",,unknown,,,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 10:30:03 AM",,,,,,,,1.1.1.17,23,OUTGOING,2.2.2.17,14,,,,,,,,,,,,,,,,,,,,,,,,,,75bf528b-1526-ba0d-f9b8-1974a96d2487,75cb6e81-9423-24c7-acca-7e20e111bbad,75bf528b-1526-ba0d-f9b8-1974a96d2487,75cb6e91-9565-7ee1-8767-b8a1f763de24,,,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1713059693172741297,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1736872503055255672,Undefined,"7/25/2023, 10:15:22 AM",01H668QFMWS1BRZA6EAHDVWFN0_15,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 10:15:37 AM",STAR,"7/25/2023, 10:15:37 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED," mount -t nfs -o vers=3,nolock 10.50.3.251:/ns2/bucket4 /root/nfsdir",,f6d5066df72ae947089cb3762679c54f61d7c97f,,/usr/bin/mount,,unknown,mount,32157,"7/25/2023, 10:14:59 AM",,unknown,,, /sbin/mount.nfs 10.50.3.251:/ns2/bucket4 /root/nfsdir,,2894ddd5adc4c4f89d6171feb966ee8db03e3d48,,/sbin/mount.nfs,,unknown,mount.nfs,32158,"7/25/2023, 10:14:59 AM",,unknown,,,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 10:30:03 AM",,,,,,,,1.1.1.18,23,OUTGOING,2.2.2.18,14,,,,,,,,,,,,,,,,,,,,,,,,,,75bf528b-1526-ba0d-f9b8-1974a96d2487,75cc5c9d-5f8f-28b3-b1fa-4ffaff168531,75bf528b-1526-ba0d-f9b8-1974a96d2487,75cc5cb4-12a0-4cb0-cb0c-5678f97e3718,,,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1713059693172741297,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1736872508449131071,Undefined,"7/25/2023, 10:15:22 AM",01H668QFMWS1BRZA6EAHDVWFN0_51,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 10:15:38 AM",STAR,"7/25/2023, 10:15:38 AM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED," mount -t nfs -o vers=3,nolock 10.50.3.251:/ns2/ /root/nfsdir",,f6d5066df72ae947089cb3762679c54f61d7c97f,,/usr/bin/mount,,unknown,mount,32166,"7/25/2023, 10:15:03 AM",,unknown,,, /sbin/mount.nfs 10.50.3.251:/ns2/ /root/nfsdir,,2894ddd5adc4c4f89d6171feb966ee8db03e3d48,,/sbin/mount.nfs,,unknown,mount.nfs,32167,"7/25/2023, 10:15:03 AM",,unknown,,,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 2:00:04 PM",,,,,,,,1.1.1.19,23,OUTGOING,2.2.2.19,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736978424395258117,Undefined,"7/25/2023, 1:45:59 PM",01H66MS4AHVPK6ZSZA1W047SMR_278,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 1:46:04 PM",STAR,"7/25/2023, 1:46:04 PM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,C:\Windows\Explorer.EXE,357b678c-68d3-d5ee-86e1-b706fbfd994b,a4e4e2bc502e4ab249b219da357d1aad163ab175,8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,14472,"7/25/2023, 5:42:20 AM",FEBB12F580778F51,sys_win32,FDBB12F580778F51,CLO007\Crest,C:\Windows\System32\smartscreen.exe -Embedding,8b71524d-b619-2b9a-1967-1156e27b1826,4549fabd13aaf136087a4501682eb2559eaafdbb,83c9bd1ff0dd424a841cd1b22993e09e16d1339501070613236b0d1f8bff92bc,C:\Windows\System32\smartscreen.exe,MICROSOFT WINDOWS,medium,smartscreen.exe,14528,"7/25/2023, 1:45:28 PM",E0E912F580778F51,sys_win32,DFE912F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 2:00:04 PM",,,,,,,,1.1.1.20,23,OUTGOING,2.2.2.20,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,FALSE,TRUE,FALSE,laptop,CLO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736978447346490503,Undefined,"7/25/2023, 1:45:59 PM",01H66MS4AHVPK6ZSZA1W047SMR_22,TCPV4,Events,Unresolved,TRUE,"7/25/2023, 1:46:07 PM",STAR,"7/25/2023, 1:46:07 PM",1733309646016098581,IP Connect & IP List,1,events,"EventType = ""IP Connect"" OR EventType = ""IP Listen""",account,Low,UNDEFINED,C:\Users\Crest\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /updateSource:ODU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix,8d5ca829-19d6-6439-685d-dd97dca650c6,81c0122bc0adc75ce71912504b8d72825aecad35,7dfe00a315c1e6956eb32c9d12fc809998590d15de1820b34b6d9ca7aa109b88,C:\Users\Crest\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe,MICROSOFT CORPORATION,medium,OneDriveSetup.exe,5412,"7/25/2023, 5:46:58 AM",70BC12F580778F51,sys_win32,19BF12F580778F51,CLO007\Crest, /updateInstalled /background,174826c7-8c0a-a36d-a145-7e711e4c9e80,56ee9857c7a0643d6f6d5e56c3f4689bb1499829,159e208d7211b71b5dad89771bf1fc047de839bcb8e68475f248a051d2ebaa02,C:\Users\Crest\AppData\Local\Microsoft\OneDrive\OneDrive.exe,MICROSOFT CORPORATION,medium,OneDrive.exe,2204,"7/25/2023, 5:47:11 AM",70BC12F580778F51,sys_win32,42CD12F580778F51,CLO007\Crest,"1/1/1970, 12:00:00 AM",,,,signed,"1/1/1970, 12:00:00 AM",,unknown,"1/1/1970, 12:00:00 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, \ No newline at end of file diff --git a/Sample Data/ASIM/SentinelOne_ASimNetworkSession_RawLogs.json b/Sample Data/ASIM/SentinelOne_ASimNetworkSession_RawLogs.json new file mode 100644 index 00000000000..7155625710d --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimNetworkSession_RawLogs.json @@ -0,0 +1,6042 @@ +[ + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 5:10:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "0f81ec00-9e52-48e6-b899-eb3bbeede741", + "alertInfo_dstIp": "1.1.1.1", + "alertInfo_dstPort": 21, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.1", + "alertInfo_srcPort": 11, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1736709934432915500, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 4:52:24 AM", + "alertInfo_dvEventId": "01H65P81VTDWS403SH4ZN0JS9T_0", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 4:52:37 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 4:52:37 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/lib/systemd/systemd --switched-root --system --deserialize 22", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "d00e622d514a3351de5cede74496dd50c65fbabb", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/lib/systemd/systemd", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "systemd", + "sourceParentProcessInfo_pid": 1, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/24/2023, 4:49:44 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/local/demisto/d1_Test2/d1", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "27141d28091ab8527a01da1f02a2e8cf5a2bc95a", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/local/demisto/d1_Test2/d1", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "d1", + "sourceProcessInfo_pid": 1279, + "sourceProcessInfo_pidStarttime [UTC]": "7/24/2023, 4:50:27 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "AC644457DCBAD901", + "alertInfo_dstIp": "1.1.1.2", + "alertInfo_dstPort": 22, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.2", + "alertInfo_srcPort": 12, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "FB4511F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "433C0EF580778F52", + "targetProcessInfo_tgtProcUid": "433C0EF580778F53", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "D83C0EF580778F51", + "sourceProcessInfo_uniqueId": "D73C0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738442842154200, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:10 AM", + "alertInfo_dvEventId": "01H65SG50RP78BRBAJ4ZGDQGGF_10", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:16 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:16 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\svchost.exe -k netprofm -p -s netprofm", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 2084, + "sourceProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\NETWORK SERVICE", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.3", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.3", + "alertInfo_srcPort": 13, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "73ffdfe3-1bbd-6667-6750-684c8ca1c402", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "78d7744d-2837-40d2-aff4-bede5877836e", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "553D0EF580778F51", + "sourceProcessInfo_uniqueId": "543D0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738444335326700, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:14 AM", + "alertInfo_dvEventId": "01H65SGAGCE4JDGCGC1GCKNT9S_22", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:16 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:16 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\svchost.exe -k utcsvc -p", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 4604, + "sourceProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:49 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.4", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.4", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "svchost.exe,FrameServer", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "9C8612F580778F51", + "sourceParentProcessInfo_uniqueId": "9B8612F580778F51", + "sourceProcessInfo_storyline": "CD8712F580778F51", + "sourceProcessInfo_uniqueId": "CC8712F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738445736224300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:09 AM", + "alertInfo_dvEventId": "01H65SG2PQ023350V5K0TTCRKP_16", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:16 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:16 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "sihost.exe", + "sourceParentProcessInfo_fileHashMd5": "e5a23407-157b-23f3-c244-1d412163e4ee", + "sourceParentProcessInfo_fileHashSha1": "e8d9750e757e5b580c56521a81ed0cc41d327d82", + "sourceParentProcessInfo_fileHashSha256": "51eb6455bdca85d3102a00b1ce89969016efc3ed8b08b24a2aa10e03ba1e2b13", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\sihost.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "sihost.exe", + "sourceParentProcessInfo_pid": 3160, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/21/2023, 4:49:44 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\SearchHost.exe\" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca", + "sourceProcessInfo_fileHashMd5": "0d7ce0d4-741a-a223-0f5a-618a796f4739", + "sourceProcessInfo_fileHashSha1": "f456a426618804abec06fd5883219c4c6eace180", + "sourceProcessInfo_fileHashSha256": "8b5b969143e22d8f27d919948e30aff8594c15c3c69b42bbafa23551e1dc0c68", + "sourceProcessInfo_filePath": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\SearchHost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "low", + "sourceProcessInfo_name": "SearchHost.exe", + "sourceProcessInfo_pid": 1160, + "sourceProcessInfo_pidStarttime [UTC]": "7/21/2023, 4:49:46 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.5", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.5", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "B83C0EF580778F51", + "sourceProcessInfo_uniqueId": "B73C0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738460617615400, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:14 AM", + "alertInfo_dvEventId": "01H65SGAGCE4JDGCGC1GCKNT9S_32", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:18 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:18 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k NetworkService -p", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 1576, + "sourceProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\NETWORK SERVICE", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.6", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.6", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "C9B312F580778F51", + "sourceParentProcessInfo_uniqueId": "CFB512F580778F51", + "sourceProcessInfo_storyline": "C9B312F580778F51", + "sourceProcessInfo_uniqueId": "EAB512F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738491395420000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:11 AM", + "alertInfo_dvEventId": "01H65SG9CAMBQHFPH0TJD6EYXN_425", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:22 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:22 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.82\\msedgewebview2.exe\" --embedded-browser-webview=1 --webview-exe-name=msteams.exe --webview-exe-version=23119.303.2080.2726 --user-data-dir=\"C:\\Users\\Crest\\AppData\\Local\\Packages\\MicrosoftTeams_8wekyb3d8bbwe\\LocalCache\\Microsoft\\MSTeams\\EBWebView\" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=MojoIpcz,msWebOOUI --edge-webview-is-background --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msEdgeFluentOverlayScrollbar,msWebView2CodeCache,msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=9452.304.14872043078598792820 /pfhostedapp:e7e952ed836442a682dca713cb7c4d91d21a087a", + "sourceParentProcessInfo_fileHashMd5": "0f259745-8e7a-c81b-049d-45ef5b291246", + "sourceParentProcessInfo_fileHashSha1": "bbd88a2a41c94d4140ccaef71bfb771e0ccc5c32", + "sourceParentProcessInfo_fileHashSha256": "0ce0ef234aba4bf60f1c48a058ce764d52e91078e95312de4db4b0911f4cc7d4", + "sourceParentProcessInfo_filePath": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.82\\msedgewebview2.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "msedgewebview2.exe", + "sourceParentProcessInfo_pid": 7280, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:36:56 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.82\\msedgewebview2.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir=\"C:\\Users\\Crest\\AppData\\Local\\Packages\\MicrosoftTeams_8wekyb3d8bbwe\\LocalCache\\Microsoft\\MSTeams\\EBWebView\" --webview-exe-name=msteams.exe --webview-exe-version=23119.303.2080.2726 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2072 --field-trial-handle=1892,i,4999416576109179693,17961817705433260896,262144 --enable-features=msEdgeFluentOverlayScrollbar,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2CodeCache,msWebView2EnableDraggableRegions --disable-features=MojoIpcz,msWebOOUI /prefetch:3 /pfhostedapp:e7e952ed836442a682dca713cb7c4d91d21a087a", + "sourceProcessInfo_fileHashMd5": "0f259745-8e7a-c81b-049d-45ef5b291246", + "sourceProcessInfo_fileHashSha1": "bbd88a2a41c94d4140ccaef71bfb771e0ccc5c32", + "sourceProcessInfo_fileHashSha256": "0ce0ef234aba4bf60f1c48a058ce764d52e91078e95312de4db4b0911f4cc7d4", + "sourceProcessInfo_filePath": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.82\\msedgewebview2.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "msedgewebview2.exe", + "sourceProcessInfo_pid": 4144, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:36:56 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.7", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.7", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "FC3C0EF580778F51", + "sourceProcessInfo_uniqueId": "FB3C0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738492846649000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:10 AM", + "alertInfo_dvEventId": "01H65SG50RP78BRBAJ4ZGDQGGF_8", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:22 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:22 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k NetworkService -p", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 2692, + "sourceProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:48 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\NETWORK SERVICE", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.8", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.8", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "4E4B0EF580778F51", + "sourceProcessInfo_uniqueId": "4D4B0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738499473650000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:14 AM", + "alertInfo_dvEventId": "01H65SGAGCE4JDGCGC1GCKNT9S_3", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:23 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:23 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\svchost.exe -k NetworkService -p", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 8620, + "sourceProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:33:11 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\NETWORK SERVICE", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.9", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.9", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "B2B112F580778F51", + "sourceParentProcessInfo_uniqueId": "B1B112F580778F51", + "sourceProcessInfo_storyline": "B5B212F580778F51", + "sourceProcessInfo_uniqueId": "B4B212F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738500874547500, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:11 AM", + "alertInfo_dvEventId": "01H65SG9CAMBQHFPH0TJD6EYXN_432", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:23 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:23 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "sihost.exe", + "sourceParentProcessInfo_fileHashMd5": "e5a23407-157b-23f3-c244-1d412163e4ee", + "sourceParentProcessInfo_fileHashSha1": "e8d9750e757e5b580c56521a81ed0cc41d327d82", + "sourceParentProcessInfo_fileHashSha256": "51eb6455bdca85d3102a00b1ce89969016efc3ed8b08b24a2aa10e03ba1e2b13", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\sihost.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "sihost.exe", + "sourceParentProcessInfo_pid": 13788, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:36:13 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\StartMenuExperienceHost.exe\" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca", + "sourceProcessInfo_fileHashMd5": "4bd84472-eca2-b69a-0391-f61fa50d0f31", + "sourceProcessInfo_fileHashSha1": "0ca4bcd60601ec0d8602d4f5994cb0393edb892b", + "sourceProcessInfo_fileHashSha256": "c1fc7f6cb2228ee6386d91f27f1a61ae60a63deefb21d78bb810b7f027f1a489", + "sourceProcessInfo_filePath": "C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\StartMenuExperienceHost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "low", + "sourceProcessInfo_name": "StartMenuExperienceHost.exe", + "sourceProcessInfo_pid": 4524, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:36:15 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.10", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.10", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "09AB12F580778F51", + "sourceProcessInfo_uniqueId": "08AB12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738502325776600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:14 AM", + "alertInfo_dvEventId": "01H65SGAGCE4JDGCGC1GCKNT9S_29", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:23 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:23 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\svchost.exe -k netsvcs -p -s BITS", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 10972, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:28:16 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.11", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.11", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "C43C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "C33C0EF580778F51", + "sourceProcessInfo_storyline": "34B612F580778F51", + "sourceProcessInfo_uniqueId": "33B612F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738511318365000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:11 AM", + "alertInfo_dvEventId": "01H65SG9CAMBQHFPH0TJD6EYXN_434", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:24 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:24 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule", + "sourceParentProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceParentProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceParentProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "svchost.exe", + "sourceParentProcessInfo_pid": 1752, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\wermgr.exe\" -upload", + "sourceProcessInfo_fileHashMd5": "b2eb37f1-bd88-302c-2f15-0217722a8c9f", + "sourceProcessInfo_fileHashSha1": "d8e0c1e1ad99a38f3a84414d5af7b761bf0eb924", + "sourceProcessInfo_fileHashSha256": "a4c41c6c4e1d0fadc9bd3313a3d0e329517f400bd8908dd8c70ac69758e60875", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\wermgr.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "wermgr.exe", + "sourceProcessInfo_pid": 5488, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:37:03 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:00:06 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.12", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.12", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "FEAE12F580778F51", + "sourceProcessInfo_uniqueId": "FDAE12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736738514782860300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 5:49:14 AM", + "alertInfo_dvEventId": "01H65SGAGCE4JDGCGC1GCKNT9S_9", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 5:49:24 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 5:49:24 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s wlidsvc", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 11436, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:34:08 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:40:04 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.13", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.13", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "D83C0EF580778F51", + "sourceProcessInfo_uniqueId": "D73C0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736756505571408600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 6:24:58 AM", + "alertInfo_dvEventId": "01H65VHMRC71Y2GK2M458J2WMW_15", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 6:25:09 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 6:25:09 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\svchost.exe -k netprofm -p -s netprofm", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 2084, + "sourceProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\NETWORK SERVICE", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 6:40:04 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.14", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.14", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "C43C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "C33C0EF580778F51", + "sourceProcessInfo_storyline": "24DB12F580778F51", + "sourceProcessInfo_uniqueId": "23DB12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736757508513437700, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 6:27:00 AM", + "alertInfo_dvEventId": "01H65VN9YVSBR9FGDK3RJX7NKK_10", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 6:27:09 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 6:27:09 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule", + "sourceParentProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceParentProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceParentProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "svchost.exe", + "sourceParentProcessInfo_pid": 1752, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/17/2023, 10:22:47 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "taskhostw.exe", + "sourceProcessInfo_fileHashMd5": "4887a65f-d4f6-598a-f498-6cbc1c0e5488", + "sourceProcessInfo_fileHashSha1": "0882f3f9947405bb80c2e830adf69af85c9b51c7", + "sourceProcessInfo_fileHashSha256": "82472a84bcbb4009add338200f8e853fe4c5eafe2e2c3a2d711b85bf29b72d54", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\taskhostw.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "taskhostw.exe", + "sourceProcessInfo_pid": 8648, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 6:26:34 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 10:30:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.15", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.15", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1736872444737646300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 10:15:22 AM", + "alertInfo_dvEventId": "01H668QFMWS1BRZA6EAHDVWFN0_55", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 10:15:30 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 10:15:30 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "mount -t nfs -o vers=3,nolock 10.50.3.251: /root/nfsdir", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "f6d5066df72ae947089cb3762679c54f61d7c97f", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/bin/mount", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "mount", + "sourceParentProcessInfo_pid": 32168, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 10:15:07 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/sbin/mount.nfs 10.50.3.251: /root/nfsdir", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "2894ddd5adc4c4f89d6171feb966ee8db03e3d48", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/sbin/mount.nfs", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "mount.nfs", + "sourceProcessInfo_pid": 32169, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 10:15:07 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 10:30:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.16", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.16", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1736872477948149000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 10:15:22 AM", + "alertInfo_dvEventId": "01H668QFMWS1BRZA6EAHDVWFN0_7", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 10:15:34 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 10:15:34 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "mount -t nfs -o vers=3,nolock 10.50.3.251:/ns2/bucket4/ /root/nfsdir", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "f6d5066df72ae947089cb3762679c54f61d7c97f", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/bin/mount", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "mount", + "sourceParentProcessInfo_pid": 32151, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 10:14:44 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/sbin/mount.nfs 10.50.3.251:/ns2/bucket4/ /root/nfsdir", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "2894ddd5adc4c4f89d6171feb966ee8db03e3d48", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/sbin/mount.nfs", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "mount.nfs", + "sourceProcessInfo_pid": 32152, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 10:14:44 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 10:30:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.17", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.17", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1736872503055255600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 10:15:22 AM", + "alertInfo_dvEventId": "01H668QFMWS1BRZA6EAHDVWFN0_15", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 10:15:37 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 10:15:37 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "mount -t nfs -o vers=3,nolock 10.50.3.251:/ns2/bucket4 /root/nfsdir", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "f6d5066df72ae947089cb3762679c54f61d7c97f", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/bin/mount", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "mount", + "sourceParentProcessInfo_pid": 32157, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 10:14:59 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/sbin/mount.nfs 10.50.3.251:/ns2/bucket4 /root/nfsdir", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "2894ddd5adc4c4f89d6171feb966ee8db03e3d48", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/sbin/mount.nfs", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "mount.nfs", + "sourceProcessInfo_pid": 32158, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 10:14:59 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 10:30:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.18", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.18", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1736872508449131000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 10:15:22 AM", + "alertInfo_dvEventId": "01H668QFMWS1BRZA6EAHDVWFN0_51", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 10:15:38 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 10:15:38 AM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "mount -t nfs -o vers=3,nolock 10.50.3.251:/ns2/ /root/nfsdir", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "f6d5066df72ae947089cb3762679c54f61d7c97f", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/bin/mount", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "mount", + "sourceParentProcessInfo_pid": 32166, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 10:15:03 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/sbin/mount.nfs 10.50.3.251:/ns2/ /root/nfsdir", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "2894ddd5adc4c4f89d6171feb966ee8db03e3d48", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/sbin/mount.nfs", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "mount.nfs", + "sourceProcessInfo_pid": 32167, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 10:15:03 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 2:00:04 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.19", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.19", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "FEBB12F580778F51", + "sourceParentProcessInfo_uniqueId": "FDBB12F580778F51", + "sourceProcessInfo_storyline": "E0E912F580778F51", + "sourceProcessInfo_uniqueId": "DFE912F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736978424395258000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 1:45:59 PM", + "alertInfo_dvEventId": "01H66MS4AHVPK6ZSZA1W047SMR_278", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 1:46:04 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 1:46:04 PM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\Explorer.EXE", + "sourceParentProcessInfo_fileHashMd5": "357b678c-68d3-d5ee-86e1-b706fbfd994b", + "sourceParentProcessInfo_fileHashSha1": "a4e4e2bc502e4ab249b219da357d1aad163ab175", + "sourceParentProcessInfo_fileHashSha256": "8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "explorer.exe", + "sourceParentProcessInfo_pid": 14472, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:42:20 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\smartscreen.exe -Embedding", + "sourceProcessInfo_fileHashMd5": "8b71524d-b619-2b9a-1967-1156e27b1826", + "sourceProcessInfo_fileHashSha1": "4549fabd13aaf136087a4501682eb2559eaafdbb", + "sourceProcessInfo_fileHashSha256": "83c9bd1ff0dd424a841cd1b22993e09e16d1339501070613236b0d1f8bff92bc", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\smartscreen.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "smartscreen.exe", + "sourceProcessInfo_pid": 14528, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 1:45:28 PM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 2:00:04 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "1.1.1.20", + "alertInfo_dstPort": 23, + "alertInfo_netEventDirection": "OUTGOING", + "alertInfo_srcIp": "2.2.2.20", + "alertInfo_srcPort": 14, + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "70BC12F580778F51", + "sourceParentProcessInfo_uniqueId": "19BF12F580778F51", + "sourceProcessInfo_storyline": "70BC12F580778F51", + "sourceProcessInfo_uniqueId": "42CD12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736978447346490600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/25/2023, 1:45:59 PM", + "alertInfo_dvEventId": "01H66MS4AHVPK6ZSZA1W047SMR_22", + "alertInfo_eventType": "TCPV4", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/25/2023, 1:46:07 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/25/2023, 1:46:07 PM", + "ruleInfo_id": 1733309646016098600, + "ruleInfo_name": "IP Connect & IP List", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"IP Connect\" OR EventType = \"IP Listen", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Users\\Crest\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe /update /restart /updateSource:ODU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix", + "sourceParentProcessInfo_fileHashMd5": "8d5ca829-19d6-6439-685d-dd97dca650c6", + "sourceParentProcessInfo_fileHashSha1": "81c0122bc0adc75ce71912504b8d72825aecad35", + "sourceParentProcessInfo_fileHashSha256": "7dfe00a315c1e6956eb32c9d12fc809998590d15de1820b34b6d9ca7aa109b88", + "sourceParentProcessInfo_filePath": "C:\\Users\\Crest\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "OneDriveSetup.exe", + "sourceParentProcessInfo_pid": 5412, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:46:58 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLO007\\Crest", + "sourceProcessInfo_commandline": "/updateInstalled /background", + "sourceProcessInfo_fileHashMd5": "174826c7-8c0a-a36d-a145-7e711e4c9e80", + "sourceProcessInfo_fileHashSha1": "56ee9857c7a0643d6f6d5e56c3f4689bb1499829", + "sourceProcessInfo_fileHashSha256": "159e208d7211b71b5dad89771bf1fc047de839bcb8e68475f248a051d2ebaa02", + "sourceProcessInfo_filePath": "C:\\Users\\Crest\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT CORPORATION", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "OneDrive.exe", + "sourceProcessInfo_pid": 2204, + "sourceProcessInfo_pidStarttime [UTC]": "7/25/2023, 5:47:11 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "1/1/1970, 12:00:00 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + } + ] \ No newline at end of file diff --git a/Sample Data/ASIM/SentinelOne_ASimProcessEvent_IngestedLogs.csv b/Sample Data/ASIM/SentinelOne_ASimProcessEvent_IngestedLogs.csv new file mode 100644 index 00000000000..3109e1011cc --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimProcessEvent_IngestedLogs.csv @@ -0,0 +1,21 @@ +TenantId,SourceSystem,MG,ManagementGroupName,TimeGenerated [UTC],Computer,RawData,alertInfo_indicatorDescription_s,alertInfo_indicatorName_s,targetProcessInfo_tgtFileOldPath_s,alertInfo_indicatorCategory_s,alertInfo_registryOldValue_g,alertInfo_dstIp_s,alertInfo_dstPort_s,alertInfo_netEventDirection_s,alertInfo_srcIp_s,alertInfo_srcPort_s,containerInfo_id_s,targetProcessInfo_tgtFileId_g,alertInfo_registryOldValue_s,alertInfo_registryOldValueType_s,alertInfo_dnsRequest_s,alertInfo_dnsResponse_s,alertInfo_registryKeyPath_s,alertInfo_registryPath_s,alertInfo_registryValue_g,ruleInfo_description_s,alertInfo_registryValue_s,alertInfo_loginAccountDomain_s,alertInfo_loginAccountSid_s,alertInfo_loginIsAdministratorEquivalent_s,alertInfo_loginIsSuccessful_s,alertInfo_loginType_s,alertInfo_loginsUserName_s,alertInfo_srcMachineIp_s,targetProcessInfo_tgtProcCmdLine_s,targetProcessInfo_tgtProcImagePath_s,targetProcessInfo_tgtProcName_s,targetProcessInfo_tgtProcPid_s,targetProcessInfo_tgtProcSignedStatus_s,targetProcessInfo_tgtProcStorylineId_s,targetProcessInfo_tgtProcUid_s,sourceParentProcessInfo_storyline_g,sourceParentProcessInfo_uniqueId_g,sourceProcessInfo_storyline_g,sourceProcessInfo_uniqueId_g,targetProcessInfo_tgtProcStorylineId_g,targetProcessInfo_tgtProcUid_g,agentDetectionInfo_machineType_s,agentDetectionInfo_name_s,agentDetectionInfo_osFamily_s,agentDetectionInfo_osName_s,agentDetectionInfo_osRevision_s,agentDetectionInfo_uuid_g,agentDetectionInfo_version_s,agentRealtimeInfo_id_s,agentRealtimeInfo_infected_b,agentRealtimeInfo_isActive_b,agentRealtimeInfo_isDecommissioned_b,agentRealtimeInfo_machineType_s,agentRealtimeInfo_name_s,agentRealtimeInfo_os_s,agentRealtimeInfo_uuid_g,alertInfo_alertId_s,alertInfo_analystVerdict_s,alertInfo_createdAt_t [UTC],alertInfo_dvEventId_s,alertInfo_eventType_s,alertInfo_hitType_s,alertInfo_incidentStatus_s,alertInfo_isEdr_b,alertInfo_reportedAt_t [UTC],alertInfo_source_s,alertInfo_updatedAt_t [UTC],ruleInfo_id_s,ruleInfo_name_s,ruleInfo_queryLang_s,ruleInfo_queryType_s,ruleInfo_s1ql_s,ruleInfo_scopeLevel_s,ruleInfo_severity_s,ruleInfo_treatAsThreat_s,sourceParentProcessInfo_commandline_s,sourceParentProcessInfo_fileHashMd5_g,sourceParentProcessInfo_fileHashSha1_s,sourceParentProcessInfo_fileHashSha256_s,sourceParentProcessInfo_filePath_s,sourceParentProcessInfo_fileSignerIdentity_s,sourceParentProcessInfo_integrityLevel_s,sourceParentProcessInfo_name_s,sourceParentProcessInfo_pid_s,sourceParentProcessInfo_pidStarttime_t [UTC],sourceParentProcessInfo_storyline_s,sourceParentProcessInfo_subsystem_s,sourceParentProcessInfo_uniqueId_s,sourceParentProcessInfo_user_s,sourceProcessInfo_commandline_s,sourceProcessInfo_fileHashMd5_g,sourceProcessInfo_fileHashSha1_s,sourceProcessInfo_fileHashSha256_s,sourceProcessInfo_filePath_s,sourceProcessInfo_fileSignerIdentity_s,sourceProcessInfo_integrityLevel_s,sourceProcessInfo_name_s,sourceProcessInfo_pid_s,sourceProcessInfo_pidStarttime_t [UTC],sourceProcessInfo_storyline_s,sourceProcessInfo_subsystem_s,sourceProcessInfo_uniqueId_s,sourceProcessInfo_user_s,targetProcessInfo_tgtFileCreatedAt_t [UTC],targetProcessInfo_tgtFileHashSha1_s,targetProcessInfo_tgtFileHashSha256_s,targetProcessInfo_tgtFileId_s,targetProcessInfo_tgtFileIsSigned_s,targetProcessInfo_tgtFileModifiedAt_t [UTC],targetProcessInfo_tgtFilePath_s,targetProcessInfo_tgtProcIntegrityLevel_s,targetProcessInfo_tgtProcessStartTime_t [UTC],agentUpdatedVersion_s,agentId_s,hash_s,osFamily_s,threatId_s,creator_s,creatorId_s,inherits_b,isDefault_b,name_s,registrationToken_s,totalAgents_d,type_s,agentDetectionInfo_accountId_s,agentDetectionInfo_accountName_s,agentDetectionInfo_agentDetectionState_s,agentDetectionInfo_agentDomain_s,agentDetectionInfo_agentIpV4_s,agentDetectionInfo_agentIpV6_s,agentDetectionInfo_agentLastLoggedInUserName_s,agentDetectionInfo_agentMitigationMode_s,agentDetectionInfo_agentOsName_s,agentDetectionInfo_agentOsRevision_s,agentDetectionInfo_agentRegisteredAt_t [UTC],agentDetectionInfo_agentUuid_g,agentDetectionInfo_agentVersion_s,agentDetectionInfo_externalIp_s,agentDetectionInfo_groupId_s,agentDetectionInfo_groupName_s,agentDetectionInfo_siteId_s,agentDetectionInfo_siteName_s,agentRealtimeInfo_accountId_s,agentRealtimeInfo_accountName_s,agentRealtimeInfo_activeThreats_d,agentRealtimeInfo_agentComputerName_s,agentRealtimeInfo_agentDomain_s,agentRealtimeInfo_agentId_s,agentRealtimeInfo_agentInfected_b,agentRealtimeInfo_agentIsActive_b,agentRealtimeInfo_agentIsDecommissioned_b,agentRealtimeInfo_agentMachineType_s,agentRealtimeInfo_agentMitigationMode_s,agentRealtimeInfo_agentNetworkStatus_s,agentRealtimeInfo_agentOsName_s,agentRealtimeInfo_agentOsRevision_s,agentRealtimeInfo_agentOsType_s,agentRealtimeInfo_agentUuid_g,agentRealtimeInfo_agentVersion_s,agentRealtimeInfo_groupId_s,agentRealtimeInfo_groupName_s,agentRealtimeInfo_networkInterfaces_s,agentRealtimeInfo_operationalState_s,agentRealtimeInfo_rebootRequired_b,agentRealtimeInfo_scanFinishedAt_t [UTC],agentRealtimeInfo_scanStartedAt_t [UTC],agentRealtimeInfo_scanStatus_s,agentRealtimeInfo_siteId_s,agentRealtimeInfo_siteName_s,agentRealtimeInfo_userActionsNeeded_s,indicators_s,mitigationStatus_s,threatInfo_analystVerdict_s,threatInfo_analystVerdictDescription_s,threatInfo_automaticallyResolved_b,threatInfo_certificateId_s,threatInfo_classification_s,threatInfo_classificationSource_s,threatInfo_cloudFilesHashVerdict_s,threatInfo_collectionId_s,threatInfo_confidenceLevel_s,threatInfo_createdAt_t [UTC],threatInfo_detectionEngines_s,threatInfo_detectionType_s,threatInfo_engines_s,threatInfo_externalTicketExists_b,threatInfo_failedActions_b,threatInfo_fileExtension_s,threatInfo_fileExtensionType_s,threatInfo_filePath_s,threatInfo_fileSize_d,threatInfo_fileVerificationType_s,threatInfo_identifiedAt_t [UTC],threatInfo_incidentStatus_s,threatInfo_incidentStatusDescription_s,threatInfo_initiatedBy_s,threatInfo_initiatedByDescription_s,threatInfo_isFileless_b,threatInfo_isValidCertificate_b,threatInfo_mitigatedPreemptively_b,threatInfo_mitigationStatus_s,threatInfo_mitigationStatusDescription_s,threatInfo_originatorProcess_s,threatInfo_pendingActions_b,threatInfo_processUser_s,threatInfo_publisherName_s,threatInfo_reachedEventsLimit_b,threatInfo_rebootRequired_b,threatInfo_sha1_s,threatInfo_storyline_s,threatInfo_threatId_s,threatInfo_threatName_s,threatInfo_updatedAt_t [UTC],whiteningOptions_s,threatInfo_maliciousProcessArguments_s,threatInfo_fileExtension_g,threatInfo_threatName_g,threatInfo_storyline_g,accountId_s,accountName_s,activityType_d,activityUuid_g,createdAt_t [UTC],id_s,primaryDescription_s,secondaryDescription_s,siteId_s,siteName_s,updatedAt_t [UTC],userId_s,event_name_s,DataFields_s,description_s,comments_s,activeDirectory_computerMemberOf_s,activeDirectory_lastUserMemberOf_s,activeThreats_d,agentVersion_s,allowRemoteShell_b,appsVulnerabilityStatus_s,computerName_s,consoleMigrationStatus_s,coreCount_d,cpuCount_d,cpuId_s,detectionState_s,domain_s,encryptedApplications_b,externalId_s,externalIp_s,firewallEnabled_b,firstFullModeTime_t [UTC],fullDiskScanLastUpdatedAt_t [UTC],groupId_s,groupIp_s,groupName_s,inRemoteShellSession_b,infected_b,installerType_s,isActive_b,isDecommissioned_b,isPendingUninstall_b,isUninstalled_b,isUpToDate_b,lastActiveDate_t [UTC],lastIpToMgmt_s,lastLoggedInUserName_s,licenseKey_s,locationEnabled_b,locationType_s,locations_s,machineType_s,mitigationMode_s,mitigationModeSuspicious_s,modelName_s,networkInterfaces_s,networkQuarantineEnabled_b,networkStatus_s,operationalState_s,osArch_s,osName_s,osRevision_s,osStartTime_t [UTC],osType_s,rangerStatus_s,rangerVersion_s,registeredAt_t [UTC],remoteProfilingState_s,scanFinishedAt_t [UTC],scanStartedAt_t [UTC],scanStatus_s,serialNumber_s,showAlertIcon_b,tags_sentinelone_s,threatRebootRequired_b,totalMemory_d,userActionsNeeded_s,uuid_g,osUsername_s,scanAbortedAt_t [UTC],activeDirectory_computerDistinguishedName_s,activeDirectory_lastUserDistinguishedName_s,Type,_ResourceId +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:10:09 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,/usr/sbin/sendmail.postfix,sendmail.postfix,44031,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,727f2aac-c251-14b8-04a2-5518c8c26679,727f2aad-3209-c937-7a56-8e04d9b72a60,73fb37d5-cf36-ab66-cc74-edb26cd47d93,727f2aad-3209-c937-7a56-8e04d9b72a60,73fb41c2-2d0e-fbde-7534-9b3fb198f4a0,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73314876567948E+018,Undefined,"7/20/2023, 6:57:02 AM",01H5S1B1DE1FQ1GQAM9BXQ29RT_3,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 6:57:13 AM",STAR,"7/20/2023, 6:57:13 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,889,"7/18/2023, 8:56:05 AM",,unknown,,, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44027,"7/20/2023, 6:55:01 AM",,unknown,,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 6:55:01 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:10:09 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/postdrop -r,/usr/sbin/postdrop,postdrop,44032,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,73fb37d5-cf36-ab66-cc74-edb26cd47d93,727f2aad-3209-c937-7a56-8e04d9b72a60,73fb41c2-2d0e-fbde-7534-9b3fb198f4a0,727f2aad-3209-c937-7a56-8e04d9b72a60,73fb420c-d665-d3f6-59dd-0a5d1d0e71f2,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73314877050293E+018,Undefined,"7/20/2023, 6:57:02 AM",01H5S1B1DE1FQ1GQAM9BXQ29RT_4,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 6:57:14 AM",STAR,"7/20/2023, 6:57:14 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44027,"7/20/2023, 6:55:01 AM",,unknown,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,,090f9f343c64158f5590276eade3bc120ca19b1a,,/usr/sbin/sendmail.postfix,,unknown,sendmail.postfix,44031,"7/20/2023, 6:55:01 AM",,unknown,,,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 6:55:01 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:10:09 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,/usr/sbin/sendmail.postfix,sendmail.postfix,44042,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,727f2aac-c251-14b8-04a2-5518c8c26679,727f2aad-3209-c937-7a56-8e04d9b72a60,730930f9-359e-ed7b-6a03-319b08f7fe76,727f2aad-3209-c937-7a56-8e04d9b72a60,73093e27-8ead-6ead-9311-613babbbf6ce,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73314892440035E+018,Undefined,"7/20/2023, 6:57:20 AM",01H5S1CW09T3Y9PJPD6M1BR9W6_3,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 6:57:32 AM",STAR,"7/20/2023, 6:57:32 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,889,"7/18/2023, 8:56:05 AM",,unknown,,, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44038,"7/20/2023, 6:56:01 AM",,unknown,,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 6:56:02 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:10:09 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/postdrop -r,/usr/sbin/postdrop,postdrop,44043,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,730930f9-359e-ed7b-6a03-319b08f7fe76,727f2aad-3209-c937-7a56-8e04d9b72a60,73093e27-8ead-6ead-9311-613babbbf6ce,727f2aad-3209-c937-7a56-8e04d9b72a60,73093eac-5267-0e8d-984e-89194dce2324,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73314892575091E+018,Undefined,"7/20/2023, 6:57:20 AM",01H5S1CW09T3Y9PJPD6M1BR9W6_4,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 6:57:32 AM",STAR,"7/20/2023, 6:57:32 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44038,"7/20/2023, 6:56:01 AM",,unknown,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,,090f9f343c64158f5590276eade3bc120ca19b1a,,/usr/sbin/sendmail.postfix,,unknown,sendmail.postfix,44042,"7/20/2023, 6:56:02 AM",,unknown,,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 6:56:02 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:10:09 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,/usr/sbin/sendmail.postfix,sendmail.postfix,44054,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,727f2aac-c251-14b8-04a2-5518c8c26679,727f2aad-3209-c937-7a56-8e04d9b72a60,73175795-3d2f-91c7-bdb1-9a00c3b4e6f9,727f2aad-3209-c937-7a56-8e04d9b72a60,7317600a-da57-51e1-f547-19c0f33270a9,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73314931664331E+018,Undefined,"7/20/2023, 6:58:08 AM",01H5S1EPKA5T8SG6SJ2PFAKNQF_3,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 6:58:19 AM",STAR,"7/20/2023, 6:58:19 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,889,"7/18/2023, 8:56:05 AM",,unknown,,, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44050,"7/20/2023, 6:57:02 AM",,unknown,,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 6:57:02 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:10:09 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/postdrop -r,/usr/sbin/postdrop,postdrop,44055,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,73175795-3d2f-91c7-bdb1-9a00c3b4e6f9,727f2aad-3209-c937-7a56-8e04d9b72a60,7317600a-da57-51e1-f547-19c0f33270a9,727f2aad-3209-c937-7a56-8e04d9b72a60,731760e0-a8a1-0e25-fb68-c809b79a0fcd,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73314934621315E+018,Undefined,"7/20/2023, 6:58:08 AM",01H5S1EPKA5T8SG6SJ2PFAKNQF_4,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 6:58:22 AM",STAR,"7/20/2023, 6:58:22 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44050,"7/20/2023, 6:57:02 AM",,unknown,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,,090f9f343c64158f5590276eade3bc120ca19b1a,,/usr/sbin/sendmail.postfix,,unknown,sendmail.postfix,44054,"7/20/2023, 6:57:02 AM",,unknown,,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 6:57:02 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:10:09 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,/usr/sbin/sendmail.postfix,sendmail.postfix,44065,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,727f2aac-c251-14b8-04a2-5518c8c26679,727f2aad-3209-c937-7a56-8e04d9b72a60,73252052-1f72-a515-eb0b-f5620305688a,727f2aad-3209-c937-7a56-8e04d9b72a60,73252e29-0db9-6ca2-c3de-049bfeac30ff,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73314984687888E+018,Undefined,"7/20/2023, 6:59:07 AM",01H5S1GH6B620AGDRX5MF9M52M_3,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 6:59:22 AM",STAR,"7/20/2023, 6:59:22 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,889,"7/18/2023, 8:56:05 AM",,unknown,,, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44061,"7/20/2023, 6:58:01 AM",,unknown,,,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 6:58:01 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:10:09 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/postdrop -r,/usr/sbin/postdrop,postdrop,44066,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,73252052-1f72-a515-eb0b-f5620305688a,727f2aad-3209-c937-7a56-8e04d9b72a60,73252e29-0db9-6ca2-c3de-049bfeac30ff,727f2aad-3209-c937-7a56-8e04d9b72a60,73252ed6-aff1-c3f8-48c2-765f7b668d7c,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73314988576008E+018,Undefined,"7/20/2023, 6:59:07 AM",01H5S1GH6B620AGDRX5MF9M52M_4,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 6:59:27 AM",STAR,"7/20/2023, 6:59:27 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44061,"7/20/2023, 6:58:01 AM",,unknown,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,,090f9f343c64158f5590276eade3bc120ca19b1a,,/usr/sbin/sendmail.postfix,,unknown,sendmail.postfix,44065,"7/20/2023, 6:58:01 AM",,unknown,,CLW547-\Crest,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 6:58:01 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:20:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /bin/sh -c /usr/local/demisto/d1_Test2/upgrade_engine.sh >> /tmp/d1_Test2/demisto_install.log,/usr/bin/bash,bash,44075,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,727f2aac-c251-14b8-04a2-5518c8c26679,727f2aad-3209-c937-7a56-8e04d9b72a60,7333194b-17ac-0f64-4f1c-59ba42bb7da6,727f2aad-3209-c937-7a56-8e04d9b72a60,733322a5-11bb-42e8-c701-7a97051c8a5b,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.7331502833382E+018,Undefined,"7/20/2023, 7:00:06 AM",01H5S1JBSA1YTHPHEXZY2S2G0T_2,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 7:00:14 AM",STAR,"7/20/2023, 7:00:14 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,889,"7/18/2023, 8:56:05 AM",,unknown,,, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44073,"7/20/2023, 6:59:01 AM",,unknown,,CLW547-\Crest,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 6:59:01 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:20:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/postdrop -r,/usr/sbin/postdrop,postdrop,44078,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,7333194b-17ac-0f64-4f1c-59ba42bb7da6,727f2aad-3209-c937-7a56-8e04d9b72a60,733322de-7b5c-6a26-b302-869f3832cbed,727f2aad-3209-c937-7a56-8e04d9b72a60,73332352-8023-8eb1-c3a3-410efe8eeb38,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73315030459493E+018,Undefined,"7/20/2023, 7:00:06 AM",01H5S1JBSA1YTHPHEXZY2S2G0T_4,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 7:00:16 AM",STAR,"7/20/2023, 7:00:16 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44073,"7/20/2023, 6:59:01 AM",,unknown,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,,090f9f343c64158f5590276eade3bc120ca19b1a,,/usr/sbin/sendmail.postfix,,unknown,sendmail.postfix,44077,"7/20/2023, 6:59:01 AM",,unknown,,CLW547-\Crest,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 6:59:01 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:20:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/postdrop -r,/usr/sbin/postdrop,postdrop,44088,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,73411224-c58f-479c-e68d-2bc957ae28d3,727f2aad-3209-c937-7a56-8e04d9b72a60,73414081-5469-2510-07c3-5b74509a4475,727f2aad-3209-c937-7a56-8e04d9b72a60,734140eb-56bf-9270-ae70-d0582e8de351,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73315082138356E+018,Undefined,"7/20/2023, 7:01:07 AM",01H5S1M6C8NJZ7KGNVCFBHK3VP_4,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 7:01:18 AM",STAR,"7/20/2023, 7:01:18 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44083,"7/20/2023, 7:00:01 AM",,unknown,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,,090f9f343c64158f5590276eade3bc120ca19b1a,,/usr/sbin/sendmail.postfix,,unknown,sendmail.postfix,44087,"7/20/2023, 7:00:02 AM",,unknown,,CLW547-\Crest,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 7:00:02 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:20:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,/usr/sbin/sendmail.postfix,sendmail.postfix,44087,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,727f2aac-c251-14b8-04a2-5518c8c26679,727f2aad-3209-c937-7a56-8e04d9b72a60,73411224-c58f-479c-e68d-2bc957ae28d3,727f2aad-3209-c937-7a56-8e04d9b72a60,73414081-5469-2510-07c3-5b74509a4475,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73315088610168E+018,Undefined,"7/20/2023, 7:01:07 AM",01H5S1M6C8NJZ7KGNVCFBHK3VP_3,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 7:01:26 AM",STAR,"7/20/2023, 7:01:26 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,889,"7/18/2023, 8:56:05 AM",,unknown,,, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44083,"7/20/2023, 7:00:01 AM",,unknown,,,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 7:00:02 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:20:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/unix_chkpwd root chkexpiry,/usr/sbin/unix_chkpwd,unix_chkpwd,44098,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,727f2aac-c251-14b8-04a2-5518c8c26679,727f2aad-3209-c937-7a56-8e04d9b72a60,734f38fd-17b6-7142-0580-c5bd4a6fd003,727f2aad-3209-c937-7a56-8e04d9b72a60,734f3932-0c7f-4e05-bfff-063d6b0c92eb,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73315125441194E+018,Undefined,"7/20/2023, 7:02:07 AM",01H5S1P0Z9027WQRD3PNDF55V0_1,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 7:02:10 AM",STAR,"7/20/2023, 7:02:10 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,889,"7/18/2023, 8:56:05 AM",,unknown,,, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44097,"7/20/2023, 7:01:02 AM",,unknown,,,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 7:01:02 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:20:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/postdrop -r,/usr/sbin/postdrop,postdrop,44102,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,734f38fd-17b6-7142-0580-c5bd4a6fd003,727f2aad-3209-c937-7a56-8e04d9b72a60,734f42ea-ba31-4ac2-1273-59fe44124624,727f2aad-3209-c937-7a56-8e04d9b72a60,734f4380-8299-a345-7dd9-8723e4b66bec,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73315131501125E+018,Undefined,"7/20/2023, 7:02:07 AM",01H5S1P0Z9027WQRD3PNDF55V0_4,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 7:02:17 AM",STAR,"7/20/2023, 7:02:17 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44097,"7/20/2023, 7:01:02 AM",,unknown,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,,090f9f343c64158f5590276eade3bc120ca19b1a,,/usr/sbin/sendmail.postfix,,unknown,sendmail.postfix,44101,"7/20/2023, 7:01:02 AM",,unknown,,NT AUTHORITY\NETWORK SERVICE,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 7:01:02 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:20:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /bin/sh -c /usr/local/demisto/d1_Test2/upgrade_engine.sh >> /tmp/d1_Test2/demisto_install.log,/usr/bin/bash,bash,44109,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,727f2aac-c251-14b8-04a2-5518c8c26679,727f2aad-3209-c937-7a56-8e04d9b72a60,735d01e8-402b-affb-12de-4741599ea560,727f2aad-3209-c937-7a56-8e04d9b72a60,735d0a85-074c-1c9d-7ba8-49901518524b,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73315179676905E+018,Undefined,"7/20/2023, 7:03:07 AM",01H5S1QVJCZMW7ZPZR8JGBQBND_2,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 7:03:14 AM",STAR,"7/20/2023, 7:03:14 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,889,"7/18/2023, 8:56:05 AM",,unknown,,, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44107,"7/20/2023, 7:02:01 AM",,unknown,,NT AUTHORITY\NETWORK SERVICE,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 7:02:01 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:20:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/postdrop -r,/usr/sbin/postdrop,postdrop,44112,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,735d01e8-402b-affb-12de-4741599ea560,727f2aad-3209-c937-7a56-8e04d9b72a60,735d0a9e-eef8-6094-bc77-c95b9a8c2b34,727f2aad-3209-c937-7a56-8e04d9b72a60,735d0b74-844c-af22-aa4a-433abde9c7a9,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73315181789996E+018,Undefined,"7/20/2023, 7:03:07 AM",01H5S1QVJCZMW7ZPZR8JGBQBND_4,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 7:03:17 AM",STAR,"7/20/2023, 7:03:17 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44107,"7/20/2023, 7:02:01 AM",,unknown,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,,090f9f343c64158f5590276eade3bc120ca19b1a,,/usr/sbin/sendmail.postfix,,unknown,sendmail.postfix,44111,"7/20/2023, 7:02:01 AM",,unknown,,,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 7:02:01 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:20:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/postdrop -r,/usr/sbin/postdrop,postdrop,44124,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,736afa1a-7181-0a1c-b160-6d7da000a15d,727f2aad-3209-c937-7a56-8e04d9b72a60,736b0393-0386-ba70-5da1-2c09cf3433f6,727f2aad-3209-c937-7a56-8e04d9b72a60,736b0422-db47-f377-3d29-85f017d9f67f,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73315233598044E+018,Undefined,"7/20/2023, 7:04:07 AM",01H5S1SP59R24VZ5C4YRRQVRH7_4,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 7:04:19 AM",STAR,"7/20/2023, 7:04:19 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44119,"7/20/2023, 7:03:01 AM",,unknown,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,,090f9f343c64158f5590276eade3bc120ca19b1a,,/usr/sbin/sendmail.postfix,,unknown,sendmail.postfix,44123,"7/20/2023, 7:03:01 AM",,unknown,,NT AUTHORITY\LOCAL SERVICE,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 7:03:01 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:20:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/unix_chkpwd root chkexpiry,/usr/sbin/unix_chkpwd,unix_chkpwd,44120,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,727f2aac-c251-14b8-04a2-5518c8c26679,727f2aad-3209-c937-7a56-8e04d9b72a60,736afa1a-7181-0a1c-b160-6d7da000a15d,727f2aad-3209-c937-7a56-8e04d9b72a60,736afa63-ed30-cc33-824b-b8dadff8a989,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73315233951204E+018,Undefined,"7/20/2023, 7:04:07 AM",01H5S1SP59R24VZ5C4YRRQVRH7_1,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 7:04:19 AM",STAR,"7/20/2023, 7:04:19 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,889,"7/18/2023, 8:56:05 AM",,unknown,,, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44119,"7/20/2023, 7:03:01 AM",,unknown,,NT AUTHORITY\LOCAL SERVICE,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 7:03:01 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:20:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /bin/sh -c /usr/local/demisto/d1_Test2/upgrade_engine.sh >> /tmp/d1_Test2/demisto_install.log,/usr/bin/bash,bash,44132,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,727f2aac-c251-14b8-04a2-5518c8c26679,727f2aad-3209-c937-7a56-8e04d9b72a60,7378f36b-3f84-3586-8482-9d904ea960df,727f2aad-3209-c937-7a56-8e04d9b72a60,73792846-4f61-1bc2-4505-aa7291b30f42,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73315287234808E+018,Undefined,"7/20/2023, 7:05:07 AM",01H5S1VGR81T56G4ZCKR5V7N29_2,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 7:05:23 AM",STAR,"7/20/2023, 7:05:23 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,889,"7/18/2023, 8:56:05 AM",,unknown,,, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44130,"7/20/2023, 7:04:02 AM",,unknown,,,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 7:04:02 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 7:20:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, /usr/sbin/postdrop -r,/usr/sbin/postdrop,postdrop,44135,unsigned,,,727f2aad-3209-c937-7a56-8e04d9b72a60,7378f36b-3f84-3586-8482-9d904ea960df,727f2aad-3209-c937-7a56-8e04d9b72a60,73792885-f06d-ebe3-9fd2-16c6bbeeb4f6,727f2aad-3209-c937-7a56-8e04d9b72a60,73792a93-b3f1-a4a6-2706-a764c17d214e,server,cent7,linux,Linux,CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64,6a01777a-1992-45e9-ae8c-5dcfd4475f87,23.1.2.9,1.71305969317274E+018,FALSE,TRUE,FALSE,server,cent7,linux,6a01777a-1992-45e9-ae8c-5dcfd4475f87,1.73315288498133E+018,Undefined,"7/20/2023, 7:05:07 AM",01H5S1VGR81T56G4ZCKR5V7N29_4,PROCESSCREATION,Events,Unresolved,TRUE,"7/20/2023, 7:05:24 AM",STAR,"7/20/2023, 7:05:24 AM",1.73312906445266E+018,Process Creation Test,1,events,"EventType = ""Process Creation""",site,Low,UNDEFINED, /usr/sbin/crond -n,,1c79e793d46d7867699807a3657a2b909f2071f9,,/usr/sbin/crond,,unknown,crond,44130,"7/20/2023, 7:04:02 AM",,unknown,,, /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root,,090f9f343c64158f5590276eade3bc120ca19b1a,,/usr/sbin/sendmail.postfix,,unknown,sendmail.postfix,44134,"7/20/2023, 7:04:02 AM",,unknown,,,"1/1/1970, 12:00:00 AM",,,,unsigned,"1/1/1970, 12:00:00 AM",,unknown,"7/20/2023, 7:04:02 AM",,,,,,,,,,,,,,1.71250023793415E+018,,,,,,,,,,,,,,,,1.71250024242206E+018,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, diff --git a/Sample Data/ASIM/SentinelOne_ASimProcessEvent_RawLogs.json b/Sample Data/ASIM/SentinelOne_ASimProcessEvent_RawLogs.json new file mode 100644 index 00000000000..2e40b94007c --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimProcessEvent_RawLogs.json @@ -0,0 +1,6042 @@ +[ + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:10:09 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "0f81ec00-9e52-48e6-b899-eb3bbeede741", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "FB4511F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "78d7744d-2837-40d2-aff4-bede5877836e", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/sendmail.postfix", + "targetProcessInfo_tgtProcName": "sendmail.postfix", + "targetProcessInfo_tgtProcPid": 44031, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "73fb41c2-2d0e-fbde-7534-9b3fb198f4a0", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733148765679480300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 6:57:02 AM", + "alertInfo_dvEventId": "01H5S1B1DE1FQ1GQAM9BXQ29RT_3", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 6:57:13 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 6:57:13 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 889, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/18/2023, 8:56:05 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/crond", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "crond", + "sourceProcessInfo_pid": 44027, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:55:01 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 6:55:01 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:10:09 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "AC644457DCBAD901", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/postdrop -r", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/postdrop", + "targetProcessInfo_tgtProcName": "postdrop", + "targetProcessInfo_tgtProcPid": 44032, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "433C0EF580778F52", + "targetProcessInfo_tgtProcUid": "433C0EF580778F53", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "553D0EF580778F51", + "sourceProcessInfo_uniqueId": "543D0EF580778F51", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733148770502930700, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 6:57:02 AM", + "alertInfo_dvEventId": "01H5S1B1DE1FQ1GQAM9BXQ29RT_4", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 6:57:14 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 6:57:14 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 44027, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:55:01 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "090f9f343c64158f5590276eade3bc120ca19b1a", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/sendmail.postfix", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sendmail.postfix", + "sourceProcessInfo_pid": 44031, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:55:01 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 6:55:01 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:10:09 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/sendmail.postfix", + "targetProcessInfo_tgtProcName": "sendmail.postfix", + "targetProcessInfo_tgtProcPid": 44042, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "73093e27-8ead-6ead-9311-613babbbf6ce", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733148924400349000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 6:57:20 AM", + "alertInfo_dvEventId": "01H5S1CW09T3Y9PJPD6M1BR9W6_3", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 6:57:32 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 6:57:32 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 889, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/18/2023, 8:56:05 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/crond", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "crond", + "sourceProcessInfo_pid": 44038, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:56:01 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 6:56:02 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:10:09 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/postdrop -r", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/postdrop", + "targetProcessInfo_tgtProcName": "postdrop", + "targetProcessInfo_tgtProcPid": 44043, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "73093eac-5267-0e8d-984e-89194dce2324", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733148925750914800, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 6:57:20 AM", + "alertInfo_dvEventId": "01H5S1CW09T3Y9PJPD6M1BR9W6_4", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 6:57:32 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 6:57:32 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 44038, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:56:01 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "090f9f343c64158f5590276eade3bc120ca19b1a", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/sendmail.postfix", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sendmail.postfix", + "sourceProcessInfo_pid": 44042, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:56:02 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 6:56:02 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:10:09 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/sendmail.postfix", + "targetProcessInfo_tgtProcName": "sendmail.postfix", + "targetProcessInfo_tgtProcPid": 44054, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "7317600a-da57-51e1-f547-19c0f33270a9", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733149316643306500, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 6:58:08 AM", + "alertInfo_dvEventId": "01H5S1EPKA5T8SG6SJ2PFAKNQF_3", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 6:58:19 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 6:58:19 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 889, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/18/2023, 8:56:05 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/crond", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "crond", + "sourceProcessInfo_pid": 44050, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:57:02 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 6:57:02 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:10:09 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/postdrop -r", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/postdrop", + "targetProcessInfo_tgtProcName": "postdrop", + "targetProcessInfo_tgtProcPid": 44055, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "731760e0-a8a1-0e25-fb68-c809b79a0fcd", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733149346213152000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 6:58:08 AM", + "alertInfo_dvEventId": "01H5S1EPKA5T8SG6SJ2PFAKNQF_4", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 6:58:22 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 6:58:22 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 44050, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:57:02 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "090f9f343c64158f5590276eade3bc120ca19b1a", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/sendmail.postfix", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sendmail.postfix", + "sourceProcessInfo_pid": 44054, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:57:02 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 6:57:02 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:10:09 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/sendmail.postfix", + "targetProcessInfo_tgtProcName": "sendmail.postfix", + "targetProcessInfo_tgtProcPid": 44065, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "73252e29-0db9-6ca2-c3de-049bfeac30ff", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733149846878878500, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 6:59:07 AM", + "alertInfo_dvEventId": "01H5S1GH6B620AGDRX5MF9M52M_3", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 6:59:22 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 6:59:22 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 889, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/18/2023, 8:56:05 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/crond", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "crond", + "sourceProcessInfo_pid": 44061, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:58:01 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 6:58:01 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:10:09 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/postdrop -r", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/postdrop", + "targetProcessInfo_tgtProcName": "postdrop", + "targetProcessInfo_tgtProcPid": 44066, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "73252ed6-aff1-c3f8-48c2-765f7b668d7c", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733149885760081000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 6:59:07 AM", + "alertInfo_dvEventId": "01H5S1GH6B620AGDRX5MF9M52M_4", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 6:59:27 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 6:59:27 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 44061, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:58:01 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "090f9f343c64158f5590276eade3bc120ca19b1a", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/sendmail.postfix", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sendmail.postfix", + "sourceProcessInfo_pid": 44065, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:58:01 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "CLW547-\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 6:58:01 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:20:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/bin/sh -c /usr/local/demisto/d1_Test2/upgrade_engine.sh >> /tmp/d1_Test2/demisto_install.log", + "targetProcessInfo_tgtProcImagePath": "/usr/bin/bash", + "targetProcessInfo_tgtProcName": "bash", + "targetProcessInfo_tgtProcPid": 44075, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "733322a5-11bb-42e8-c701-7a97051c8a5b", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733150283338197000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 7:00:06 AM", + "alertInfo_dvEventId": "01H5S1JBSA1YTHPHEXZY2S2G0T_2", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 7:00:14 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 7:00:14 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 889, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/18/2023, 8:56:05 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/crond", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "crond", + "sourceProcessInfo_pid": 44073, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:59:01 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "CLW547-\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 6:59:01 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:20:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/postdrop -r", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/postdrop", + "targetProcessInfo_tgtProcName": "postdrop", + "targetProcessInfo_tgtProcPid": 44078, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "73332352-8023-8eb1-c3a3-410efe8eeb38", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733150304594931200, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 7:00:06 AM", + "alertInfo_dvEventId": "01H5S1JBSA1YTHPHEXZY2S2G0T_4", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 7:00:16 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 7:00:16 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 44073, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:59:01 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "090f9f343c64158f5590276eade3bc120ca19b1a", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/sendmail.postfix", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sendmail.postfix", + "sourceProcessInfo_pid": 44077, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 6:59:01 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "CLW547-\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 6:59:01 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:20:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/postdrop -r", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/postdrop", + "targetProcessInfo_tgtProcName": "postdrop", + "targetProcessInfo_tgtProcPid": 44088, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "734140eb-56bf-9270-ae70-d0582e8de351", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733150821383560400, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 7:01:07 AM", + "alertInfo_dvEventId": "01H5S1M6C8NJZ7KGNVCFBHK3VP_4", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 7:01:18 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 7:01:18 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 44083, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:00:01 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "090f9f343c64158f5590276eade3bc120ca19b1a", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/sendmail.postfix", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sendmail.postfix", + "sourceProcessInfo_pid": 44087, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:00:02 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "CLW547-\\Crest", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 7:00:02 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:20:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/sendmail.postfix", + "targetProcessInfo_tgtProcName": "sendmail.postfix", + "targetProcessInfo_tgtProcPid": 44087, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "73414081-5469-2510-07c3-5b74509a4475", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733150886101677600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 7:01:07 AM", + "alertInfo_dvEventId": "01H5S1M6C8NJZ7KGNVCFBHK3VP_3", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 7:01:26 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 7:01:26 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 889, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/18/2023, 8:56:05 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/crond", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "crond", + "sourceProcessInfo_pid": 44083, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:00:01 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 7:00:02 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:20:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/unix_chkpwd root chkexpiry", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/unix_chkpwd", + "targetProcessInfo_tgtProcName": "unix_chkpwd", + "targetProcessInfo_tgtProcPid": 44098, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "734f3932-0c7f-4e05-bfff-063d6b0c92eb", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733151254411937800, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 7:02:07 AM", + "alertInfo_dvEventId": "01H5S1P0Z9027WQRD3PNDF55V0_1", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 7:02:10 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 7:02:10 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 889, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/18/2023, 8:56:05 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/crond", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "crond", + "sourceProcessInfo_pid": 44097, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:01:02 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 7:01:02 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:20:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/postdrop -r", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/postdrop", + "targetProcessInfo_tgtProcName": "postdrop", + "targetProcessInfo_tgtProcPid": 44102, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "734f4380-8299-a345-7dd9-8723e4b66bec", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733151315011247400, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 7:02:07 AM", + "alertInfo_dvEventId": "01H5S1P0Z9027WQRD3PNDF55V0_4", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 7:02:17 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 7:02:17 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 44097, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:01:02 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "090f9f343c64158f5590276eade3bc120ca19b1a", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/sendmail.postfix", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sendmail.postfix", + "sourceProcessInfo_pid": 44101, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:01:02 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "NT AUTHORITY\\NETWORK SERVICE", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 7:01:02 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:20:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/bin/sh -c /usr/local/demisto/d1_Test2/upgrade_engine.sh >> /tmp/d1_Test2/demisto_install.log", + "targetProcessInfo_tgtProcImagePath": "/usr/bin/bash", + "targetProcessInfo_tgtProcName": "bash", + "targetProcessInfo_tgtProcPid": 44109, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "735d0a85-074c-1c9d-7ba8-49901518524b", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733151796769051600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 7:03:07 AM", + "alertInfo_dvEventId": "01H5S1QVJCZMW7ZPZR8JGBQBND_2", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 7:03:14 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 7:03:14 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 889, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/18/2023, 8:56:05 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/crond", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "crond", + "sourceProcessInfo_pid": 44107, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:02:01 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "NT AUTHORITY\\NETWORK SERVICE", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 7:02:01 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:20:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/postdrop -r", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/postdrop", + "targetProcessInfo_tgtProcName": "postdrop", + "targetProcessInfo_tgtProcPid": 44112, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "735d0b74-844c-af22-aa4a-433abde9c7a9", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733151817899958000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 7:03:07 AM", + "alertInfo_dvEventId": "01H5S1QVJCZMW7ZPZR8JGBQBND_4", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 7:03:17 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 7:03:17 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 44107, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:02:01 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "090f9f343c64158f5590276eade3bc120ca19b1a", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/sendmail.postfix", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sendmail.postfix", + "sourceProcessInfo_pid": 44111, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:02:01 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 7:02:01 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:20:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/postdrop -r", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/postdrop", + "targetProcessInfo_tgtProcName": "postdrop", + "targetProcessInfo_tgtProcPid": 44124, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "736b0422-db47-f377-3d29-85f017d9f67f", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733152335980435000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 7:04:07 AM", + "alertInfo_dvEventId": "01H5S1SP59R24VZ5C4YRRQVRH7_4", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 7:04:19 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 7:04:19 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 44119, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:03:01 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "090f9f343c64158f5590276eade3bc120ca19b1a", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/sendmail.postfix", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sendmail.postfix", + "sourceProcessInfo_pid": 44123, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:03:01 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "NT AUTHORITY\\LOCAL SERVICE", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 7:03:01 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:20:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/unix_chkpwd root chkexpiry", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/unix_chkpwd", + "targetProcessInfo_tgtProcName": "unix_chkpwd", + "targetProcessInfo_tgtProcPid": 44120, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "736afa63-ed30-cc33-824b-b8dadff8a989", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733152339512039400, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 7:04:07 AM", + "alertInfo_dvEventId": "01H5S1SP59R24VZ5C4YRRQVRH7_1", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 7:04:19 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 7:04:19 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 889, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/18/2023, 8:56:05 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/crond", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "crond", + "sourceProcessInfo_pid": 44119, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:03:01 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "NT AUTHORITY\\LOCAL SERVICE", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 7:03:01 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:20:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/bin/sh -c /usr/local/demisto/d1_Test2/upgrade_engine.sh >> /tmp/d1_Test2/demisto_install.log", + "targetProcessInfo_tgtProcImagePath": "/usr/bin/bash", + "targetProcessInfo_tgtProcName": "bash", + "targetProcessInfo_tgtProcPid": 44132, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "73792846-4f61-1bc2-4505-aa7291b30f42", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733152872348083200, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 7:05:07 AM", + "alertInfo_dvEventId": "01H5S1VGR81T56G4ZCKR5V7N29_2", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 7:05:23 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 7:05:23 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 889, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/18/2023, 8:56:05 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/crond", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "crond", + "sourceProcessInfo_pid": 44130, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:04:02 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 7:04:02 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 7:20:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "/usr/sbin/postdrop -r", + "targetProcessInfo_tgtProcImagePath": "/usr/sbin/postdrop", + "targetProcessInfo_tgtProcName": "postdrop", + "targetProcessInfo_tgtProcPid": 44135, + "targetProcessInfo_tgtProcSignedStatus": "unsigned", + "targetProcessInfo_tgtProcStorylineId": "727f2aad-3209-c937-7a56-8e04d9b72a60", + "targetProcessInfo_tgtProcUid": "73792a93-b3f1-a4a6-2706-a764c17d214e", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "server", + "agentDetectionInfo_name": "cent7", + "agentDetectionInfo_osFamily": "linux", + "agentDetectionInfo_osName": "Linux", + "agentDetectionInfo_osRevision": "CentOS release 7.9.2009 (Core) 3.10.0-1160.92.1.el7.x86_64", + "agentDetectionInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "agentDetectionInfo_version": "23.1.2.9", + "agentRealtimeInfo_id": 1713059693172741400, + "agentRealtimeInfo_infected": "FALSE", + "agentRealtimeInfo_isActive": "TRUE", + "agentRealtimeInfo_isDecommissioned": "FALSE", + "agentRealtimeInfo_machineType": "server", + "agentRealtimeInfo_name": "cent7", + "agentRealtimeInfo_os": "linux", + "agentRealtimeInfo_uuid": "6a01777a-1992-45e9-ae8c-5dcfd4475f87", + "alertInfo_alertId": 1733152884981328000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt [UTC]": "7/20/2023, 7:05:07 AM", + "alertInfo_dvEventId": "01H5S1VGR81T56G4ZCKR5V7N29_4", + "alertInfo_eventType": "PROCESSCREATION", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": "TRUE", + "alertInfo_reportedAt [UTC]": "7/20/2023, 7:05:24 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt [UTC]": "7/20/2023, 7:05:24 AM", + "ruleInfo_id": 1733129064452659700, + "ruleInfo_name": "Process Creation Test", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Process Creation", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "/usr/sbin/crond -n", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "1c79e793d46d7867699807a3657a2b909f2071f9", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "/usr/sbin/crond", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "unknown", + "sourceParentProcessInfo_name": "crond", + "sourceParentProcessInfo_pid": 44130, + "sourceParentProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:04:02 AM", + "sourceParentProcessInfo_subsystem": "unknown", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t -f root", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "090f9f343c64158f5590276eade3bc120ca19b1a", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "/usr/sbin/sendmail.postfix", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "unknown", + "sourceProcessInfo_name": "sendmail.postfix", + "sourceProcessInfo_pid": 44134, + "sourceProcessInfo_pidStarttime [UTC]": "7/20/2023, 7:04:02 AM", + "sourceProcessInfo_subsystem": "unknown", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "unsigned", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "1/1/1970, 12:00:00 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime [UTC]": "7/20/2023, 7:04:02 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt [UTC]": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + } +] \ No newline at end of file diff --git a/Sample Data/ASIM/SentinelOne_ASimRegistryEvent_IngestedLogs.csv b/Sample Data/ASIM/SentinelOne_ASimRegistryEvent_IngestedLogs.csv new file mode 100644 index 00000000000..449f7734ed8 --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimRegistryEvent_IngestedLogs.csv @@ -0,0 +1,21 @@ +TenantId,SourceSystem,MG,ManagementGroupName,TimeGenerated,Computer,RawData,alertInfo_indicatorDescription_s,alertInfo_indicatorName_s,targetProcessInfo_tgtFileOldPath_s,alertInfo_indicatorCategory_s,alertInfo_registryOldValue_g,alertInfo_dstIp_s,alertInfo_dstPort_s,alertInfo_netEventDirection_s,alertInfo_srcIp_s,alertInfo_srcPort_s,containerInfo_id_s,targetProcessInfo_tgtFileId_g,alertInfo_registryOldValue_s,alertInfo_registryOldValueType_s,alertInfo_dnsRequest_s,alertInfo_dnsResponse_s,alertInfo_registryKeyPath_s,alertInfo_registryPath_s,alertInfo_registryValue_g,ruleInfo_description_s,alertInfo_registryValue_s,alertInfo_loginAccountDomain_s,alertInfo_loginAccountSid_s,alertInfo_loginIsAdministratorEquivalent_s,alertInfo_loginIsSuccessful_s,alertInfo_loginType_s,alertInfo_loginsUserName_s,alertInfo_srcMachineIp_s,targetProcessInfo_tgtProcCmdLine_s,targetProcessInfo_tgtProcImagePath_s,targetProcessInfo_tgtProcName_s,targetProcessInfo_tgtProcPid_s,targetProcessInfo_tgtProcSignedStatus_s,targetProcessInfo_tgtProcStorylineId_s,targetProcessInfo_tgtProcUid_s,sourceParentProcessInfo_storyline_g,sourceParentProcessInfo_uniqueId_g,sourceProcessInfo_storyline_g,sourceProcessInfo_uniqueId_g,targetProcessInfo_tgtProcStorylineId_g,targetProcessInfo_tgtProcUid_g,agentDetectionInfo_machineType_s,agentDetectionInfo_name_s,agentDetectionInfo_osFamily_s,agentDetectionInfo_osName_s,agentDetectionInfo_osRevision_s,agentDetectionInfo_uuid_g,agentDetectionInfo_version_s,agentRealtimeInfo_id_s,agentRealtimeInfo_infected_b,agentRealtimeInfo_isActive_b,agentRealtimeInfo_isDecommissioned_b,agentRealtimeInfo_machineType_s,agentRealtimeInfo_name_s,agentRealtimeInfo_os_s,agentRealtimeInfo_uuid_g,alertInfo_alertId_s,alertInfo_analystVerdict_s,alertInfo_createdAt_t,alertInfo_dvEventId_s,alertInfo_eventType_s,alertInfo_hitType_s,alertInfo_incidentStatus_s,alertInfo_isEdr_b,alertInfo_reportedAt_t,alertInfo_source_s,alertInfo_updatedAt_t,ruleInfo_id_s,ruleInfo_name_s,ruleInfo_queryLang_s,ruleInfo_queryType_s,ruleInfo_s1ql_s,ruleInfo_scopeLevel_s,ruleInfo_severity_s,ruleInfo_treatAsThreat_s,sourceParentProcessInfo_commandline_s,sourceParentProcessInfo_fileHashMd5_g,sourceParentProcessInfo_fileHashSha1_s,sourceParentProcessInfo_fileHashSha256_s,sourceParentProcessInfo_filePath_s,sourceParentProcessInfo_fileSignerIdentity_s,sourceParentProcessInfo_integrityLevel_s,sourceParentProcessInfo_name_s,sourceParentProcessInfo_pid_s,sourceParentProcessInfo_pidStarttime_t,sourceParentProcessInfo_storyline_s,sourceParentProcessInfo_subsystem_s,sourceParentProcessInfo_uniqueId_s,sourceParentProcessInfo_user_s,sourceProcessInfo_commandline_s,sourceProcessInfo_fileHashMd5_g,sourceProcessInfo_fileHashSha1_s,sourceProcessInfo_fileHashSha256_s,sourceProcessInfo_filePath_s,sourceProcessInfo_fileSignerIdentity_s,sourceProcessInfo_integrityLevel_s,sourceProcessInfo_name_s,sourceProcessInfo_pid_s,sourceProcessInfo_pidStarttime_t,sourceProcessInfo_storyline_s,sourceProcessInfo_subsystem_s,sourceProcessInfo_uniqueId_s,sourceProcessInfo_user_s,targetProcessInfo_tgtFileCreatedAt_t,targetProcessInfo_tgtFileHashSha1_s,targetProcessInfo_tgtFileHashSha256_s,targetProcessInfo_tgtFileId_s,targetProcessInfo_tgtFileIsSigned_s,targetProcessInfo_tgtFileModifiedAt_t,targetProcessInfo_tgtFilePath_s,targetProcessInfo_tgtProcIntegrityLevel_s,targetProcessInfo_tgtProcessStartTime_t,agentUpdatedVersion_s,agentId_s,hash_s,osFamily_s,threatId_s,creator_s,creatorId_s,inherits_b,isDefault_b,name_s,registrationToken_s,totalAgents_d,type_s,agentDetectionInfo_accountId_s,agentDetectionInfo_accountName_s,agentDetectionInfo_agentDetectionState_s,agentDetectionInfo_agentDomain_s,agentDetectionInfo_agentIpV4_s,agentDetectionInfo_agentIpV6_s,agentDetectionInfo_agentLastLoggedInUserName_s,agentDetectionInfo_agentMitigationMode_s,agentDetectionInfo_agentOsName_s,agentDetectionInfo_agentOsRevision_s,agentDetectionInfo_agentRegisteredAt_t,agentDetectionInfo_agentUuid_g,agentDetectionInfo_agentVersion_s,agentDetectionInfo_externalIp_s,agentDetectionInfo_groupId_s,agentDetectionInfo_groupName_s,agentDetectionInfo_siteId_s,agentDetectionInfo_siteName_s,agentRealtimeInfo_accountId_s,agentRealtimeInfo_accountName_s,agentRealtimeInfo_activeThreats_d,agentRealtimeInfo_agentComputerName_s,agentRealtimeInfo_agentDomain_s,agentRealtimeInfo_agentId_s,agentRealtimeInfo_agentInfected_b,agentRealtimeInfo_agentIsActive_b,agentRealtimeInfo_agentIsDecommissioned_b,agentRealtimeInfo_agentMachineType_s,agentRealtimeInfo_agentMitigationMode_s,agentRealtimeInfo_agentNetworkStatus_s,agentRealtimeInfo_agentOsName_s,agentRealtimeInfo_agentOsRevision_s,agentRealtimeInfo_agentOsType_s,agentRealtimeInfo_agentUuid_g,agentRealtimeInfo_agentVersion_s,agentRealtimeInfo_groupId_s,agentRealtimeInfo_groupName_s,agentRealtimeInfo_networkInterfaces_s,agentRealtimeInfo_operationalState_s,agentRealtimeInfo_rebootRequired_b,agentRealtimeInfo_scanFinishedAt_t,agentRealtimeInfo_scanStartedAt_t,agentRealtimeInfo_scanStatus_s,agentRealtimeInfo_siteId_s,agentRealtimeInfo_siteName_s,agentRealtimeInfo_userActionsNeeded_s,indicators_s,mitigationStatus_s,threatInfo_analystVerdict_s,threatInfo_analystVerdictDescription_s,threatInfo_automaticallyResolved_b,threatInfo_certificateId_s,threatInfo_classification_s,threatInfo_classificationSource_s,threatInfo_cloudFilesHashVerdict_s,threatInfo_collectionId_s,threatInfo_confidenceLevel_s,threatInfo_createdAt_t,threatInfo_detectionEngines_s,threatInfo_detectionType_s,threatInfo_engines_s,threatInfo_externalTicketExists_b,threatInfo_failedActions_b,threatInfo_fileExtension_s,threatInfo_fileExtensionType_s,threatInfo_filePath_s,threatInfo_fileSize_d,threatInfo_fileVerificationType_s,threatInfo_identifiedAt_t,threatInfo_incidentStatus_s,threatInfo_incidentStatusDescription_s,threatInfo_initiatedBy_s,threatInfo_initiatedByDescription_s,threatInfo_isFileless_b,threatInfo_isValidCertificate_b,threatInfo_mitigatedPreemptively_b,threatInfo_mitigationStatus_s,threatInfo_mitigationStatusDescription_s,threatInfo_originatorProcess_s,threatInfo_pendingActions_b,threatInfo_processUser_s,threatInfo_publisherName_s,threatInfo_reachedEventsLimit_b,threatInfo_rebootRequired_b,threatInfo_sha1_s,threatInfo_storyline_s,threatInfo_threatId_s,threatInfo_threatName_s,threatInfo_updatedAt_t,whiteningOptions_s,threatInfo_maliciousProcessArguments_s,threatInfo_fileExtension_g,threatInfo_threatName_g,threatInfo_storyline_g,accountId_s,accountName_s,activityType_d,activityUuid_g,createdAt_t,id_s,primaryDescription_s,secondaryDescription_s,siteId_s,siteName_s,updatedAt_t,userId_s,event_name_s,DataFields_s,description_s,comments_s,activeDirectory_computerMemberOf_s,activeDirectory_lastUserMemberOf_s,activeThreats_d,agentVersion_s,allowRemoteShell_b,appsVulnerabilityStatus_s,computerName_s,consoleMigrationStatus_s,coreCount_d,cpuCount_d,cpuId_s,detectionState_s,domain_s,encryptedApplications_b,externalId_s,externalIp_s,firewallEnabled_b,firstFullModeTime_t,fullDiskScanLastUpdatedAt_t,groupId_s,groupIp_s,groupName_s,inRemoteShellSession_b,infected_b,installerType_s,isActive_b,isDecommissioned_b,isPendingUninstall_b,isUninstalled_b,isUpToDate_b,lastActiveDate_t,lastIpToMgmt_s,lastLoggedInUserName_s,licenseKey_s,locationEnabled_b,locationType_s,locations_s,machineType_s,mitigationMode_s,mitigationModeSuspicious_s,modelName_s,networkInterfaces_s,networkQuarantineEnabled_b,networkStatus_s,operationalState_s,osArch_s,osName_s,osRevision_s,osStartTime_t,osType_s,rangerStatus_s,rangerVersion_s,registeredAt_t,remoteProfilingState_s,scanFinishedAt_t,scanStartedAt_t,scanStatus_s,serialNumber_s,showAlertIcon_b,tags_sentinelone_s,threatRebootRequired_b,totalMemory_d,userActionsNeeded_s,uuid_g,osUsername_s,scanAbortedAt_t,activeDirectory_computerDistinguishedName_s,activeDirectory_lastUserDistinguishedName_s,Type,_ResourceId +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:00:04.211 AM",,,,,,,,,,,,,,,,,,,USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000,USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000,,Registry Modified Alert,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1733809524573085377,Undefined,"7/21/2023, 4:49:54.966 AM",01H5VCGQX8NDGYCZ97EQ7KNBHM_88,REGVALUEDELETE,Events,Unresolved,true,"7/21/2023, 4:50:01.639 AM",STAR,"7/21/2023, 4:50:01.639 AM",1733126240259591279,Registry Modified,1.0,events,"EventType = ""Registry Key Create"" OR EventType = ""Registry Value Create"" OR EventType = ""Registry Key Delete"" OR EventType = ""Registry Key Rename"" OR EventType = ""Registry Key Security Changed"" OR EventType = ""Registry Value Delete"" OR EventType = ""Registry Value Modified"" OR EventType = ""Task Register"" OR EventType = ""Registry Key Export"" OR EventType = ""Registry Key Import"" OR EventType = ""Registry Value Create""",site,Low,UNDEFINED,C:\Windows\System32\WinLogon.exe -SpecialSession,bc97817d-5acf-afc4-ab85-ed9c3c576161,2a142db7d20ea7dd8e63341a7cc4c4035c461e64,51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a,C:\Windows\System32\winlogon.exe,MICROSOFT WINDOWS,system,winlogon.exe,15044,"7/20/2023, 1:42:45.436 PM",DD8512F580778F51,sys_win32,DC8512F580778F51,NT AUTHORITY\SYSTEM,"""LogonUI.exe"" /flags:0x2 /state0:0xa2159855 /state1:0x41c64e6d",b3cc2464-bece-9a99-d8c7-55a7ccbfef52,83acd640edab941976a0326670e6c0a8ab7755dd,b62e62c7374ce1398b985af3122ff10a092750f65191fdc3aa6151de130183a3,C:\Windows\System32\LogonUI.exe,MICROSOFT WINDOWS,system,LogonUI.exe,12572,"7/20/2023, 1:42:45.521 PM",E88512F580778F51,sys_win32,E78512F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:40:03.934 AM",,,,,,,,,,,,,,,,,,,MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\LastLoggedOnProvider,MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\LastLoggedOnProvider,60b78e88-ead8-445c-9cfd-0b87f74ea6cd,,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736756033410194474,Undefined,"7/25/2023, 6:23:59.251 AM",01H65VFT5FJT5WRW54TT0TPT5X_182,REGVALUECREATE,Events,Unresolved,true,"7/25/2023, 6:24:12.864 AM",STAR,"7/25/2023, 6:24:12.864 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLWO007""",account,Medium,UNDEFINED,winlogon.exe,bc97817d-5acf-afc4-ab85-ed9c3c576161,2a142db7d20ea7dd8e63341a7cc4c4035c461e64,51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a,C:\Windows\System32\winlogon.exe,MICROSOFT WINDOWS,system,winlogon.exe,11468,"7/25/2023, 5:42:14.136 AM",DDBA12F580778F51,sys_win32,DCBA12F580778F51,NT AUTHORITY\SYSTEM,"""LogonUI.exe"" /flags:0x0 /state0:0xa1eb2055 /state1:0x41c64e6d",b3cc2464-bece-9a99-d8c7-55a7ccbfef52,83acd640edab941976a0326670e6c0a8ab7755dd,b62e62c7374ce1398b985af3122ff10a092750f65191fdc3aa6151de130183a3,C:\Windows\System32\LogonUI.exe,MICROSOFT WINDOWS,system,LogonUI.exe,288,"7/25/2023, 6:21:57.165 AM",EADA12F580778F51,sys_win32,E9DA12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:40:03.934 AM",,,,,,,,,,,,,,,,,,,MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-19\{849FB467-5283-433A-A697-1106D6DFDCF8}\ProcessCreationTime,MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-19\{849FB467-5283-433A-A697-1106D6DFDCF8}\ProcessCreationTime,,,0x01D9BEC08888128D,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736756056545976543,Undefined,"7/25/2023, 6:23:59.237 AM",01H65VFT5FJT5WRW54TT0TPT5X_94,REGVALUECREATE,Events,Unresolved,true,"7/25/2023, 6:24:15.622 AM",STAR,"7/25/2023, 6:24:15.622 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLWO007""",account,Medium,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:46.739 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,15536,"7/25/2023, 6:23:32.034 AM",F4DA12F580778F51,sys_win32,F3DA12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 2:00:04.318 PM",,,,,,,,,,,,,,,,,,,MACHINE\SYSTEM\ControlSet001\Control\CI\Aggregation\ccbca715cf18ac35db66a1bf785518be709dfe1d32ea9aa0b2f44183b5015f56_78eac555aed3cf37a692d07c943605bfd142b473d9128551ab6272b7edc42bf0,MACHINE\SYSTEM\ControlSet001\Control\CI\Aggregation\ccbca715cf18ac35db66a1bf785518be709dfe1d32ea9aa0b2f44183b5015f56_78eac555aed3cf37a692d07c943605bfd142b473d9128551ab6272b7edc42bf0,,,0x01D9BEFDEF4AE0EF,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736977181371246149,Undefined,"7/25/2023, 1:43:18.485 PM",01H66MM8VMFWW6SBPQ81V9PDKH_70,REGVALUECREATE,Events,Unresolved,true,"7/25/2023, 1:43:35.756 PM",STAR,"7/25/2023, 1:43:35.756 PM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLWO007""",account,Medium,UNDEFINED,C:\Windows\System32\svchost.exe -k utcsvc -p,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,4604,"7/17/2023, 10:22:48.963 AM",553D0EF580778F51,sys_win32,543D0EF580778F51,NT AUTHORITY\SYSTEM,AggregatorHost.exe,83ae8c09-e701-a0d6-9502-531388abb9a2,b6b739386d618672c01743a19a0dabdeb7b07b47,eea98faad130bc115316045cded19f3ae90be91f24161ff4251ce9f4b4e2b82d,C:\Windows\System32\AggregatorHost.exe,MICROSOFT WINDOWS,system,AggregatorHost.exe,5736,"7/17/2023, 10:22:49.711 AM",8E3D0EF580778F51,sys_win32,8D3D0EF580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 2:00:04.318 PM",,,,,,,,,,,,,,,,,,,MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\LastLoggedOnProvider,MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\LastLoggedOnProvider,60b78e88-ead8-445c-9cfd-0b87f74ea6cd,,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736978460432719875,Undefined,"7/25/2023, 1:45:58.677 PM",01H66MS4AHVPK6ZSZA1W047SMR_259,REGVALUECREATE,Events,Unresolved,true,"7/25/2023, 1:46:08.231 PM",STAR,"7/25/2023, 1:46:08.231 PM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLWO007""",account,Medium,UNDEFINED,winlogon.exe,bc97817d-5acf-afc4-ab85-ed9c3c576161,2a142db7d20ea7dd8e63341a7cc4c4035c461e64,51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a,C:\Windows\System32\winlogon.exe,MICROSOFT WINDOWS,system,winlogon.exe,11468,"7/25/2023, 5:42:14.136 AM",DDBA12F580778F51,sys_win32,DCBA12F580778F51,NT AUTHORITY\SYSTEM,"""LogonUI.exe"" /flags:0x0 /state0:0xa13da855 /state1:0x41c64e6d",b3cc2464-bece-9a99-d8c7-55a7ccbfef52,83acd640edab941976a0326670e6c0a8ab7755dd,b62e62c7374ce1398b985af3122ff10a092750f65191fdc3aa6151de130183a3,C:\Windows\System32\LogonUI.exe,MICROSOFT WINDOWS,system,LogonUI.exe,8412,"7/25/2023, 1:44:19.606 PM",A8E912F580778F51,sys_win32,A7E912F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 9:00:03.330 AM",,,,,,,,,,,,,,,,,,,MACHINE\SOFTWARE\Classes\CLSID\{D099E2CC-54BE-4BF6-B1D9-73092B5D139B},MACHINE\SOFTWARE\Classes\CLSID\{D099E2CC-54BE-4BF6-B1D9-73092B5D139B},,Registry Modified Alert,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1733928319128067769,Undefined,"7/21/2023, 8:45:49.258 AM",01H5VT0N41Z3MMMBM9DFA6JF76_17,REGKEYCREATE,Events,Unresolved,true,"7/21/2023, 8:46:03.055 AM",STAR,"7/21/2023, 8:46:03.055 AM",1733126240259591279,Registry Modified,1.0,events,"EventType = ""Registry Key Create"" OR EventType = ""Registry Value Create"" OR EventType = ""Registry Key Delete"" OR EventType = ""Registry Key Rename"" OR EventType = ""Registry Key Security Changed"" OR EventType = ""Registry Value Delete"" OR EventType = ""Registry Value Modified"" OR EventType = ""Task Register"" OR EventType = ""Registry Key Export"" OR EventType = ""Registry Key Import"" OR EventType = ""Registry Value Create""",site,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:46.739 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,17008,"7/21/2023, 8:44:53.471 AM",2E9D12F580778F51,sys_win32,2D9D12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 8:40:04.366 AM",,,,,,,,,,,,,,,,,,,USER\S-1-5-21-3622100493-2250088526-2058887289-1000\System\CurrentControlSet\Control\NetTrace,USER\S-1-5-21-3622100493-2250088526-2058887289-1000\System\CurrentControlSet\Control\NetTrace,,Registry Modified Alert,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1733919264950225665,Undefined,"7/21/2023, 8:27:50.082 AM",01H5VRZP98HJ39M1KMSR9AGTBE_93,REGKEYCREATE,Events,Unresolved,true,"7/21/2023, 8:28:03.713 AM",STAR,"7/21/2023, 8:28:03.713 AM",1733126240259591279,Registry Modified,1.0,events,"EventType = ""Registry Key Create"" OR EventType = ""Registry Value Create"" OR EventType = ""Registry Key Delete"" OR EventType = ""Registry Key Rename"" OR EventType = ""Registry Key Security Changed"" OR EventType = ""Registry Value Delete"" OR EventType = ""Registry Value Modified"" OR EventType = ""Task Register"" OR EventType = ""Registry Key Export"" OR EventType = ""Registry Key Import"" OR EventType = ""Registry Value Create""",site,Low,UNDEFINED,C:\Windows\System32\sdiagnhost.exe -Embedding,114ce4ca-fd4c-1ca9-438b-b548ebda27fc,1583cf30eb074ba1604504f45e492519c5fdddea,b2f5e94881978f898010db4f913e1ad619063ada5768ddd41df235918247d163,C:\Windows\System32\sdiagnhost.exe,MICROSOFT WINDOWS,medium,sdiagnhost.exe,2780,"7/21/2023, 8:27:25.173 AM",2D9A12F580778F51,sys_win32,579A12F580778F51,CLWO007\Crest,"""C:\Windows\system32\netsh.exe"" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter",52b46510-8308-1201-e243-e97ed965b60a,92f2b4e5e5ca66486f4062ab27b8af23d6ad564a,3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44,C:\Windows\System32\netsh.exe,MICROSOFT WINDOWS,medium,netsh.exe,4236,"7/21/2023, 8:27:25.788 AM",2D9A12F580778F51,sys_win32,719A12F580778F51,CLWO007\Crest,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:00:04.211 AM",,,,,,,,,,,,,,,,,,,USER\S-1-5-21-3622100493-2250088526-2058887289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMode,USER\S-1-5-21-3622100493-2250088526-2058887289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMode,,Registry Modified Alert,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1733809553228572378,Undefined,"7/21/2023, 4:49:54.955 AM",01H5VCGQX8NDGYCZ97EQ7KNBHM_2,REGKEYCREATE,Events,Unresolved,true,"7/21/2023, 4:50:05.055 AM",STAR,"7/21/2023, 4:50:05.055 AM",1733126240259591279,Registry Modified,1.0,events,"EventType = ""Registry Key Create"" OR EventType = ""Registry Value Create"" OR EventType = ""Registry Key Delete"" OR EventType = ""Registry Key Rename"" OR EventType = ""Registry Key Security Changed"" OR EventType = ""Registry Value Delete"" OR EventType = ""Registry Value Modified"" OR EventType = ""Task Register"" OR EventType = ""Registry Key Export"" OR EventType = ""Registry Key Import"" OR EventType = ""Registry Value Create""",site,Low,UNDEFINED,C:\Windows\system32\userinit.exe,fc003295-bccc-472c-f80d-e65788f64978,43246106034f0fcbb07ecda6be3635a967bac688,f098ce116049a2024fa282fd62764159f451a9c1cc21a7845d155d439cf52b27,C:\Windows\System32\userinit.exe,MICROSOFT WINDOWS,medium,userinit.exe,10796,"7/21/2023, 4:49:44.429 AM",8C8712F580778F51,sys_win32,8B8712F580778F51,CLWO007\Crest,C:\Windows\Explorer.EXE,357b678c-68d3-d5ee-86e1-b706fbfd994b,a4e4e2bc502e4ab249b219da357d1aad163ab175,8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,5000,"7/21/2023, 4:49:44.522 AM",8F8712F580778F51,sys_win32,8E8712F580778F51,CLWO007\Crest,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 5:00:04.211 AM",,,,,,,,,,,,,,,,,,,USER\S-1-5-21-3622100493-2250088526-2058887289-1000\Control Panel\Desktop\MuiCached,USER\S-1-5-21-3622100493-2250088526-2058887289-1000\Control Panel\Desktop\MuiCached,,Registry Modified Alert,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1733809554604304189,Undefined,"7/21/2023, 4:49:54.924 AM",01H5VCGKX654Z6M4GRY5GYDXEQ_577,REGKEYCREATE,Events,Unresolved,true,"7/21/2023, 4:50:05.219 AM",STAR,"7/21/2023, 4:50:05.219 AM",1733126240259591279,Registry Modified,1.0,events,"EventType = ""Registry Key Create"" OR EventType = ""Registry Value Create"" OR EventType = ""Registry Key Delete"" OR EventType = ""Registry Key Rename"" OR EventType = ""Registry Key Security Changed"" OR EventType = ""Registry Value Delete"" OR EventType = ""Registry Value Modified"" OR EventType = ""Task Register"" OR EventType = ""Registry Key Export"" OR EventType = ""Registry Key Import"" OR EventType = ""Registry Value Create""",site,Low,UNDEFINED,\SystemRoot\System32\smss.exe 00000118 000000c0 C:\Windows\System32\WinLogon.exe -SpecialSession,49ce4a7f-ed5d-271a-0142-6f2bc262d23c,746f5ae87f13a46e88088dea31d1362727b9ec49,b6800c2ca4bfec26c8b8553beee774f4ebab741b1a48adcccce79f07062977be,C:\Windows\System32\smss.exe,MICROSOFT WINDOWS,system,smss.exe,12104,"7/20/2023, 1:42:45.411 PM",D98512F580778F51,sys_win32,D88512F580778F51,NT AUTHORITY\SYSTEM,C:\Windows\System32\WinLogon.exe -SpecialSession,bc97817d-5acf-afc4-ab85-ed9c3c576161,2a142db7d20ea7dd8e63341a7cc4c4035c461e64,51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a,C:\Windows\System32\winlogon.exe,MICROSOFT WINDOWS,system,winlogon.exe,15044,"7/20/2023, 1:42:45.436 PM",DD8512F580778F51,sys_win32,DC8512F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:40:03.934 AM",,,,,,,,,,,,,,,1432,DWORD,,,MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Epoch\Epoch,MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Epoch\Epoch,,,1433,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736756069313438662,Undefined,"7/25/2023, 6:23:59.269 AM",01H65VFT5FJT5WRW54TT0TPT5X_244,REGVALUEMODIFIED,Events,Unresolved,true,"7/25/2023, 6:24:17.144 AM",STAR,"7/25/2023, 6:24:17.144 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLWO007""",account,Medium,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:46.739 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,3468,"7/17/2023, 10:22:48.287 AM",273D0EF580778F51,sys_win32,263D0EF580778F51,NT AUTHORITY\LOCAL SERVICE,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 2:00:04.318 PM",,,,,,,,,,,,,,,76,DWORD,,,MACHINE\SYSTEM\ControlSet001\Services\DisplayEnhancementService\State\LEN40A00_2A_07E0_68\ScreenBrightnessPercent,MACHINE\SYSTEM\ControlSet001\Services\DisplayEnhancementService\State\LEN40A00_2A_07E0_68\ScreenBrightnessPercent,,,53,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736978413867554551,Undefined,"7/25/2023, 1:45:58.637 PM",01H66MS4AHVPK6ZSZA1W047SMR_14,REGVALUEMODIFIED,Events,Unresolved,true,"7/25/2023, 1:46:02.681 PM",STAR,"7/25/2023, 1:46:02.681 PM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLWO007""",account,Medium,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:46.739 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,1864,"7/17/2023, 10:22:47.406 AM",C83C0EF580778F51,sys_win32,C73C0EF580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 2:00:04.318 PM",,,,,,,,,,,,,,,6,DWORD,,,MACHINE\SYSTEM\ControlSet001\Services\LITSSVC\IC\PSC\CurrentSetting,MACHINE\SYSTEM\ControlSet001\Services\LITSSVC\IC\PSC\CurrentSetting,,,2,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736978490463938635,Undefined,"7/25/2023, 1:45:58.637 PM",01H66MS4AHVPK6ZSZA1W047SMR_13,REGVALUEMODIFIED,Events,Unresolved,true,"7/25/2023, 1:46:11.812 PM",STAR,"7/25/2023, 1:46:11.812 PM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLWO007""",account,Medium,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:46.739 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,"""C:\Windows\System32\LITSSvc.exe""",a24ce5c0-eb03-a693-f911-3a756b7ccf56,3c1b6a9c6c3a632851c16d8491abedf44d91d98c,457f7a1b89c4714970183b83c23c18758008b36cb634d9c514191adb793480f7,C:\Windows\System32\LITSSvc.exe,LENOVO,system,LITSSvc.exe,2412,"7/17/2023, 10:22:47.555 AM",F53C0EF580778F51,sys_win32,F43C0EF580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 6:20:04.306 AM",,,,,,,,,,,,,,,128,DWORD,,,MACHINE\SYSTEM\ControlSet001\Services\IBMPMSVC\Parameters2\Type20\Notification\Type22,MACHINE\SYSTEM\ControlSet001\Services\IBMPMSVC\Parameters2\Type20\Notification\Type22,,,0,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736745544310931663,Undefined,"7/25/2023, 6:03:12.137 AM",01H65T9DBHC9TC5YD2TC4279XG_17,REGVALUEMODIFIED,Events,Unresolved,true,"7/25/2023, 6:03:22.466 AM",STAR,"7/25/2023, 6:03:22.466 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLWO007""",account,Medium,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:46.739 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,"""C:\Windows\System32\DriverStore\FileRepository\ibmpmdrv.inf_amd64_02d728b29c6492d3\x64\ibmpmsvc.exe""",131233a4-aed6-a5d7-5baa-73d2ea29dd95,ce235043f17f02aeffe8fcb87d38492ced932a05,75b12d3461cadf6defe081347443692e2fa1b1dc440cee5effb4947a3fba0d46,C:\Windows\System32\DriverStore\FileRepository\ibmpmdrv.inf_amd64_02d728b29c6492d3\x64\ibmpmsvc.exe,LENOVO,system,ibmpmsvc.exe,2404,"7/17/2023, 10:22:47.555 AM",F13C0EF580778F51,sys_win32,F03C0EF580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 1:30:03.345 PM",,,,,,,,,,,,,,,,,,,MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\LastLoggedOnProvider,MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\LastLoggedOnProvider,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1736965156242159292,Undefined,"7/25/2023, 1:19:27.618 PM",01H66K83G1KZT95CZAKY7VXX3T_6,REGVALUEDELETE,Events,Unresolved,true,"7/25/2023, 1:19:42.249 PM",STAR,"7/25/2023, 1:19:42.249 PM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLWO007""",account,Medium,UNDEFINED,winlogon.exe,bc97817d-5acf-afc4-ab85-ed9c3c576161,2a142db7d20ea7dd8e63341a7cc4c4035c461e64,51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a,C:\Windows\System32\winlogon.exe,MICROSOFT WINDOWS,system,winlogon.exe,11468,"7/25/2023, 5:42:14.136 AM",DDBA12F580778F51,sys_win32,DCBA12F580778F51,NT AUTHORITY\SYSTEM,"""LogonUI.exe"" /flags:0x0 /state0:0xa1e1e055 /state1:0x41c64e6d",b3cc2464-bece-9a99-d8c7-55a7ccbfef52,83acd640edab941976a0326670e6c0a8ab7755dd,b62e62c7374ce1398b985af3122ff10a092750f65191fdc3aa6151de130183a3,C:\Windows\System32\LogonUI.exe,MICROSOFT WINDOWS,system,LogonUI.exe,14776,"7/25/2023, 6:36:59.465 AM",8DDB12F580778F51,sys_win32,8CDB12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/26/2023, 5:10:04.255 AM",,,,,,,,,,,,,,,,,,,MACHINE\SYSTEM\ControlSet001\Control\Class\{ce5939ae-ebde-11d0-b181-0000f8753ec4}\LowerFilters,MACHINE\SYSTEM\ControlSet001\Control\Class\{ce5939ae-ebde-11d0-b181-0000f8753ec4}\LowerFilters,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,true,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1737434976838411407,Undefined,"7/26/2023, 4:52:56.749 AM",01H688NVMGGD1RB6YEGZ05DW3B_90,REGVALUEDELETE,Events,Unresolved,true,"7/26/2023, 4:53:09.227 AM",STAR,"7/26/2023, 4:53:09.227 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLWO007""",account,Medium,UNDEFINED,"C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding",357b678c-68d3-d5ee-86e1-b706fbfd994b,a4e4e2bc502e4ab249b219da357d1aad163ab175,8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,3752,"7/26/2023, 4:51:18.156 AM",240814F580778F51,sys_win32,230814F580778F51,CLWO007\Crest,C:\Windows\System32\MsiExec.exe -Embedding 4C754603A3163416FCCAF5EE73FB156F E Global\MSI0000,302be4b7-434e-6797-6902-9c8570825cc0,f3d7fee4ced78e37f49ce4e38ac681f07bca6ae0,5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1,C:\Windows\System32\msiexec.exe,MICROSOFT WINDOWS,system,msiexec.exe,3628,"7/26/2023, 4:52:44.193 AM",960814F580778F51,sys_win32,950814F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/26/2023, 5:10:04.255 AM",,,,,,,,,,,,,,,,,,,MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sentinel Agent,MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sentinel Agent,,,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,true,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1737436654199444088,Undefined,"7/26/2023, 4:56:13.464 AM",01H688VX35HEE63RCZGXE2VWQE_70,REGVALUEDELETE,Events,Unresolved,true,"7/26/2023, 4:56:29.184 AM",STAR,"7/26/2023, 4:56:29.184 AM",1736743171400115521,CWL547,1.0,events,"EndpointName = ""CLWO007""",account,Medium,UNDEFINED,"C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding",357b678c-68d3-d5ee-86e1-b706fbfd994b,a4e4e2bc502e4ab249b219da357d1aad163ab175,8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b,C:\Windows\explorer.exe,MICROSOFT WINDOWS,medium,explorer.exe,3752,"7/26/2023, 4:51:18.156 AM",240814F580778F51,sys_win32,230814F580778F51,CLWO007\Crest,C:\Windows\System32\MsiExec.exe -Embedding BFA5DB129DF20220C00F97E73D052F54 E Global\MSI0000,302be4b7-434e-6797-6902-9c8570825cc0,f3d7fee4ced78e37f49ce4e38ac681f07bca6ae0,5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1,C:\Windows\System32\msiexec.exe,MICROSOFT WINDOWS,system,msiexec.exe,15308,"7/26/2023, 4:56:03.410 AM",690C14F580778F51,sys_win32,680C14F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 9:40:03.772 AM",,,,,,,,,,,,,,,,,,,MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-19\{06C443E0-9747-4F4D-A792-5DA91420829B},MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-19\{06C443E0-9747-4F4D-A792-5DA91420829B},,Registry Modified Alert,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1733950286218943809,Undefined,"7/21/2023, 9:29:26.013 AM",01H5VWGETNMQH8KV3ZCDJ3MC2A_329,REGKEYDELETE,Events,Unresolved,true,"7/21/2023, 9:29:41.735 AM",STAR,"7/21/2023, 9:29:41.735 AM",1733126240259591279,Registry Modified,1.0,events,"EventType = ""Registry Key Create"" OR EventType = ""Registry Value Create"" OR EventType = ""Registry Key Delete"" OR EventType = ""Registry Key Rename"" OR EventType = ""Registry Key Security Changed"" OR EventType = ""Registry Value Delete"" OR EventType = ""Registry Value Modified"" OR EventType = ""Task Register"" OR EventType = ""Registry Key Export"" OR EventType = ""Registry Key Import"" OR EventType = ""Registry Value Create""",site,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:46.739 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,11236,"7/21/2023, 9:28:28.316 AM",AD9F12F580778F51,sys_win32,AC9F12F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 8:40:04.319 AM",,,,,,,,,,,,,,,,,,,MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-19,MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-19,,Registry Modified Alert,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1733918183583034878,Undefined,"7/21/2023, 8:25:42.484 AM",01H5VRVRKTSAKG13GTVNQHJ1TZ_287,REGKEYDELETE,Events,Unresolved,true,"7/21/2023, 8:25:54.805 AM",STAR,"7/21/2023, 8:25:54.805 AM",1733126240259591279,Registry Modified,1.0,events,"EventType = ""Registry Key Create"" OR EventType = ""Registry Value Create"" OR EventType = ""Registry Key Delete"" OR EventType = ""Registry Key Rename"" OR EventType = ""Registry Key Security Changed"" OR EventType = ""Registry Value Delete"" OR EventType = ""Registry Value Modified"" OR EventType = ""Task Register"" OR EventType = ""Registry Key Export"" OR EventType = ""Registry Key Import"" OR EventType = ""Registry Value Create""",site,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:46.739 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,14280,"7/21/2023, 6:25:57.043 AM",859512F580778F51,sys_win32,849512F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 8:40:04.319 AM",,,,,,,,,,,,,,,,,,,MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-19\{07E81A47-8011-48EE-B862-5478381C98C9},MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-19\{07E81A47-8011-48EE-B862-5478381C98C9},,Registry Modified Alert,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1733918300872566400,Undefined,"7/21/2023, 8:25:56.255 AM",01H5VRWD4CS22TWYKBDHABA5BX_46,REGKEYDELETE,Events,Unresolved,true,"7/21/2023, 8:26:08.786 AM",STAR,"7/21/2023, 8:26:08.786 AM",1733126240259591279,Registry Modified,1.0,events,"EventType = ""Registry Key Create"" OR EventType = ""Registry Value Create"" OR EventType = ""Registry Key Delete"" OR EventType = ""Registry Key Rename"" OR EventType = ""Registry Key Security Changed"" OR EventType = ""Registry Value Delete"" OR EventType = ""Registry Value Modified"" OR EventType = ""Task Register"" OR EventType = ""Registry Key Export"" OR EventType = ""Registry Key Import"" OR EventType = ""Registry Value Create""",site,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:46.739 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,15152,"7/21/2023, 8:19:53.306 AM",7E9912F580778F51,sys_win32,7D9912F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 8:40:04.366 AM",,,,,,,,,,,,,,,,,,,MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-19\{C890C6C8-DF70-476B-A7A3-2CB1D0F77DDA},MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-19\{C890C6C8-DF70-476B-A7A3-2CB1D0F77DDA},,Registry Modified Alert,,,,,,,,,,,,,,,,,,,,,,laptop,CLWO007,windows,Windows 11 Pro,22621,f25c1ccd-5039-4dcf-812e-79a2aede6358,23.1.2.400,1730979466865875730,false,true,false,laptop,CLWO007,windows,f25c1ccd-5039-4dcf-812e-79a2aede6358,1733918320736792952,Undefined,"7/21/2023, 8:25:55.191 AM",01H5VRW6M6TNCJRT5RZ12N71XM_32,REGKEYDELETE,Events,Unresolved,true,"7/21/2023, 8:26:11.154 AM",STAR,"7/21/2023, 8:26:11.154 AM",1733126240259591279,Registry Modified,1.0,events,"EventType = ""Registry Key Create"" OR EventType = ""Registry Value Create"" OR EventType = ""Registry Key Delete"" OR EventType = ""Registry Key Rename"" OR EventType = ""Registry Key Security Changed"" OR EventType = ""Registry Value Delete"" OR EventType = ""Registry Value Modified"" OR EventType = ""Task Register"" OR EventType = ""Registry Key Export"" OR EventType = ""Registry Key Import"" OR EventType = ""Registry Value Create""",site,Low,UNDEFINED,C:\Windows\system32\services.exe,68483e45-9f55-5389-ad8b-a6424bbaf42f,16d12a866c716390af9ca4d87bd7674d6e478f42,4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb,C:\Windows\System32\services.exe,MICROSOFT WINDOWS PUBLISHER,system,services.exe,8,"7/17/2023, 10:22:46.739 AM",433C0EF580778F51,sys_win32,423C0EF580778F51,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc,8ec922c7-a58a-8701-ab48-1b7be9644536,3f64c98f22da277a07cab248c44c56eedb796a81,949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b,C:\Windows\System32\svchost.exe,MICROSOFT WINDOWS,system,svchost.exe,16652,"7/21/2023, 6:59:28.192 AM",B99812F580778F51,sys_win32,B89812F580778F51,NT AUTHORITY\SYSTEM,"1/1/1970, 12:00:00.000 AM",,,,signed,"1/1/1970, 12:00:00.000 AM",,unknown,"1/1/1970, 12:00:00.000 AM",,,,,,,,,,,,,,1712500237934148927,,,,,,,,,,,,,,,,1712500242422055104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Alerts.,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, \ No newline at end of file diff --git a/Sample Data/ASIM/SentinelOne_ASimRegistryEvent_RawLogs.json b/Sample Data/ASIM/SentinelOne_ASimRegistryEvent_RawLogs.json new file mode 100644 index 00000000000..84462ff0574 --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimRegistryEvent_RawLogs.json @@ -0,0 +1,6042 @@ +[ + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 5:00:04.211 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "0f81ec00-9e52-48e6-b899-eb3bbeede741", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "FB4511F580778F51", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "USER\\.DEFAULT\\Software\\Microsoft\\CTF\\SortOrder\\Language\\00000000", + "alertInfo_registryPath": "USER\\.DEFAULT\\Software\\Microsoft\\CTF\\SortOrder\\Language\\00000000", + "alertInfo_registryValue": "78d7744d-2837-40d2-aff4-bede5877836e", + "ruleInfo_description": "Registry Modified Alert", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733809524573085400, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 4:49:54.966 AM", + "alertInfo_dvEventId": "01H5VCGQX8NDGYCZ97EQ7KNBHM_88", + "alertInfo_eventType": "REGVALUEDELETE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 4:50:01.639 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 4:50:01.639 AM", + "ruleInfo_id": 1733126240259591200, + "ruleInfo_name": "Registry Modified", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Registry Key Create\" OR EventType = \"Registry Value Create\" OR EventType = \"Registry Key Delete\" OR EventType = \"Registry Key Rename\" OR EventType = \"Registry Key Security Changed\" OR EventType = \"Registry Value Delete\" OR EventType = \"Registry Value Modified\" OR EventType = \"Task Register\" OR EventType = \"Registry Key Export\" OR EventType = \"Registry Key Import\" OR EventType = \"Registry Value Create", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\System32\\WinLogon.exe -SpecialSession", + "sourceParentProcessInfo_fileHashMd5": "bc97817d-5acf-afc4-ab85-ed9c3c576161", + "sourceParentProcessInfo_fileHashSha1": "2a142db7d20ea7dd8e63341a7cc4c4035c461e64", + "sourceParentProcessInfo_fileHashSha256": "51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\winlogon.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "winlogon.exe", + "sourceParentProcessInfo_pid": 15044, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 1:42:45.436 PM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "LogonUI.exe\" /flags:0x2 /state0:0xa2159855 /state1:0x41c64e6d", + "sourceProcessInfo_fileHashMd5": "b3cc2464-bece-9a99-d8c7-55a7ccbfef52", + "sourceProcessInfo_fileHashSha1": "83acd640edab941976a0326670e6c0a8ab7755dd", + "sourceProcessInfo_fileHashSha256": "b62e62c7374ce1398b985af3122ff10a092750f65191fdc3aa6151de130183a3", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\LogonUI.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "LogonUI.exe", + "sourceProcessInfo_pid": 12572, + "sourceProcessInfo_pidStarttime": "7/20/2023, 1:42:45.521 PM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 6:40:03.934 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "AC644457DCBAD901", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\LogonUI\\SessionData\\LastLoggedOnProvider", + "alertInfo_registryPath": "MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\LogonUI\\SessionData\\LastLoggedOnProvider", + "alertInfo_registryValue": "svchost.exe,FrameServer", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "433C0EF580778F52", + "targetProcessInfo_tgtProcUid": "433C0EF580778F53", + "sourceParentProcessInfo_storyline": "DDBA12F580778F51", + "sourceParentProcessInfo_uniqueId": "DCBA12F580778F51", + "sourceProcessInfo_storyline": "EADA12F580778F51", + "sourceProcessInfo_uniqueId": "E9DA12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736756033410194400, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 6:23:59.251 AM", + "alertInfo_dvEventId": "01H65VFT5FJT5WRW54TT0TPT5X_182", + "alertInfo_eventType": "REGVALUECREATE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 6:24:12.864 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 6:24:12.864 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLWO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "winlogon.exe", + "sourceParentProcessInfo_fileHashMd5": "bc97817d-5acf-afc4-ab85-ed9c3c576161", + "sourceParentProcessInfo_fileHashSha1": "2a142db7d20ea7dd8e63341a7cc4c4035c461e64", + "sourceParentProcessInfo_fileHashSha256": "51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\winlogon.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "winlogon.exe", + "sourceParentProcessInfo_pid": 11468, + "sourceParentProcessInfo_pidStarttime": "7/25/2023, 5:42:14.136 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "LogonUI.exe\" /flags:0x0 /state0:0xa1eb2055 /state1:0x41c64e6d", + "sourceProcessInfo_fileHashMd5": "b3cc2464-bece-9a99-d8c7-55a7ccbfef52", + "sourceProcessInfo_fileHashSha1": "83acd640edab941976a0326670e6c0a8ab7755dd", + "sourceProcessInfo_fileHashSha256": "b62e62c7374ce1398b985af3122ff10a092750f65191fdc3aa6151de130183a3", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\LogonUI.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "LogonUI.exe", + "sourceProcessInfo_pid": 288, + "sourceProcessInfo_pidStarttime": "7/25/2023, 6:21:57.165 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 6:40:03.934 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-19\\{849FB467-5283-433A-A697-1106D6DFDCF8}\\ProcessCreationTime", + "alertInfo_registryPath": "MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-19\\{849FB467-5283-433A-A697-1106D6DFDCF8}\\ProcessCreationTime", + "alertInfo_registryValue": "0x01D9BEC08888128D", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "F4DA12F580778F51", + "sourceProcessInfo_uniqueId": "F3DA12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736756056545976600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 6:23:59.237 AM", + "alertInfo_dvEventId": "01H65VFT5FJT5WRW54TT0TPT5X_94", + "alertInfo_eventType": "REGVALUECREATE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 6:24:15.622 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 6:24:15.622 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLWO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:46.739 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k wsappx -p -s AppXSvc", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 15536, + "sourceProcessInfo_pidStarttime": "7/25/2023, 6:23:32.034 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 2:00:04.318 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SYSTEM\\ControlSet001\\Control\\CI\\Aggregation\\ccbca715cf18ac35db66a1bf785518be709dfe1d32ea9aa0b2f44183b5015f56_78eac555aed3cf37a692d07c943605bfd142b473d9128551ab6272b7edc42bf0", + "alertInfo_registryPath": "MACHINE\\SYSTEM\\ControlSet001\\Control\\CI\\Aggregation\\ccbca715cf18ac35db66a1bf785518be709dfe1d32ea9aa0b2f44183b5015f56_78eac555aed3cf37a692d07c943605bfd142b473d9128551ab6272b7edc42bf0", + "alertInfo_registryValue": "0x01D9BEFDEF4AE0EF", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "553D0EF580778F51", + "sourceParentProcessInfo_uniqueId": "543D0EF580778F51", + "sourceProcessInfo_storyline": "8E3D0EF580778F51", + "sourceProcessInfo_uniqueId": "8D3D0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736977181371246000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 1:43:18.485 PM", + "alertInfo_dvEventId": "01H66MM8VMFWW6SBPQ81V9PDKH_70", + "alertInfo_eventType": "REGVALUECREATE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 1:43:35.756 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 1:43:35.756 PM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLWO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\System32\\svchost.exe -k utcsvc -p", + "sourceParentProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceParentProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceParentProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "svchost.exe", + "sourceParentProcessInfo_pid": 4604, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:48.963 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "AggregatorHost.exe", + "sourceProcessInfo_fileHashMd5": "83ae8c09-e701-a0d6-9502-531388abb9a2", + "sourceProcessInfo_fileHashSha1": "b6b739386d618672c01743a19a0dabdeb7b07b47", + "sourceProcessInfo_fileHashSha256": "eea98faad130bc115316045cded19f3ae90be91f24161ff4251ce9f4b4e2b82d", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\AggregatorHost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "AggregatorHost.exe", + "sourceProcessInfo_pid": 5736, + "sourceProcessInfo_pidStarttime": "7/17/2023, 10:22:49.711 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 2:00:04.318 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\LogonUI\\SessionData\\LastLoggedOnProvider", + "alertInfo_registryPath": "MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\LogonUI\\SessionData\\LastLoggedOnProvider", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "DDBA12F580778F51", + "sourceParentProcessInfo_uniqueId": "DCBA12F580778F51", + "sourceProcessInfo_storyline": "A8E912F580778F51", + "sourceProcessInfo_uniqueId": "A7E912F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736978460432720000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 1:45:58.677 PM", + "alertInfo_dvEventId": "01H66MS4AHVPK6ZSZA1W047SMR_259", + "alertInfo_eventType": "REGVALUECREATE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 1:46:08.231 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 1:46:08.231 PM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLWO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "winlogon.exe", + "sourceParentProcessInfo_fileHashMd5": "bc97817d-5acf-afc4-ab85-ed9c3c576161", + "sourceParentProcessInfo_fileHashSha1": "2a142db7d20ea7dd8e63341a7cc4c4035c461e64", + "sourceParentProcessInfo_fileHashSha256": "51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\winlogon.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "winlogon.exe", + "sourceParentProcessInfo_pid": 11468, + "sourceParentProcessInfo_pidStarttime": "7/25/2023, 5:42:14.136 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "LogonUI.exe\" /flags:0x0 /state0:0xa13da855 /state1:0x41c64e6d", + "sourceProcessInfo_fileHashMd5": "b3cc2464-bece-9a99-d8c7-55a7ccbfef52", + "sourceProcessInfo_fileHashSha1": "83acd640edab941976a0326670e6c0a8ab7755dd", + "sourceProcessInfo_fileHashSha256": "b62e62c7374ce1398b985af3122ff10a092750f65191fdc3aa6151de130183a3", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\LogonUI.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "LogonUI.exe", + "sourceProcessInfo_pid": 8412, + "sourceProcessInfo_pidStarttime": "7/25/2023, 1:44:19.606 PM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 9:00:03.330 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SOFTWARE\\Classes\\CLSID\\{D099E2CC-54BE-4BF6-B1D9-73092B5D139B}", + "alertInfo_registryPath": "MACHINE\\SOFTWARE\\Classes\\CLSID\\{D099E2CC-54BE-4BF6-B1D9-73092B5D139B}", + "alertInfo_registryValue": "", + "ruleInfo_description": "Registry Modified Alert", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "2E9D12F580778F51", + "sourceProcessInfo_uniqueId": "2D9D12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733928319128067800, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 8:45:49.258 AM", + "alertInfo_dvEventId": "01H5VT0N41Z3MMMBM9DFA6JF76_17", + "alertInfo_eventType": "REGKEYCREATE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 8:46:03.055 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 8:46:03.055 AM", + "ruleInfo_id": 1733126240259591200, + "ruleInfo_name": "Registry Modified", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Registry Key Create\" OR EventType = \"Registry Value Create\" OR EventType = \"Registry Key Delete\" OR EventType = \"Registry Key Rename\" OR EventType = \"Registry Key Security Changed\" OR EventType = \"Registry Value Delete\" OR EventType = \"Registry Value Modified\" OR EventType = \"Task Register\" OR EventType = \"Registry Key Export\" OR EventType = \"Registry Key Import\" OR EventType = \"Registry Value Create", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:46.739 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s wuauserv", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 17008, + "sourceProcessInfo_pidStarttime": "7/21/2023, 8:44:53.471 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 8:40:04.366 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "USER\\S-1-5-21-3622100493-2250088526-2058887289-1000\\System\\CurrentControlSet\\Control\\NetTrace", + "alertInfo_registryPath": "USER\\S-1-5-21-3622100493-2250088526-2058887289-1000\\System\\CurrentControlSet\\Control\\NetTrace", + "alertInfo_registryValue": "", + "ruleInfo_description": "Registry Modified Alert", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "2D9A12F580778F51", + "sourceParentProcessInfo_uniqueId": "579A12F580778F51", + "sourceProcessInfo_storyline": "2D9A12F580778F51", + "sourceProcessInfo_uniqueId": "719A12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733919264950225700, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 8:27:50.082 AM", + "alertInfo_dvEventId": "01H5VRZP98HJ39M1KMSR9AGTBE_93", + "alertInfo_eventType": "REGKEYCREATE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 8:28:03.713 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 8:28:03.713 AM", + "ruleInfo_id": 1733126240259591200, + "ruleInfo_name": "Registry Modified", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Registry Key Create\" OR EventType = \"Registry Value Create\" OR EventType = \"Registry Key Delete\" OR EventType = \"Registry Key Rename\" OR EventType = \"Registry Key Security Changed\" OR EventType = \"Registry Value Delete\" OR EventType = \"Registry Value Modified\" OR EventType = \"Task Register\" OR EventType = \"Registry Key Export\" OR EventType = \"Registry Key Import\" OR EventType = \"Registry Value Create", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\System32\\sdiagnhost.exe -Embedding", + "sourceParentProcessInfo_fileHashMd5": "114ce4ca-fd4c-1ca9-438b-b548ebda27fc", + "sourceParentProcessInfo_fileHashSha1": "1583cf30eb074ba1604504f45e492519c5fdddea", + "sourceParentProcessInfo_fileHashSha256": "b2f5e94881978f898010db4f913e1ad619063ada5768ddd41df235918247d163", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\sdiagnhost.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "sdiagnhost.exe", + "sourceParentProcessInfo_pid": 2780, + "sourceParentProcessInfo_pidStarttime": "7/21/2023, 8:27:25.173 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLWO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\netsh.exe\" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter", + "sourceProcessInfo_fileHashMd5": "52b46510-8308-1201-e243-e97ed965b60a", + "sourceProcessInfo_fileHashSha1": "92f2b4e5e5ca66486f4062ab27b8af23d6ad564a", + "sourceProcessInfo_fileHashSha256": "3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\netsh.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "netsh.exe", + "sourceProcessInfo_pid": 4236, + "sourceProcessInfo_pidStarttime": "7/21/2023, 8:27:25.788 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLWO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 5:00:04.211 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "USER\\S-1-5-21-3622100493-2250088526-2058887289-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\StartMode", + "alertInfo_registryPath": "USER\\S-1-5-21-3622100493-2250088526-2058887289-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\StartMode", + "alertInfo_registryValue": "", + "ruleInfo_description": "Registry Modified Alert", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "8C8712F580778F51", + "sourceParentProcessInfo_uniqueId": "8B8712F580778F51", + "sourceProcessInfo_storyline": "8F8712F580778F51", + "sourceProcessInfo_uniqueId": "8E8712F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733809553228572400, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 4:49:54.955 AM", + "alertInfo_dvEventId": "01H5VCGQX8NDGYCZ97EQ7KNBHM_2", + "alertInfo_eventType": "REGKEYCREATE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 4:50:05.055 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 4:50:05.055 AM", + "ruleInfo_id": 1733126240259591200, + "ruleInfo_name": "Registry Modified", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Registry Key Create\" OR EventType = \"Registry Value Create\" OR EventType = \"Registry Key Delete\" OR EventType = \"Registry Key Rename\" OR EventType = \"Registry Key Security Changed\" OR EventType = \"Registry Value Delete\" OR EventType = \"Registry Value Modified\" OR EventType = \"Task Register\" OR EventType = \"Registry Key Export\" OR EventType = \"Registry Key Import\" OR EventType = \"Registry Value Create", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\userinit.exe", + "sourceParentProcessInfo_fileHashMd5": "fc003295-bccc-472c-f80d-e65788f64978", + "sourceParentProcessInfo_fileHashSha1": "43246106034f0fcbb07ecda6be3635a967bac688", + "sourceParentProcessInfo_fileHashSha256": "f098ce116049a2024fa282fd62764159f451a9c1cc21a7845d155d439cf52b27", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\userinit.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "userinit.exe", + "sourceParentProcessInfo_pid": 10796, + "sourceParentProcessInfo_pidStarttime": "7/21/2023, 4:49:44.429 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLWO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\Explorer.EXE", + "sourceProcessInfo_fileHashMd5": "357b678c-68d3-d5ee-86e1-b706fbfd994b", + "sourceProcessInfo_fileHashSha1": "a4e4e2bc502e4ab249b219da357d1aad163ab175", + "sourceProcessInfo_fileHashSha256": "8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b", + "sourceProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "medium", + "sourceProcessInfo_name": "explorer.exe", + "sourceProcessInfo_pid": 5000, + "sourceProcessInfo_pidStarttime": "7/21/2023, 4:49:44.522 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "CLWO007\\Crest", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 5:00:04.211 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "USER\\S-1-5-21-3622100493-2250088526-2058887289-1000\\Control Panel\\Desktop\\MuiCached", + "alertInfo_registryPath": "USER\\S-1-5-21-3622100493-2250088526-2058887289-1000\\Control Panel\\Desktop\\MuiCached", + "alertInfo_registryValue": "", + "ruleInfo_description": "Registry Modified Alert", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "D98512F580778F51", + "sourceParentProcessInfo_uniqueId": "D88512F580778F51", + "sourceProcessInfo_storyline": "DD8512F580778F51", + "sourceProcessInfo_uniqueId": "DC8512F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733809554604304100, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 4:49:54.924 AM", + "alertInfo_dvEventId": "01H5VCGKX654Z6M4GRY5GYDXEQ_577", + "alertInfo_eventType": "REGKEYCREATE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 4:50:05.219 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 4:50:05.219 AM", + "ruleInfo_id": 1733126240259591200, + "ruleInfo_name": "Registry Modified", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Registry Key Create\" OR EventType = \"Registry Value Create\" OR EventType = \"Registry Key Delete\" OR EventType = \"Registry Key Rename\" OR EventType = \"Registry Key Security Changed\" OR EventType = \"Registry Value Delete\" OR EventType = \"Registry Value Modified\" OR EventType = \"Task Register\" OR EventType = \"Registry Key Export\" OR EventType = \"Registry Key Import\" OR EventType = \"Registry Value Create", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "\\SystemRoot\\System32\\smss.exe 00000118 000000c0 C:\\Windows\\System32\\WinLogon.exe -SpecialSession", + "sourceParentProcessInfo_fileHashMd5": "49ce4a7f-ed5d-271a-0142-6f2bc262d23c", + "sourceParentProcessInfo_fileHashSha1": "746f5ae87f13a46e88088dea31d1362727b9ec49", + "sourceParentProcessInfo_fileHashSha256": "b6800c2ca4bfec26c8b8553beee774f4ebab741b1a48adcccce79f07062977be", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\smss.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "smss.exe", + "sourceParentProcessInfo_pid": 12104, + "sourceParentProcessInfo_pidStarttime": "7/20/2023, 1:42:45.411 PM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\WinLogon.exe -SpecialSession", + "sourceProcessInfo_fileHashMd5": "bc97817d-5acf-afc4-ab85-ed9c3c576161", + "sourceProcessInfo_fileHashSha1": "2a142db7d20ea7dd8e63341a7cc4c4035c461e64", + "sourceProcessInfo_fileHashSha256": "51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\winlogon.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "winlogon.exe", + "sourceProcessInfo_pid": 15044, + "sourceProcessInfo_pidStarttime": "7/20/2023, 1:42:45.436 PM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 6:40:03.934 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": 1432, + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "DWORD", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SYSTEM\\ControlSet001\\Services\\SharedAccess\\Epoch\\Epoch", + "alertInfo_registryPath": "MACHINE\\SYSTEM\\ControlSet001\\Services\\SharedAccess\\Epoch\\Epoch", + "alertInfo_registryValue": 1433, + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "273D0EF580778F51", + "sourceProcessInfo_uniqueId": "263D0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736756069313438700, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 6:23:59.269 AM", + "alertInfo_dvEventId": "01H65VFT5FJT5WRW54TT0TPT5X_244", + "alertInfo_eventType": "REGVALUEMODIFIED", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 6:24:17.144 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 6:24:17.144 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLWO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:46.739 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetworkFirewall -p", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 3468, + "sourceProcessInfo_pidStarttime": "7/17/2023, 10:22:48.287 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\LOCAL SERVICE", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 2:00:04.318 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": 76, + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "DWORD", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SYSTEM\\ControlSet001\\Services\\DisplayEnhancementService\\State\\LEN40A00_2A_07E0_68\\ScreenBrightnessPercent", + "alertInfo_registryPath": "MACHINE\\SYSTEM\\ControlSet001\\Services\\DisplayEnhancementService\\State\\LEN40A00_2A_07E0_68\\ScreenBrightnessPercent", + "alertInfo_registryValue": 53, + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "C83C0EF580778F51", + "sourceProcessInfo_uniqueId": "C73C0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736978413867554600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 1:45:58.637 PM", + "alertInfo_dvEventId": "01H66MS4AHVPK6ZSZA1W047SMR_14", + "alertInfo_eventType": "REGVALUEMODIFIED", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 1:46:02.681 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 1:46:02.681 PM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLWO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:46.739 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 1864, + "sourceProcessInfo_pidStarttime": "7/17/2023, 10:22:47.406 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 2:00:04.318 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": 6, + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "DWORD", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SYSTEM\\ControlSet001\\Services\\LITSSVC\\IC\\PSC\\CurrentSetting", + "alertInfo_registryPath": "MACHINE\\SYSTEM\\ControlSet001\\Services\\LITSSVC\\IC\\PSC\\CurrentSetting", + "alertInfo_registryValue": 2, + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "F53C0EF580778F51", + "sourceProcessInfo_uniqueId": "F43C0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736978490463938600, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 1:45:58.637 PM", + "alertInfo_dvEventId": "01H66MS4AHVPK6ZSZA1W047SMR_13", + "alertInfo_eventType": "REGVALUEMODIFIED", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 1:46:11.812 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 1:46:11.812 PM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLWO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:46.739 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\LITSSvc.exe", + "sourceProcessInfo_fileHashMd5": "a24ce5c0-eb03-a693-f911-3a756b7ccf56", + "sourceProcessInfo_fileHashSha1": "3c1b6a9c6c3a632851c16d8491abedf44d91d98c", + "sourceProcessInfo_fileHashSha256": "457f7a1b89c4714970183b83c23c18758008b36cb634d9c514191adb793480f7", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\LITSSvc.exe", + "sourceProcessInfo_fileSignerIdentity": "LENOVO", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "LITSSvc.exe", + "sourceProcessInfo_pid": 2412, + "sourceProcessInfo_pidStarttime": "7/17/2023, 10:22:47.555 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 6:20:04.306 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": 128, + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "DWORD", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SYSTEM\\ControlSet001\\Services\\IBMPMSVC\\Parameters2\\Type20\\Notification\\Type22", + "alertInfo_registryPath": "MACHINE\\SYSTEM\\ControlSet001\\Services\\IBMPMSVC\\Parameters2\\Type20\\Notification\\Type22", + "alertInfo_registryValue": 0, + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "F13C0EF580778F51", + "sourceProcessInfo_uniqueId": "F03C0EF580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736745544310931700, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 6:03:12.137 AM", + "alertInfo_dvEventId": "01H65T9DBHC9TC5YD2TC4279XG_17", + "alertInfo_eventType": "REGVALUEMODIFIED", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 6:03:22.466 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 6:03:22.466 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLWO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:46.739 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\DriverStore\\FileRepository\\ibmpmdrv.inf_amd64_02d728b29c6492d3\\x64\\ibmpmsvc.exe", + "sourceProcessInfo_fileHashMd5": "131233a4-aed6-a5d7-5baa-73d2ea29dd95", + "sourceProcessInfo_fileHashSha1": "ce235043f17f02aeffe8fcb87d38492ced932a05", + "sourceProcessInfo_fileHashSha256": "75b12d3461cadf6defe081347443692e2fa1b1dc440cee5effb4947a3fba0d46", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\DriverStore\\FileRepository\\ibmpmdrv.inf_amd64_02d728b29c6492d3\\x64\\ibmpmsvc.exe", + "sourceProcessInfo_fileSignerIdentity": "LENOVO", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "ibmpmsvc.exe", + "sourceProcessInfo_pid": 2404, + "sourceProcessInfo_pidStarttime": "7/17/2023, 10:22:47.555 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/25/2023, 1:30:03.345 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\LogonUI\\SessionData\\LastLoggedOnProvider", + "alertInfo_registryPath": "MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\LogonUI\\SessionData\\LastLoggedOnProvider", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "DDBA12F580778F51", + "sourceParentProcessInfo_uniqueId": "DCBA12F580778F51", + "sourceProcessInfo_storyline": "8DDB12F580778F51", + "sourceProcessInfo_uniqueId": "8CDB12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1736965156242159400, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/25/2023, 1:19:27.618 PM", + "alertInfo_dvEventId": "01H66K83G1KZT95CZAKY7VXX3T_6", + "alertInfo_eventType": "REGVALUEDELETE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/25/2023, 1:19:42.249 PM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/25/2023, 1:19:42.249 PM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLWO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "winlogon.exe", + "sourceParentProcessInfo_fileHashMd5": "bc97817d-5acf-afc4-ab85-ed9c3c576161", + "sourceParentProcessInfo_fileHashSha1": "2a142db7d20ea7dd8e63341a7cc4c4035c461e64", + "sourceParentProcessInfo_fileHashSha256": "51750130dcf9442a22eb3a4a4e2ebe77519c95955c9b843abcfe0d03e0ede05a", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\winlogon.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "winlogon.exe", + "sourceParentProcessInfo_pid": 11468, + "sourceParentProcessInfo_pidStarttime": "7/25/2023, 5:42:14.136 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "LogonUI.exe\" /flags:0x0 /state0:0xa1e1e055 /state1:0x41c64e6d", + "sourceProcessInfo_fileHashMd5": "b3cc2464-bece-9a99-d8c7-55a7ccbfef52", + "sourceProcessInfo_fileHashSha1": "83acd640edab941976a0326670e6c0a8ab7755dd", + "sourceProcessInfo_fileHashSha256": "b62e62c7374ce1398b985af3122ff10a092750f65191fdc3aa6151de130183a3", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\LogonUI.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "LogonUI.exe", + "sourceProcessInfo_pid": 14776, + "sourceProcessInfo_pidStarttime": "7/25/2023, 6:36:59.465 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/26/2023, 5:10:04.255 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SYSTEM\\ControlSet001\\Control\\Class\\{ce5939ae-ebde-11d0-b181-0000f8753ec4}\\LowerFilters", + "alertInfo_registryPath": "MACHINE\\SYSTEM\\ControlSet001\\Control\\Class\\{ce5939ae-ebde-11d0-b181-0000f8753ec4}\\LowerFilters", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "240814F580778F51", + "sourceParentProcessInfo_uniqueId": "230814F580778F51", + "sourceProcessInfo_storyline": "960814F580778F51", + "sourceProcessInfo_uniqueId": "950814F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": true, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1737434976838411500, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/26/2023, 4:52:56.749 AM", + "alertInfo_dvEventId": "01H688NVMGGD1RB6YEGZ05DW3B_90", + "alertInfo_eventType": "REGVALUEDELETE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/26/2023, 4:53:09.227 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/26/2023, 4:53:09.227 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLWO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding", + "sourceParentProcessInfo_fileHashMd5": "357b678c-68d3-d5ee-86e1-b706fbfd994b", + "sourceParentProcessInfo_fileHashSha1": "a4e4e2bc502e4ab249b219da357d1aad163ab175", + "sourceParentProcessInfo_fileHashSha256": "8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "explorer.exe", + "sourceParentProcessInfo_pid": 3752, + "sourceParentProcessInfo_pidStarttime": "7/26/2023, 4:51:18.156 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLWO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\MsiExec.exe -Embedding 4C754603A3163416FCCAF5EE73FB156F E Global\\MSI0000", + "sourceProcessInfo_fileHashMd5": "302be4b7-434e-6797-6902-9c8570825cc0", + "sourceProcessInfo_fileHashSha1": "f3d7fee4ced78e37f49ce4e38ac681f07bca6ae0", + "sourceProcessInfo_fileHashSha256": "5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\msiexec.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "msiexec.exe", + "sourceProcessInfo_pid": 3628, + "sourceProcessInfo_pidStarttime": "7/26/2023, 4:52:44.193 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/26/2023, 5:10:04.255 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Sentinel Agent", + "alertInfo_registryPath": "MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Sentinel Agent", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "240814F580778F51", + "sourceParentProcessInfo_uniqueId": "230814F580778F51", + "sourceProcessInfo_storyline": "690C14F580778F51", + "sourceProcessInfo_uniqueId": "680C14F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": true, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1737436654199444000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/26/2023, 4:56:13.464 AM", + "alertInfo_dvEventId": "01H688VX35HEE63RCZGXE2VWQE_70", + "alertInfo_eventType": "REGVALUEDELETE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/26/2023, 4:56:29.184 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/26/2023, 4:56:29.184 AM", + "ruleInfo_id": 1736743171400115500, + "ruleInfo_name": "CWL547", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EndpointName = \"CLWO007", + "ruleInfo_scopeLevel": "account", + "ruleInfo_severity": "Medium", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding", + "sourceParentProcessInfo_fileHashMd5": "357b678c-68d3-d5ee-86e1-b706fbfd994b", + "sourceParentProcessInfo_fileHashSha1": "a4e4e2bc502e4ab249b219da357d1aad163ab175", + "sourceParentProcessInfo_fileHashSha256": "8375581b32e510a1ddf90b1ff8ffb8a756d71e1d5572b1c7c027e9b7393ccd3b", + "sourceParentProcessInfo_filePath": "C:\\Windows\\explorer.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceParentProcessInfo_integrityLevel": "medium", + "sourceParentProcessInfo_name": "explorer.exe", + "sourceParentProcessInfo_pid": 3752, + "sourceParentProcessInfo_pidStarttime": "7/26/2023, 4:51:18.156 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "CLWO007\\Crest", + "sourceProcessInfo_commandline": "C:\\Windows\\System32\\MsiExec.exe -Embedding BFA5DB129DF20220C00F97E73D052F54 E Global\\MSI0000", + "sourceProcessInfo_fileHashMd5": "302be4b7-434e-6797-6902-9c8570825cc0", + "sourceProcessInfo_fileHashSha1": "f3d7fee4ced78e37f49ce4e38ac681f07bca6ae0", + "sourceProcessInfo_fileHashSha256": "5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\msiexec.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "msiexec.exe", + "sourceProcessInfo_pid": 15308, + "sourceProcessInfo_pidStarttime": "7/26/2023, 4:56:03.410 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 9:40:03.772 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-19\\{06C443E0-9747-4F4D-A792-5DA91420829B}", + "alertInfo_registryPath": "MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-19\\{06C443E0-9747-4F4D-A792-5DA91420829B}", + "alertInfo_registryValue": "", + "ruleInfo_description": "Registry Modified Alert", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "AD9F12F580778F51", + "sourceProcessInfo_uniqueId": "AC9F12F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733950286218943700, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 9:29:26.013 AM", + "alertInfo_dvEventId": "01H5VWGETNMQH8KV3ZCDJ3MC2A_329", + "alertInfo_eventType": "REGKEYDELETE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 9:29:41.735 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 9:29:41.735 AM", + "ruleInfo_id": 1733126240259591200, + "ruleInfo_name": "Registry Modified", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Registry Key Create\" OR EventType = \"Registry Value Create\" OR EventType = \"Registry Key Delete\" OR EventType = \"Registry Key Rename\" OR EventType = \"Registry Key Security Changed\" OR EventType = \"Registry Value Delete\" OR EventType = \"Registry Value Modified\" OR EventType = \"Task Register\" OR EventType = \"Registry Key Export\" OR EventType = \"Registry Key Import\" OR EventType = \"Registry Value Create", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:46.739 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k wsappx -p -s AppXSvc", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 11236, + "sourceProcessInfo_pidStarttime": "7/21/2023, 9:28:28.316 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 8:40:04.319 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-19", + "alertInfo_registryPath": "MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-19", + "alertInfo_registryValue": "", + "ruleInfo_description": "Registry Modified Alert", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "859512F580778F51", + "sourceProcessInfo_uniqueId": "849512F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733918183583035000, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 8:25:42.484 AM", + "alertInfo_dvEventId": "01H5VRVRKTSAKG13GTVNQHJ1TZ_287", + "alertInfo_eventType": "REGKEYDELETE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 8:25:54.805 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 8:25:54.805 AM", + "ruleInfo_id": 1733126240259591200, + "ruleInfo_name": "Registry Modified", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Registry Key Create\" OR EventType = \"Registry Value Create\" OR EventType = \"Registry Key Delete\" OR EventType = \"Registry Key Rename\" OR EventType = \"Registry Key Security Changed\" OR EventType = \"Registry Value Delete\" OR EventType = \"Registry Value Modified\" OR EventType = \"Task Register\" OR EventType = \"Registry Key Export\" OR EventType = \"Registry Key Import\" OR EventType = \"Registry Value Create", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:46.739 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k wsappx -p -s AppXSvc", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 14280, + "sourceProcessInfo_pidStarttime": "7/21/2023, 6:25:57.043 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 8:40:04.319 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-19\\{07E81A47-8011-48EE-B862-5478381C98C9}", + "alertInfo_registryPath": "MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-19\\{07E81A47-8011-48EE-B862-5478381C98C9}", + "alertInfo_registryValue": "", + "ruleInfo_description": "Registry Modified Alert", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "7E9912F580778F51", + "sourceProcessInfo_uniqueId": "7D9912F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733918300872566300, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 8:25:56.255 AM", + "alertInfo_dvEventId": "01H5VRWD4CS22TWYKBDHABA5BX_46", + "alertInfo_eventType": "REGKEYDELETE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 8:26:08.786 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 8:26:08.786 AM", + "ruleInfo_id": 1733126240259591200, + "ruleInfo_name": "Registry Modified", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Registry Key Create\" OR EventType = \"Registry Value Create\" OR EventType = \"Registry Key Delete\" OR EventType = \"Registry Key Rename\" OR EventType = \"Registry Key Security Changed\" OR EventType = \"Registry Value Delete\" OR EventType = \"Registry Value Modified\" OR EventType = \"Task Register\" OR EventType = \"Registry Key Export\" OR EventType = \"Registry Key Import\" OR EventType = \"Registry Value Create", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:46.739 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k wsappx -p -s AppXSvc", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 15152, + "sourceProcessInfo_pidStarttime": "7/21/2023, 8:19:53.306 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated": "7/21/2023, 8:40:04.366 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-19\\{C890C6C8-DF70-476B-A7A3-2CB1D0F77DDA}", + "alertInfo_registryPath": "MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Deployment\\Package\\*\\S-1-5-19\\{C890C6C8-DF70-476B-A7A3-2CB1D0F77DDA}", + "alertInfo_registryValue": "", + "ruleInfo_description": "Registry Modified Alert", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "B99812F580778F51", + "sourceProcessInfo_uniqueId": "B89812F580778F51", + "agentDetectionInfo_machineType": "laptop", + "agentDetectionInfo_name": "CLWO007", + "agentDetectionInfo_osFamily": "windows", + "agentDetectionInfo_osName": "Windows 11 Pro", + "agentDetectionInfo_osRevision": 22621, + "agentDetectionInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "agentDetectionInfo_version": "23.1.2.400", + "agentRealtimeInfo_id": 1730979466865875700, + "agentRealtimeInfo_infected": false, + "agentRealtimeInfo_isActive": true, + "agentRealtimeInfo_isDecommissioned": false, + "agentRealtimeInfo_machineType": "laptop", + "agentRealtimeInfo_name": "CLWO007", + "agentRealtimeInfo_os": "windows", + "agentRealtimeInfo_uuid": "f25c1ccd-5039-4dcf-812e-79a2aede6358", + "alertInfo_alertId": 1733918320736792800, + "alertInfo_analystVerdict": "Undefined", + "alertInfo_createdAt": "7/21/2023, 8:25:55.191 AM", + "alertInfo_dvEventId": "01H5VRW6M6TNCJRT5RZ12N71XM_32", + "alertInfo_eventType": "REGKEYDELETE", + "alertInfo_hitType": "Events", + "alertInfo_incidentStatus": "Unresolved", + "alertInfo_isEdr": true, + "alertInfo_reportedAt": "7/21/2023, 8:26:11.154 AM", + "alertInfo_source": "STAR", + "alertInfo_updatedAt": "7/21/2023, 8:26:11.154 AM", + "ruleInfo_id": 1733126240259591200, + "ruleInfo_name": "Registry Modified", + "ruleInfo_queryLang": 1, + "ruleInfo_queryType": "events", + "ruleInfo_s1ql": "EventType = \"Registry Key Create\" OR EventType = \"Registry Value Create\" OR EventType = \"Registry Key Delete\" OR EventType = \"Registry Key Rename\" OR EventType = \"Registry Key Security Changed\" OR EventType = \"Registry Value Delete\" OR EventType = \"Registry Value Modified\" OR EventType = \"Task Register\" OR EventType = \"Registry Key Export\" OR EventType = \"Registry Key Import\" OR EventType = \"Registry Value Create", + "ruleInfo_scopeLevel": "site", + "ruleInfo_severity": "Low", + "ruleInfo_treatAsThreat": "UNDEFINED", + "sourceParentProcessInfo_commandline": "C:\\Windows\\system32\\services.exe", + "sourceParentProcessInfo_fileHashMd5": "68483e45-9f55-5389-ad8b-a6424bbaf42f", + "sourceParentProcessInfo_fileHashSha1": "16d12a866c716390af9ca4d87bd7674d6e478f42", + "sourceParentProcessInfo_fileHashSha256": "4a12143226b7090d6e9bb8d040618a2c7a9ef5282f7cc10fa374adc9ab19cbeb", + "sourceParentProcessInfo_filePath": "C:\\Windows\\System32\\services.exe", + "sourceParentProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS PUBLISHER", + "sourceParentProcessInfo_integrityLevel": "system", + "sourceParentProcessInfo_name": "services.exe", + "sourceParentProcessInfo_pid": 8, + "sourceParentProcessInfo_pidStarttime": "7/17/2023, 10:22:46.739 AM", + "sourceParentProcessInfo_subsystem": "sys_win32", + "sourceParentProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "sourceProcessInfo_commandline": "C:\\Windows\\system32\\svchost.exe -k wsappx -p -s AppXSvc", + "sourceProcessInfo_fileHashMd5": "8ec922c7-a58a-8701-ab48-1b7be9644536", + "sourceProcessInfo_fileHashSha1": "3f64c98f22da277a07cab248c44c56eedb796a81", + "sourceProcessInfo_fileHashSha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "sourceProcessInfo_filePath": "C:\\Windows\\System32\\svchost.exe", + "sourceProcessInfo_fileSignerIdentity": "MICROSOFT WINDOWS", + "sourceProcessInfo_integrityLevel": "system", + "sourceProcessInfo_name": "svchost.exe", + "sourceProcessInfo_pid": 16652, + "sourceProcessInfo_pidStarttime": "7/21/2023, 6:59:28.192 AM", + "sourceProcessInfo_subsystem": "sys_win32", + "sourceProcessInfo_user": "NT AUTHORITY\\SYSTEM", + "targetProcessInfo_tgtFileCreatedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "signed", + "targetProcessInfo_tgtFileModifiedAt": "1/1/1970, 12:00:00.000 AM", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "unknown", + "targetProcessInfo_tgtProcessStartTime": "1/1/1970, 12:00:00.000 AM", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits": "", + "isDefault": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": 1712500237934148900, + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": 1712500242422055200, + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected": "", + "agentRealtimeInfo_agentIsActive": "", + "agentRealtimeInfo_agentIsDecommissioned": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired": "", + "agentRealtimeInfo_scanFinishedAt": "", + "agentRealtimeInfo_scanStartedAt": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists": "", + "threatInfo_failedActions": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless": "", + "threatInfo_isValidCertificate": "", + "threatInfo_mitigatedPreemptively": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedEventsLimit": "", + "threatInfo_rebootRequired": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": "", + "accountName": "", + "activityType": "", + "activityUuid": "", + "createdAt": "", + "id": "", + "primaryDescription": "", + "secondaryDescription": "", + "siteId": "", + "siteName": "", + "updatedAt": "", + "userId": "", + "event_name": "Alerts.", + "DataFields": "", + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications": "", + "externalId": "", + "externalIp": "", + "firewallEnabled": "", + "firstFullModeTime": "", + "fullDiskScanLastUpdatedAt": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession": "", + "infected": "", + "installerType": "", + "isActive": "", + "isDecommissioned": "", + "isPendingUninstall": "", + "isUninstalled": "", + "isUpToDate": "", + "lastActiveDate": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt": "", + "remoteProfilingState": "", + "scanFinishedAt": "", + "scanStartedAt": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon": "", + "tags_sentinelone": "", + "threatRebootRequired": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + } +] \ No newline at end of file diff --git a/Sample Data/ASIM/SentinelOne_ASimUserManagement_IngestedLogs.csv b/Sample Data/ASIM/SentinelOne_ASimUserManagement_IngestedLogs.csv new file mode 100644 index 00000000000..99cece1493e --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimUserManagement_IngestedLogs.csv @@ -0,0 +1,23 @@ +TenantId,SourceSystem,MG,ManagementGroupName,TimeGenerated [UTC],Computer,RawData,alertInfo_indicatorDescription_s,alertInfo_indicatorName_s,targetProcessInfo_tgtFileOldPath_s,alertInfo_indicatorCategory_s,alertInfo_registryOldValue_g,alertInfo_dstIp_s,alertInfo_dstPort_s,alertInfo_netEventDirection_s,alertInfo_srcIp_s,alertInfo_srcPort_s,containerInfo_id_s,targetProcessInfo_tgtFileId_g,alertInfo_registryOldValue_s,alertInfo_registryOldValueType_s,alertInfo_dnsRequest_s,alertInfo_dnsResponse_s,alertInfo_registryKeyPath_s,alertInfo_registryPath_s,alertInfo_registryValue_g,ruleInfo_description_s,alertInfo_registryValue_s,alertInfo_loginAccountDomain_s,alertInfo_loginAccountSid_s,alertInfo_loginIsAdministratorEquivalent_s,alertInfo_loginIsSuccessful_s,alertInfo_loginType_s,alertInfo_loginsUserName_s,alertInfo_srcMachineIp_s,targetProcessInfo_tgtProcCmdLine_s,targetProcessInfo_tgtProcImagePath_s,targetProcessInfo_tgtProcName_s,targetProcessInfo_tgtProcPid_s,targetProcessInfo_tgtProcSignedStatus_s,targetProcessInfo_tgtProcStorylineId_s,targetProcessInfo_tgtProcUid_s,sourceParentProcessInfo_storyline_g,sourceParentProcessInfo_uniqueId_g,sourceProcessInfo_storyline_g,sourceProcessInfo_uniqueId_g,targetProcessInfo_tgtProcStorylineId_g,targetProcessInfo_tgtProcUid_g,agentDetectionInfo_machineType_s,agentDetectionInfo_name_s,agentDetectionInfo_osFamily_s,agentDetectionInfo_osName_s,agentDetectionInfo_osRevision_s,agentDetectionInfo_uuid_g,agentDetectionInfo_version_s,agentRealtimeInfo_id_s,agentRealtimeInfo_infected_b,agentRealtimeInfo_isActive_b,agentRealtimeInfo_isDecommissioned_b,agentRealtimeInfo_machineType_s,agentRealtimeInfo_name_s,agentRealtimeInfo_os_s,agentRealtimeInfo_uuid_g,alertInfo_alertId_s,alertInfo_analystVerdict_s,alertInfo_createdAt_t [UTC],alertInfo_dvEventId_s,alertInfo_eventType_s,alertInfo_hitType_s,alertInfo_incidentStatus_s,alertInfo_isEdr_b,alertInfo_reportedAt_t [UTC],alertInfo_source_s,alertInfo_updatedAt_t [UTC],ruleInfo_id_s,ruleInfo_name_s,ruleInfo_queryLang_s,ruleInfo_queryType_s,ruleInfo_s1ql_s,ruleInfo_scopeLevel_s,ruleInfo_severity_s,ruleInfo_treatAsThreat_s,sourceParentProcessInfo_commandline_s,sourceParentProcessInfo_fileHashMd5_g,sourceParentProcessInfo_fileHashSha1_s,sourceParentProcessInfo_fileHashSha256_s,sourceParentProcessInfo_filePath_s,sourceParentProcessInfo_fileSignerIdentity_s,sourceParentProcessInfo_integrityLevel_s,sourceParentProcessInfo_name_s,sourceParentProcessInfo_pid_s,sourceParentProcessInfo_pidStarttime_t [UTC],sourceParentProcessInfo_storyline_s,sourceParentProcessInfo_subsystem_s,sourceParentProcessInfo_uniqueId_s,sourceParentProcessInfo_user_s,sourceProcessInfo_commandline_s,sourceProcessInfo_fileHashMd5_g,sourceProcessInfo_fileHashSha1_s,sourceProcessInfo_fileHashSha256_s,sourceProcessInfo_filePath_s,sourceProcessInfo_fileSignerIdentity_s,sourceProcessInfo_integrityLevel_s,sourceProcessInfo_name_s,sourceProcessInfo_pid_s,sourceProcessInfo_pidStarttime_t [UTC],sourceProcessInfo_storyline_s,sourceProcessInfo_subsystem_s,sourceProcessInfo_uniqueId_s,sourceProcessInfo_user_s,targetProcessInfo_tgtFileCreatedAt_t [UTC],targetProcessInfo_tgtFileHashSha1_s,targetProcessInfo_tgtFileHashSha256_s,targetProcessInfo_tgtFileId_s,targetProcessInfo_tgtFileIsSigned_s,targetProcessInfo_tgtFileModifiedAt_t [UTC],targetProcessInfo_tgtFilePath_s,targetProcessInfo_tgtProcIntegrityLevel_s,targetProcessInfo_tgtProcessStartTime_t [UTC],agentUpdatedVersion_s,agentId_s,hash_s,osFamily_s,threatId_s,creator_s,creatorId_s,inherits_b,isDefault_b,name_s,registrationToken_s,totalAgents_d,type_s,agentDetectionInfo_accountId_s,agentDetectionInfo_accountName_s,agentDetectionInfo_agentDetectionState_s,agentDetectionInfo_agentDomain_s,agentDetectionInfo_agentIpV4_s,agentDetectionInfo_agentIpV6_s,agentDetectionInfo_agentLastLoggedInUserName_s,agentDetectionInfo_agentMitigationMode_s,agentDetectionInfo_agentOsName_s,agentDetectionInfo_agentOsRevision_s,agentDetectionInfo_agentRegisteredAt_t [UTC],agentDetectionInfo_agentUuid_g,agentDetectionInfo_agentVersion_s,agentDetectionInfo_externalIp_s,agentDetectionInfo_groupId_s,agentDetectionInfo_groupName_s,agentDetectionInfo_siteId_s,agentDetectionInfo_siteName_s,agentRealtimeInfo_accountId_s,agentRealtimeInfo_accountName_s,agentRealtimeInfo_activeThreats_d,agentRealtimeInfo_agentComputerName_s,agentRealtimeInfo_agentDomain_s,agentRealtimeInfo_agentId_s,agentRealtimeInfo_agentInfected_b,agentRealtimeInfo_agentIsActive_b,agentRealtimeInfo_agentIsDecommissioned_b,agentRealtimeInfo_agentMachineType_s,agentRealtimeInfo_agentMitigationMode_s,agentRealtimeInfo_agentNetworkStatus_s,agentRealtimeInfo_agentOsName_s,agentRealtimeInfo_agentOsRevision_s,agentRealtimeInfo_agentOsType_s,agentRealtimeInfo_agentUuid_g,agentRealtimeInfo_agentVersion_s,agentRealtimeInfo_groupId_s,agentRealtimeInfo_groupName_s,agentRealtimeInfo_networkInterfaces_s,agentRealtimeInfo_operationalState_s,agentRealtimeInfo_rebootRequired_b,agentRealtimeInfo_scanFinishedAt_t [UTC],agentRealtimeInfo_scanStartedAt_t [UTC],agentRealtimeInfo_scanStatus_s,agentRealtimeInfo_siteId_s,agentRealtimeInfo_siteName_s,agentRealtimeInfo_userActionsNeeded_s,indicators_s,mitigationStatus_s,threatInfo_analystVerdict_s,threatInfo_analystVerdictDescription_s,threatInfo_automaticallyResolved_b,threatInfo_certificateId_s,threatInfo_classification_s,threatInfo_classificationSource_s,threatInfo_cloudFilesHashVerdict_s,threatInfo_collectionId_s,threatInfo_confidenceLevel_s,threatInfo_createdAt_t [UTC],threatInfo_detectionEngines_s,threatInfo_detectionType_s,threatInfo_engines_s,threatInfo_externalTicketExists_b,threatInfo_failedActions_b,threatInfo_fileExtension_s,threatInfo_fileExtensionType_s,threatInfo_filePath_s,threatInfo_fileSize_d,threatInfo_fileVerificationType_s,threatInfo_identifiedAt_t [UTC],threatInfo_incidentStatus_s,threatInfo_incidentStatusDescription_s,threatInfo_initiatedBy_s,threatInfo_initiatedByDescription_s,threatInfo_isFileless_b,threatInfo_isValidCertificate_b,threatInfo_mitigatedPreemptively_b,threatInfo_mitigationStatus_s,threatInfo_mitigationStatusDescription_s,threatInfo_originatorProcess_s,threatInfo_pendingActions_b,threatInfo_processUser_s,threatInfo_publisherName_s,threatInfo_reachedarthentsLimit_b,threatInfo_rebootRequired_b,threatInfo_sha1_s,threatInfo_storyline_s,threatInfo_threatId_s,threatInfo_threatName_s,threatInfo_updatedAt_t [UTC],whiteningOptions_s,threatInfo_maliciousProcessArguments_s,threatInfo_fileExtension_g,threatInfo_threatName_g,threatInfo_storyline_g,accountId_s,accountName_s,activityType_d,activityUuid_g,createdAt_t [UTC],id_s,primaryDescription_s,secondaryDescription_s,siteId_s,siteName_s,updatedAt_t [UTC],userId_s,event_name_s,DataFields_s,description_s,comments_s,activeDirectory_computerMemberOf_s,activeDirectory_lastUserMemberOf_s,activeThreats_d,agentVersion_s,allowRemoteShell_b,appsVulnerabilityStatus_s,computerName_s,consoleMigrationStatus_s,coreCount_d,cpuCount_d,cpuId_s,detectionState_s,domain_s,encryptedApplications_b,externalId_s,externalIp_s,firewallEnabled_b,firstFullModeTime_t [UTC],fullDiskScanLastUpdatedAt_t [UTC],groupId_s,groupIp_s,groupName_s,inRemoteShellSession_b,infected_b,installerType_s,isActive_b,isDecommissioned_b,isPendingUninstall_b,isUninstalled_b,isUpToDate_b,lastActiveDate_t [UTC],lastIpToMgmt_s,lastLoggedInUserName_s,licenseKey_s,locationEnabled_b,locationType_s,locations_s,machineType_s,mitigationMode_s,mitigationModeSuspicious_s,modelName_s,networkInterfaces_s,networkQuarantineEnabled_b,networkStatus_s,operationalState_s,osArch_s,osName_s,osRevision_s,osStartTime_t [UTC],osType_s,rangerStatus_s,rangerVersion_s,registeredAt_t [UTC],remoteProfilingState_s,scanFinishedAt_t [UTC],scanStartedAt_t [UTC],scanStatus_s,serialNumber_s,showAlertIcon_b,tags_sentinelone_s,threatRebootRequired_b,totalMemory_d,userActionsNeeded_s,uuid_g,osUsername_s,scanAbortedAt_t [UTC],activeDirectory_computerDistinguishedName_s,activeDirectory_lastUserDistinguishedName_s,Type,_ResourceId +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/19/2023, 12:40:04 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,23,fb366a5d-1950-4106-80a9-2715c63030d9,"7/19/2023, 12:25:04 PM",1732588999478741481,The management user Nick Man added user Darth as Viewer.,IP address: 1.1.1.1,,,"7/19/2023, 12:25:04 PM",1732588998690212150,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""role"": ""Viewer"", ""scopeLevel"": ""Account"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""sourceType"": ""UI"", ""userScope"": ""account"", ""username"": ""Darth""}","",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 9:40:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,37,c8e96690-cfc1-4c30-96dc-74c59d18ed96,"7/25/2023, 9:25:03 AM",1736847049504106605,The management user Nick Man added user Dave to role Viewer in scope Crest Data Systems,IP address: 1.1.1.1,,,"7/25/2023, 9:25:03 AM",1716583470262263007,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""role"": ""Viewer"", ""roleName"": ""Viewer"", ""scopeLevel"": ""Account"", ""scopeLevelName"": ""Crest Data Systems"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""sourceType"": ""UI"", ""userScope"": ""account"", ""username"": ""Dave""}",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 9:40:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,37,5d68c5d5-0693-4f28-ae15-5e1a0ea2bb04,"7/25/2023, 9:26:08 AM",1736847596114257723,The management user Nick Man added user Dave to role Admin in scope Crest Data Systems,IP address: 1.1.1.1,,,"7/25/2023, 9:26:08 AM",1716583470262263007,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""role"": ""Admin"", ""roleName"": ""Admin"", ""scopeLevel"": ""Account"", ""scopeLevelName"": ""Crest Data Systems"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""sourceType"": ""UI"", ""userScope"": ""account"", ""username"": ""Dave""}",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/6/2023, 6:04:55 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,23,5298b51f-599a-4613-9118-87bbd70e6b61,"7/5/2023, 1:12:24 PM",1722465966578341798,The management user NisMan added user jack as Admin.,IP address: 1.1.1.2,1712500242422055104,Default site,"7/5/2023, 1:12:24 PM",1722465965663983441,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""NisMan"", ""fullScopeDetails"": ""Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site"", ""groupName"": null, ""ipAddress"": ""1.1.1.2"", ""realUser"": null, ""role"": ""Admin"", ""scopeLevel"": ""Site"", ""scopeName"": ""Default site"", ""siteName"": ""Default site"", ""sourceType"": ""UI"", ""userScope"": ""site"", ""username"": ""jack""}","",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 9:40:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,24,6d73dfa5-3947-43d2-b716-29e849dc3153,"7/25/2023, 9:25:03 AM",1736847049755764852,"The management user Nick Man updated the management user Dave. +Modified fields: User scope roles",IP address: 1.1.1.1,,,"7/25/2023, 9:25:03 AM",1716583470262263007,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""modifiedFields"": ""Modified fields: User scope roles"", ""realUser"": null, ""role"": ""Viewer"", ""scopeLevel"": ""Account"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""sourceType"": ""UI"", ""userScope"": ""account"", ""username"": ""Dave""}",Nick Man,Modified fields: User scope roles,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/25/2023, 9:40:03 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,24,5c5e7e13-fd66-4b2d-a28a-1174af876f70,"7/25/2023, 9:26:08 AM",1736847596407859079,"The management user Nick Man updated the management user Dave. +Modified fields: User scope roles",IP address: 1.1.1.1,,,"7/25/2023, 9:26:08 AM",1716583470262263007,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""modifiedFields"": ""Modified fields: User scope roles"", ""realUser"": null, ""role"": ""Admin"", ""scopeLevel"": ""Account"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""sourceType"": ""UI"", ""userScope"": ""account"", ""username"": ""Dave""}",Nick Man,Modified fields: User scope roles,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 11:50:04 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,110,89b49441-4f83-4e54-91b0-29f02a4a996e,"7/20/2023, 11:39:00 AM",1733290588638022118,The management user Nick Man gave permission to the management user Nirvato generate API tokens.,IP address: 1.1.1.1,1712500242422055104,Default site,"7/20/2023, 11:39:00 AM",1722466127522197269,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""fullScopeDetails"": ""Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""role"": ""Admin"", ""scopeLevel"": ""Site"", ""scopeName"": ""Default site"", ""siteName"": ""Default site"", ""sourceType"": ""UI"", ""userScope"": ""site"", ""username"": ""Nirva""}",Nirva,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/21/2023, 7:00:18 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,5006,37b6aca3-6759-4406-9990-9427ff5947ec,"7/21/2023, 6:46:32 AM",1733868167914689364,The management user Nick Man deleted the Manual Group: Test.,IP address: 1.1.1.1,1712500242422055104,Default site,"7/21/2023, 6:46:32 AM",1712986475444464777,Activities.,"{""accountName"": ""Crest Data Systems"", ""fullScopeDetails"": ""Group Test in Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site / Test"", ""groupId"": 1721525955683466807, ""groupName"": ""Test"", ""groupType"": ""Manual"", ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""scopeLevel"": ""Group"", ""scopeName"": ""Test"", ""siteName"": ""Default site"", ""sourceType"": ""UI"", ""username"": ""Nick Man""}",,,,,,,,,,,,,,,,,,,,,,1721525955683466807,,Test,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/6/2023, 12:50:14 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,25,9b9a0977-8483-4f2c-8bba-f85c50f01559,"6/27/2023, 10:24:22 AM",1716583181635393170,The management user NisMan deleted the user Dave.,IP address: 1.1.1.2,1712500242422055104,Default site,"6/27/2023, 10:24:22 AM",1716583004803512585,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""NisMan"", ""deactivationPeriodInDays"": ""90"", ""fullScopeDetails"": ""Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site"", ""groupName"": null, ""ipAddress"": ""1.1.1.2"", ""realUser"": null, ""role"": ""Viewer"", ""scopeLevel"": ""Site"", ""scopeName"": ""Default site"", ""siteName"": ""Default site"", ""sourceType"": ""UI"", ""userScope"": ""site"", ""username"": ""Dave""}",NisMan,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/19/2023, 12:50:03 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,140,2ad1ba17-d519-4866-b401-67da64e3317a,"7/19/2023, 12:38:17 PM",1732595655286628841,The management user Nick Man added a new Service User Darth with the description Darth to Crest Data Systems with role Admin.,IP address: 1.1.1.1,,,"7/19/2023, 12:38:17 PM",1732595654439379351,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""description"": ""Darth"", ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""roleName"": ""Admin"", ""scopeLevel"": ""Account"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""sourceType"": ""UI"", ""username"": ""Darth""}",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/19/2023, 12:50:03 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,140,3f33a1f3-9f08-490b-8f94-760a9135e13f,"7/19/2023, 12:39:28 PM",1732596251003720722,The management user Nick Man added a new Service User Darth with the description Darth to Default site with role C-Level.,IP address: 1.1.1.1,1712500242422055104,Default site,"7/19/2023, 12:39:28 PM",1732595654439379351,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""description"": ""Darth"", ""fullScopeDetails"": ""Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""roleName"": ""C-Level"", ""scopeLevel"": ""Site"", ""scopeName"": ""Default site"", ""siteName"": ""Default site"", ""sourceType"": ""UI"", ""username"": ""Darth""}",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/6/2023, 12:50:14 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,5008,327cc7b4-f116-490d-9a0b-53d572cce162,"6/22/2023, 12:44:45 PM",1713029962565392283,The management user Nick Man created the new Manual Group: Crest Data Systems.,IP address: 1.1.1.1,1712500242422055104,Default site,"6/22/2023, 12:44:45 PM",1712986475444464777,Activities.,"{""accountName"": ""Crest Data Systems"", ""fullScopeDetails"": ""Group Crest Data Systems in Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site / Crest Data Systems"", ""groupId"": ""1713029962380842894"", ""groupName"": ""Crest Data Systems"", ""groupType"": ""Manual"", ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""scopeLevel"": ""Group"", ""scopeName"": ""Crest Data Systems"", ""siteName"": ""Default site"", ""sourceType"": ""UI"", ""username"": ""Nick Man""}",,,,,,,,,,,,,,,,,,,,,,1713029962380842894,,Crest Data Systems,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/6/2023, 12:50:14 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,5008,6a5ae272-d4df-4986-a8ec-b1c9c09ef60d,"7/4/2023, 6:04:46 AM",1721525955893182011,The management user Dave created the new Manual Group: Test.,IP address: 1.1.1.2,1712500242422055104,Default site,"7/4/2023, 6:04:46 AM",1716583470262263007,Activities.,"{""accountName"": ""Crest Data Systems"", ""fullScopeDetails"": ""Group Test in Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site / Test"", ""groupId"": ""1721525955683466807"", ""groupName"": ""Test"", ""groupType"": ""Manual"", ""ipAddress"": ""1.1.1.2"", ""realUser"": null, ""scopeLevel"": ""Group"", ""scopeName"": ""Test"", ""siteName"": ""Default site"", ""sourceType"": ""UI"", ""username"": ""Dave""}",,,,,,,,,,,,,,,,,,,,,,1721525955683466807,,Test,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/19/2023, 12:50:03 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,142,46b211c2-1223-4ff0-9cfc-a3fc7eed4b05,"7/19/2023, 12:39:28 PM",1732596250928223249,The management user Nick Man deleted the Service User Darth from scope Crest Data Systems.,IP address: 1.1.1.1,,,"7/19/2023, 12:39:28 PM",1732595654439379351,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""description"": ""Darth"", ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""scopeLevel"": ""Account"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""sourceType"": ""UI"", ""username"": ""Darth""}",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 10:20:04 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,5006,a180e2f3-fb7e-44fc-adfe-cbc5d250d9ed,"7/20/2023, 10:03:42 AM",1733242623065122727,The management user Nirvadeleted the Manual Group: Test Group Activity.,IP address: 1.1.1.2,1712500242422055104,Default site,"7/20/2023, 10:03:42 AM",1722466127522197269,Activities.,"{""accountName"": ""Crest Data Systems"", ""fullScopeDetails"": ""Group Test Group Activity in Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site / Test Group Activity"", ""groupId"": 1733236199462385361, ""groupName"": ""Test Group Activity"", ""groupType"": ""Manual"", ""ipAddress"": ""1.1.1.2"", ""realUser"": null, ""scopeLevel"": ""Group"", ""scopeName"": ""Test Group Activity"", ""siteName"": ""Default site"", ""sourceType"": ""UI"", ""username"": ""Nirva""}",,,,,,,,,,,,,,,,,,,,,,1733236199462385361,,Test Group Activity,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/19/2023, 12:50:03 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,25,eded5a54-86c8-4337-9dff-e3e13a9305f2,"7/19/2023, 12:37:15 PM",1732595136375643864,The management user Nick Man deleted the user Darth.,IP address: 1.1.1.1,,,"7/19/2023, 12:37:15 PM",1732588998690212150,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""deactivationPeriodInDays"": ""90"", ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""role"": ""Admin"", ""scopeLevel"": ""Account"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""sourceType"": ""UI"", ""userScope"": ""account"", ""username"": ""Darth""}",Nick Man,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/19/2023, 12:50:03 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,141,df06ac01-c280-4a06-b3a3-0563c04b7e58,"7/19/2023, 12:38:55 PM",1732595970044029527,The management user Nick Man changed the role of the Service User Darth on scope Crest Data Systems. Previous role: Admin. New role: SOC.,IP address: 1.1.1.1,,,"7/19/2023, 12:38:55 PM",1732595654439379351,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""description"": ""Darth"", ""descriptionChanged"": false, ""fullScopeDetails"": ""Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""oldDescription"": ""N/A"", ""oldRole"": ""Admin"", ""realUser"": null, ""role"": ""SOC"", ""scopeLevel"": ""Account"", ""scopeName"": ""Crest Data Systems"", ""siteName"": null, ""sourceType"": ""UI"", ""username"": ""Darth""}",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/19/2023, 1:00:02 PM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,141,f4804b82-7729-499d-9157-f1ea3aa7e361,"7/19/2023, 12:41:17 PM",1732597165974508627,The management user Nick Man changed the role of the Service User Darth on scope Default site. Previous role: C-Level. New role: User Test.,IP address: 1.1.1.1,1712500242422055104,Default site,"7/19/2023, 12:41:17 PM",1732595654439379351,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""description"": ""Darth"", ""descriptionChanged"": false, ""fullScopeDetails"": ""Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""oldDescription"": ""N/A"", ""oldRole"": ""C-Level"", ""realUser"": null, ""role"": ""User Test"", ""scopeLevel"": ""Site"", ""scopeName"": ""Default site"", ""siteName"": ""Default site"", ""sourceType"": ""UI"", ""username"": ""Darth""}",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 11:50:04 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,111,9cce98f3-b039-4ba0-a8f2-e0105b688546,"7/20/2023, 11:38:42 AM",1733290437886321178,The management user Nick Man blocked the management user Nirvafrom generating API tokens.,IP address: 1.1.1.1,1712500242422055104,Default site,"7/20/2023, 11:38:42 AM",1722466127522197269,Activities.,"{""accountName"": ""Crest Data Systems"", ""byUser"": ""Nick Man"", ""fullScopeDetails"": ""Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site"", ""groupName"": null, ""ipAddress"": ""1.1.1.1"", ""realUser"": null, ""role"": ""Admin"", ""scopeLevel"": ""Site"", ""scopeName"": ""Default site"", ""siteName"": ""Default site"", ""sourceType"": ""UI"", ""userScope"": ""site"", ""username"": ""Nirva""}",Nirva,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, +1a0e2567-2e58-4989-ad18-206108185325,RestAPI,,,"7/20/2023, 10:20:04 AM",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1712500237934148927,Crest Data Systems,5011,1b86a2ea-9f84-4e5b-a918-a521b20d8f09,"7/20/2023, 10:07:15 AM",1733244408404449162,The management user Nirvareverted the policy of Group Test Pinned group to its Site policy.,IP address: 1.1.1.2,1712500242422055104,Default site,"7/20/2023, 10:07:14 AM",1722466127522197269,Activities.,"{""accountName"": ""Crest Data Systems"", ""fullScopeDetails"": ""Group Test Pinned group in Site Default site of Account Crest Data Systems"", ""fullScopeDetailsPath"": ""Global / Crest Data Systems / Default site / Test Pinned group"", ""groupId"": ""1733241822456258550"", ""groupName"": ""Test Pinned group"", ""groupType"": ""Pinned"", ""ipAddress"": ""1.1.1.2"", ""realUser"": null, ""scopeLevel"": ""Group"", ""scopeName"": ""Test Pinned group"", ""siteName"": ""Default site"", ""sourceType"": ""UI"", ""username"": ""Nirva""}",,,,,,,,,,,,,,,,,,,,,,1733241822456258550,,Test Pinned group,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,SentinelOne_CL, \ No newline at end of file diff --git a/Sample Data/ASIM/SentinelOne_ASimUserManagement_RawLogs.json b/Sample Data/ASIM/SentinelOne_ASimUserManagement_RawLogs.json new file mode 100644 index 00000000000..9c64872bb30 --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_ASimUserManagement_RawLogs.json @@ -0,0 +1,6350 @@ +[ + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/19/2023, 12:40:04 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "0f81ec00-9e52-48e6-b899-eb3bbeede741", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "78d7744d-2837-40d2-aff4-bede5877836e", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "73ffd9f9-7430-51bf-89fd-275f31272868", + "targetProcessInfo_tgtProcUid": "73ffdf8e-0a44-5079-fd74-243fc15cbe7e", + "sourceParentProcessInfo_storyline": "73ffdf8e-0a44-5079-fd74-243fc15cbe7c", + "sourceParentProcessInfo_uniqueId": "73ffdf8e-0a44-5079-fd74-243fc15cbe7d", + "sourceProcessInfo_storyline": "73ffdf8e-0a33-5079-fd74-243fc15cbe7c", + "sourceProcessInfo_uniqueId": "73ffdf8e-0a22-5079-fd74-243fc15cbe7c", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 23, + "activityUuid": "fb366a5d-1950-4106-80a9-2715c63030d9", + "createdAt [UTC]": "7/19/2023, 12:25:04 PM", + "id": 1732588999478741500, + "primaryDescription": "The management user Nick Man added user Darth as Viewer.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "7/19/2023, 12:25:04 PM", + "userId": 1732588998690212000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "role": "Viewer", + "scopeLevel": "Account", + "scopeName": "Crest Data Systems", + "siteName": null, + "sourceType": "UI", + "userScope": "account", + "username": "Darth" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 9:40:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "AC644457DCBAD901", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "svchost.exe,FrameServer", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "433C0EF580778F52", + "targetProcessInfo_tgtProcUid": "433C0EF580778F53", + "sourceParentProcessInfo_storyline": "433C0EF580778F51", + "sourceParentProcessInfo_uniqueId": "423C0EF580778F51", + "sourceProcessInfo_storyline": "553D0EF580778F51", + "sourceProcessInfo_uniqueId": "543D0EF580778F51", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 37, + "activityUuid": "c8e96690-cfc1-4c30-96dc-74c59d18ed96", + "createdAt [UTC]": "7/25/2023, 9:25:03 AM", + "id": 1736847049504106500, + "primaryDescription": "The management user Nick Man added user Dave to role Viewer in scope Crest Data Systems", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "7/25/2023, 9:25:03 AM", + "userId": 1716583470262263000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "role": "Viewer", + "roleName": "Viewer", + "scopeLevel": "Account", + "scopeLevelName": "Crest Data Systems", + "scopeName": "Crest Data Systems", + "siteName": null, + "sourceType": "UI", + "userScope": "account", + "username": "Dave" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 9:40:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 37, + "activityUuid": "5d68c5d5-0693-4f28-ae15-5e1a0ea2bb04", + "createdAt [UTC]": "7/25/2023, 9:26:08 AM", + "id": 1736847596114257700, + "primaryDescription": "The management user Nick Man added user Dave to role Admin in scope Crest Data Systems", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "7/25/2023, 9:26:08 AM", + "userId": 1716583470262263000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "role": "Admin", + "roleName": "Admin", + "scopeLevel": "Account", + "scopeLevelName": "Crest Data Systems", + "scopeName": "Crest Data Systems", + "siteName": null, + "sourceType": "UI", + "userScope": "account", + "username": "Dave" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/6/2023, 6:04:55 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 23, + "activityUuid": "5298b51f-599a-4613-9118-87bbd70e6b61", + "createdAt [UTC]": "7/5/2023, 1:12:24 PM", + "id": 1722465966578342000, + "primaryDescription": "The management user NisMan added user jack as Admin.", + "secondaryDescription": "IP address: 1.1.1.2", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt [UTC]": "7/5/2023, 1:12:24 PM", + "userId": 1722465965663983400, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "NisMan", + "fullScopeDetails": "Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site", + "groupName": null, + "ipAddress": "1.1.1.2", + "realUser": null, + "role": "Admin", + "scopeLevel": "Site", + "scopeName": "Default site", + "siteName": "Default site", + "sourceType": "UI", + "userScope": "site", + "username": "jack" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 9:40:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 24, + "activityUuid": "6d73dfa5-3947-43d2-b716-29e849dc3153", + "createdAt [UTC]": "7/25/2023, 9:25:03 AM", + "id": 1736847049755764700, + "primaryDescription": "The management user Nick Man updated the management user Dave.\nModified fields: User scope roles", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "7/25/2023, 9:25:03 AM", + "userId": 1716583470262263000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "modifiedFields": "Modified fields: User scope roles", + "realUser": null, + "role": "Viewer", + "scopeLevel": "Account", + "scopeName": "Crest Data Systems", + "siteName": null, + "sourceType": "UI", + "userScope": "account", + "username": "Dave" + }, + "description": "Nick Man", + "comments": "Modified fields: User scope roles", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/25/2023, 9:40:03 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 24, + "activityUuid": "5c5e7e13-fd66-4b2d-a28a-1174af876f70", + "createdAt [UTC]": "7/25/2023, 9:26:08 AM", + "id": 1736847596407859200, + "primaryDescription": "The management user Nick Man updated the management user Dave.\nModified fields: User scope roles", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "7/25/2023, 9:26:08 AM", + "userId": 1716583470262263000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "modifiedFields": "Modified fields: User scope roles", + "realUser": null, + "role": "Admin", + "scopeLevel": "Account", + "scopeName": "Crest Data Systems", + "siteName": null, + "sourceType": "UI", + "userScope": "account", + "username": "Dave" + }, + "description": "Nick Man", + "comments": "Modified fields: User scope roles", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 11:50:04 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 110, + "activityUuid": "89b49441-4f83-4e54-91b0-29f02a4a996e", + "createdAt [UTC]": "7/20/2023, 11:39:00 AM", + "id": 1733290588638022100, + "primaryDescription": "The management user Nick Man gave permission to the management user Nirvato generate API tokens.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt [UTC]": "7/20/2023, 11:39:00 AM", + "userId": 1722466127522197200, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "fullScopeDetails": "Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "role": "Admin", + "scopeLevel": "Site", + "scopeName": "Default site", + "siteName": "Default site", + "sourceType": "UI", + "userScope": "site", + "username": "Nirva" + }, + "description": "Nirva", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/21/2023, 7:00:18 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 5006, + "activityUuid": "37b6aca3-6759-4406-9990-9427ff5947ec", + "createdAt [UTC]": "7/21/2023, 6:46:32 AM", + "id": 1733868167914689300, + "primaryDescription": "The management user Nick Man deleted the Manual Group: Test.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt [UTC]": "7/21/2023, 6:46:32 AM", + "userId": 1712986475444465000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "fullScopeDetails": "Group Test in Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site / Test", + "groupId": 1721525955683466800, + "groupName": "Test", + "groupType": "Manual", + "ipAddress": "1.1.1.1", + "realUser": null, + "scopeLevel": "Group", + "scopeName": "Test", + "siteName": "Default site", + "sourceType": "UI", + "username": "Nick Man" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": 1721525955683466800, + "groupIp": "", + "groupName": "Test", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/6/2023, 12:50:14 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 25, + "activityUuid": "9b9a0977-8483-4f2c-8bba-f85c50f01559", + "createdAt [UTC]": "6/27/2023, 10:24:22 AM", + "id": 1716583181635393300, + "primaryDescription": "The management user NisMan deleted the user Dave.", + "secondaryDescription": "IP address: 1.1.1.2", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt [UTC]": "6/27/2023, 10:24:22 AM", + "userId": 1716583004803512600, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "NisMan", + "deactivationPeriodInDays": "90", + "fullScopeDetails": "Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site", + "groupName": null, + "ipAddress": "1.1.1.2", + "realUser": null, + "role": "Viewer", + "scopeLevel": "Site", + "scopeName": "Default site", + "siteName": "Default site", + "sourceType": "UI", + "userScope": "site", + "username": "Dave" + }, + "description": "NisMan", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/19/2023, 12:50:03 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 140, + "activityUuid": "2ad1ba17-d519-4866-b401-67da64e3317a", + "createdAt [UTC]": "7/19/2023, 12:38:17 PM", + "id": 1732595655286628900, + "primaryDescription": "The management user Nick Man added a new Service User Darth with the description Darth to Crest Data Systems with role Admin.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "7/19/2023, 12:38:17 PM", + "userId": 1732595654439379500, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "description": "Darth", + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "roleName": "Admin", + "scopeLevel": "Account", + "scopeName": "Crest Data Systems", + "siteName": null, + "sourceType": "UI", + "username": "Darth" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/19/2023, 12:50:03 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 140, + "activityUuid": "3f33a1f3-9f08-490b-8f94-760a9135e13f", + "createdAt [UTC]": "7/19/2023, 12:39:28 PM", + "id": 1732596251003720700, + "primaryDescription": "The management user Nick Man added a new Service User Darth with the description Darth to Default site with role C-Level.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt [UTC]": "7/19/2023, 12:39:28 PM", + "userId": 1732595654439379500, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "description": "Darth", + "fullScopeDetails": "Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "roleName": "C-Level", + "scopeLevel": "Site", + "scopeName": "Default site", + "siteName": "Default site", + "sourceType": "UI", + "username": "Darth" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/6/2023, 12:50:14 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 5008, + "activityUuid": "327cc7b4-f116-490d-9a0b-53d572cce162", + "createdAt [UTC]": "6/22/2023, 12:44:45 PM", + "id": 1713029962565392400, + "primaryDescription": "The management user Nick Man created the new Manual Group: Crest Data Systems.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt [UTC]": "6/22/2023, 12:44:45 PM", + "userId": 1712986475444465000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "fullScopeDetails": "Group Crest Data Systems in Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site / Crest Data Systems", + "groupId": "1713029962380842894", + "groupName": "Crest Data Systems", + "groupType": "Manual", + "ipAddress": "1.1.1.1", + "realUser": null, + "scopeLevel": "Group", + "scopeName": "Crest Data Systems", + "siteName": "Default site", + "sourceType": "UI", + "username": "Nick Man" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": 1713029962380843000, + "groupIp": "", + "groupName": "Crest Data Systems", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/6/2023, 12:50:14 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 5008, + "activityUuid": "6a5ae272-d4df-4986-a8ec-b1c9c09ef60d", + "createdAt [UTC]": "7/4/2023, 6:04:46 AM", + "id": 1721525955893182000, + "primaryDescription": "The management user Dave created the new Manual Group: Test.", + "secondaryDescription": "IP address: 1.1.1.2", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt [UTC]": "7/4/2023, 6:04:46 AM", + "userId": 1716583470262263000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "fullScopeDetails": "Group Test in Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site / Test", + "groupId": "1721525955683466807", + "groupName": "Test", + "groupType": "Manual", + "ipAddress": "1.1.1.2", + "realUser": null, + "scopeLevel": "Group", + "scopeName": "Test", + "siteName": "Default site", + "sourceType": "UI", + "username": "Dave" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": 1721525955683466800, + "groupIp": "", + "groupName": "Test", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/19/2023, 12:50:03 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 142, + "activityUuid": "46b211c2-1223-4ff0-9cfc-a3fc7eed4b05", + "createdAt [UTC]": "7/19/2023, 12:39:28 PM", + "id": 1732596250928223200, + "primaryDescription": "The management user Nick Man deleted the Service User Darth from scope Crest Data Systems.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "7/19/2023, 12:39:28 PM", + "userId": 1732595654439379500, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "description": "Darth", + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "scopeLevel": "Account", + "scopeName": "Crest Data Systems", + "siteName": null, + "sourceType": "UI", + "username": "Darth" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 10:20:04 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 5006, + "activityUuid": "a180e2f3-fb7e-44fc-adfe-cbc5d250d9ed", + "createdAt [UTC]": "7/20/2023, 10:03:42 AM", + "id": 1733242623065122800, + "primaryDescription": "The management user Nirvadeleted the Manual Group: Test Group Activity.", + "secondaryDescription": "IP address: 1.1.1.2", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt [UTC]": "7/20/2023, 10:03:42 AM", + "userId": 1722466127522197200, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "fullScopeDetails": "Group Test Group Activity in Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site / Test Group Activity", + "groupId": 1733236199462385400, + "groupName": "Test Group Activity", + "groupType": "Manual", + "ipAddress": "1.1.1.2", + "realUser": null, + "scopeLevel": "Group", + "scopeName": "Test Group Activity", + "siteName": "Default site", + "sourceType": "UI", + "username": "Nirva" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": 1733236199462385400, + "groupIp": "", + "groupName": "Test Group Activity", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/19/2023, 12:50:03 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 25, + "activityUuid": "eded5a54-86c8-4337-9dff-e3e13a9305f2", + "createdAt [UTC]": "7/19/2023, 12:37:15 PM", + "id": 1732595136375644000, + "primaryDescription": "The management user Nick Man deleted the user Darth.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "7/19/2023, 12:37:15 PM", + "userId": 1732588998690212000, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "deactivationPeriodInDays": "90", + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "role": "Admin", + "scopeLevel": "Account", + "scopeName": "Crest Data Systems", + "siteName": null, + "sourceType": "UI", + "userScope": "account", + "username": "Darth" + }, + "description": "Nick Man", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/19/2023, 12:50:03 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 141, + "activityUuid": "df06ac01-c280-4a06-b3a3-0563c04b7e58", + "createdAt [UTC]": "7/19/2023, 12:38:55 PM", + "id": 1732595970044029400, + "primaryDescription": "The management user Nick Man changed the role of the Service User Darth on scope Crest Data Systems. Previous role: Admin. New role: SOC.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": "", + "siteName": "", + "updatedAt [UTC]": "7/19/2023, 12:38:55 PM", + "userId": 1732595654439379500, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "description": "Darth", + "descriptionChanged": false, + "fullScopeDetails": "Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems", + "groupName": null, + "ipAddress": "1.1.1.1", + "oldDescription": "N/A", + "oldRole": "Admin", + "realUser": null, + "role": "SOC", + "scopeLevel": "Account", + "scopeName": "Crest Data Systems", + "siteName": null, + "sourceType": "UI", + "username": "Darth" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/19/2023, 1:00:02 PM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 141, + "activityUuid": "f4804b82-7729-499d-9157-f1ea3aa7e361", + "createdAt [UTC]": "7/19/2023, 12:41:17 PM", + "id": 1732597165974508500, + "primaryDescription": "The management user Nick Man changed the role of the Service User Darth on scope Default site. Previous role: C-Level. New role: User Test.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt [UTC]": "7/19/2023, 12:41:17 PM", + "userId": 1732595654439379500, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "description": "Darth", + "descriptionChanged": false, + "fullScopeDetails": "Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site", + "groupName": null, + "ipAddress": "1.1.1.1", + "oldDescription": "N/A", + "oldRole": "C-Level", + "realUser": null, + "role": "User Test", + "scopeLevel": "Site", + "scopeName": "Default site", + "siteName": "Default site", + "sourceType": "UI", + "username": "Darth" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 11:50:04 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 111, + "activityUuid": "9cce98f3-b039-4ba0-a8f2-e0105b688546", + "createdAt [UTC]": "7/20/2023, 11:38:42 AM", + "id": 1733290437886321200, + "primaryDescription": "The management user Nick Man blocked the management user Nirvafrom generating API tokens.", + "secondaryDescription": "IP address: 1.1.1.1", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt [UTC]": "7/20/2023, 11:38:42 AM", + "userId": 1722466127522197200, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "byUser": "Nick Man", + "fullScopeDetails": "Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site", + "groupName": null, + "ipAddress": "1.1.1.1", + "realUser": null, + "role": "Admin", + "scopeLevel": "Site", + "scopeName": "Default site", + "siteName": "Default site", + "sourceType": "UI", + "userScope": "site", + "username": "Nirva" + }, + "description": "Nirva", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": "", + "groupIp": "", + "groupName": "", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + }, + { + "TenantId": "1a0e2567-2e58-4989-ad18-206108185325", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "7/20/2023, 10:20:04 AM", + "Computer": "", + "RawData": "", + "alertInfo_indicatorDescription": "", + "alertInfo_indicatorName": "", + "targetProcessInfo_tgtFileOldPath": "", + "alertInfo_indicatorCategory": "", + "alertInfo_registryOldValue": "", + "alertInfo_dstIp": "", + "alertInfo_dstPort": "", + "alertInfo_netEventDirection": "", + "alertInfo_srcIp": "", + "alertInfo_srcPort": "", + "containerInfo_id": "", + "targetProcessInfo_tgtFileId": "", + "alertInfo_registryOldValueType": "", + "alertInfo_dnsRequest": "", + "alertInfo_dnsResponse": "", + "alertInfo_registryKeyPath": "", + "alertInfo_registryPath": "", + "alertInfo_registryValue": "", + "ruleInfo_description": "", + "alertInfo_loginAccountDomain": "", + "alertInfo_loginAccountSid": "", + "alertInfo_loginIsAdministratorEquivalent": "", + "alertInfo_loginIsSuccessful": "", + "alertInfo_loginType": "", + "alertInfo_loginsUserName": "", + "alertInfo_srcMachineIp": "", + "targetProcessInfo_tgtProcCmdLine": "", + "targetProcessInfo_tgtProcImagePath": "", + "targetProcessInfo_tgtProcName": "", + "targetProcessInfo_tgtProcPid": "", + "targetProcessInfo_tgtProcSignedStatus": "", + "targetProcessInfo_tgtProcStorylineId": "", + "targetProcessInfo_tgtProcUid": "", + "sourceParentProcessInfo_storyline": "", + "sourceParentProcessInfo_uniqueId": "", + "sourceProcessInfo_storyline": "", + "sourceProcessInfo_uniqueId": "", + "agentDetectionInfo_machineType": "", + "agentDetectionInfo_name": "", + "agentDetectionInfo_osFamily": "", + "agentDetectionInfo_osName": "", + "agentDetectionInfo_osRevision": "", + "agentDetectionInfo_uuid": "", + "agentDetectionInfo_version": "", + "agentRealtimeInfo_id": "", + "agentRealtimeInfo_infected_b": "", + "agentRealtimeInfo_isActive_b": "", + "agentRealtimeInfo_isDecommissioned_b": "", + "agentRealtimeInfo_machineType": "", + "agentRealtimeInfo_name": "", + "agentRealtimeInfo_os": "", + "agentRealtimeInfo_uuid": "", + "alertInfo_alertId": "", + "alertInfo_analystVerdict": "", + "alertInfo_createdAt [UTC]": "", + "alertInfo_dvEventId": "", + "alertInfo_eventType": "", + "alertInfo_hitType": "", + "alertInfo_incidentStatus": "", + "alertInfo_isEdr_b": "", + "alertInfo_reportedAt [UTC]": "", + "alertInfo_source": "", + "alertInfo_updatedAt [UTC]": "", + "ruleInfo_id": "", + "ruleInfo_name": "", + "ruleInfo_queryLang": "", + "ruleInfo_queryType": "", + "ruleInfo_s1ql": "", + "ruleInfo_scopeLevel": "", + "ruleInfo_severity": "", + "ruleInfo_treatAsThreat": "", + "sourceParentProcessInfo_commandline": "", + "sourceParentProcessInfo_fileHashMd5": "", + "sourceParentProcessInfo_fileHashSha1": "", + "sourceParentProcessInfo_fileHashSha256": "", + "sourceParentProcessInfo_filePath": "", + "sourceParentProcessInfo_fileSignerIdentity": "", + "sourceParentProcessInfo_integrityLevel": "", + "sourceParentProcessInfo_name": "", + "sourceParentProcessInfo_pid": "", + "sourceParentProcessInfo_pidStarttime [UTC]": "", + "sourceParentProcessInfo_subsystem": "", + "sourceParentProcessInfo_user": "", + "sourceProcessInfo_commandline": "", + "sourceProcessInfo_fileHashMd5": "", + "sourceProcessInfo_fileHashSha1": "", + "sourceProcessInfo_fileHashSha256": "", + "sourceProcessInfo_filePath": "", + "sourceProcessInfo_fileSignerIdentity": "", + "sourceProcessInfo_integrityLevel": "", + "sourceProcessInfo_name": "", + "sourceProcessInfo_pid": "", + "sourceProcessInfo_pidStarttime [UTC]": "", + "sourceProcessInfo_subsystem": "", + "sourceProcessInfo_user": "", + "targetProcessInfo_tgtFileCreatedAt [UTC]": "", + "targetProcessInfo_tgtFileHashSha1": "", + "targetProcessInfo_tgtFileHashSha256": "", + "targetProcessInfo_tgtFileIsSigned": "", + "targetProcessInfo_tgtFileModifiedAt [UTC]": "", + "targetProcessInfo_tgtFilePath": "", + "targetProcessInfo_tgtProcIntegrityLevel": "", + "targetProcessInfo_tgtProcessStartTime [UTC]": "", + "agentUpdatedVersion": "", + "agentId": "", + "hash": "", + "osFamily": "", + "threatId": "", + "creator": "", + "creatorId": "", + "inherits_b": "", + "isDefault_b": "", + "name": "", + "registrationToken": "", + "totalAgents": "", + "type": "", + "agentDetectionInfo_accountId": "", + "agentDetectionInfo_accountName": "", + "agentDetectionInfo_agentDetectionState": "", + "agentDetectionInfo_agentDomain": "", + "agentDetectionInfo_agentIpV4": "", + "agentDetectionInfo_agentIpV6": "", + "agentDetectionInfo_agentLastLoggedInUserName": "", + "agentDetectionInfo_agentMitigationMode": "", + "agentDetectionInfo_agentOsName": "", + "agentDetectionInfo_agentOsRevision": "", + "agentDetectionInfo_agentRegisteredAt [UTC]": "", + "agentDetectionInfo_agentUuid": "", + "agentDetectionInfo_agentVersion": "", + "agentDetectionInfo_externalIp": "", + "agentDetectionInfo_groupId": "", + "agentDetectionInfo_groupName": "", + "agentDetectionInfo_siteId": "", + "agentDetectionInfo_siteName": "", + "agentRealtimeInfo_accountId": "", + "agentRealtimeInfo_accountName": "", + "agentRealtimeInfo_activeThreats": "", + "agentRealtimeInfo_agentComputerName": "", + "agentRealtimeInfo_agentDomain": "", + "agentRealtimeInfo_agentId": "", + "agentRealtimeInfo_agentInfected_b": "", + "agentRealtimeInfo_agentIsActive_b": "", + "agentRealtimeInfo_agentIsDecommissioned_b": "", + "agentRealtimeInfo_agentMachineType": "", + "agentRealtimeInfo_agentMitigationMode": "", + "agentRealtimeInfo_agentNetworkStatus": "", + "agentRealtimeInfo_agentOsName": "", + "agentRealtimeInfo_agentOsRevision": "", + "agentRealtimeInfo_agentOsType": "", + "agentRealtimeInfo_agentUuid": "", + "agentRealtimeInfo_agentVersion": "", + "agentRealtimeInfo_groupId": "", + "agentRealtimeInfo_groupName": "", + "agentRealtimeInfo_networkInterfaces": "", + "agentRealtimeInfo_operationalState": "", + "agentRealtimeInfo_rebootRequired_b": "", + "agentRealtimeInfo_scanFinishedAt [UTC]": "", + "agentRealtimeInfo_scanStartedAt [UTC]": "", + "agentRealtimeInfo_scanStatus": "", + "agentRealtimeInfo_siteId": "", + "agentRealtimeInfo_siteName": "", + "agentRealtimeInfo_userActionsNeeded": "", + "indicators": "", + "mitigationStatus": "", + "threatInfo_analystVerdict": "", + "threatInfo_analystVerdictDescription": "", + "threatInfo_automaticallyResolved_b": "", + "threatInfo_certificateId": "", + "threatInfo_classification": "", + "threatInfo_classificationSource": "", + "threatInfo_cloudFilesHashVerdict": "", + "threatInfo_collectionId": "", + "threatInfo_confidenceLevel": "", + "threatInfo_createdAt [UTC]": "", + "threatInfo_detectionEngines": "", + "threatInfo_detectionType": "", + "threatInfo_engines": "", + "threatInfo_externalTicketExists_b": "", + "threatInfo_failedActions_b": "", + "threatInfo_fileExtension": "", + "threatInfo_fileExtensionType": "", + "threatInfo_filePath": "", + "threatInfo_fileSize": "", + "threatInfo_fileVerificationType": "", + "threatInfo_identifiedAt [UTC]": "", + "threatInfo_incidentStatus": "", + "threatInfo_incidentStatusDescription": "", + "threatInfo_initiatedBy": "", + "threatInfo_initiatedByDescription": "", + "threatInfo_isFileless_b": "", + "threatInfo_isValidCertificate_b": "", + "threatInfo_mitigatedPreemptively_b": "", + "threatInfo_mitigationStatus": "", + "threatInfo_mitigationStatusDescription": "", + "threatInfo_originatorProcess": "", + "threatInfo_pendingActions_b": "", + "threatInfo_processUser": "", + "threatInfo_publisherName": "", + "threatInfo_reachedarthentsLimit_b": "", + "threatInfo_rebootRequired_b": "", + "threatInfo_sha1": "", + "threatInfo_storyline": "", + "threatInfo_threatId": "", + "threatInfo_threatName": "", + "threatInfo_updatedAt [UTC]": "", + "whiteningOptions": "", + "threatInfo_maliciousProcessArguments": "", + "accountId": 1712500237934148900, + "accountName": "Crest Data Systems", + "activityType": 5011, + "activityUuid": "1b86a2ea-9f84-4e5b-a918-a521b20d8f09", + "createdAt [UTC]": "7/20/2023, 10:07:15 AM", + "id": 1733244408404449300, + "primaryDescription": "The management user Nirvareverted the policy of Group Test Pinned group to its Site policy.", + "secondaryDescription": "IP address: 1.1.1.2", + "siteId": 1712500242422055200, + "siteName": "Default site", + "updatedAt [UTC]": "7/20/2023, 10:07:14 AM", + "userId": 1722466127522197200, + "event_name": "Activities.", + "DataFields": { + "accountName": "Crest Data Systems", + "fullScopeDetails": "Group Test Pinned group in Site Default site of Account Crest Data Systems", + "fullScopeDetailsPath": "Global / Crest Data Systems / Default site / Test Pinned group", + "groupId": "1733241822456258550", + "groupName": "Test Pinned group", + "groupType": "Pinned", + "ipAddress": "1.1.1.2", + "realUser": null, + "scopeLevel": "Group", + "scopeName": "Test Pinned group", + "siteName": "Default site", + "sourceType": "UI", + "username": "Nirva" + }, + "description": "", + "comments": "", + "activeDirectory_computerMemberOf": "", + "activeDirectory_lastUserMemberOf": "", + "activeThreats": "", + "agentVersion": "", + "allowRemoteShell_b": "", + "appsVulnerabilityStatus": "", + "computerName": "", + "consoleMigrationStatus": "", + "coreCount": "", + "cpuCount": "", + "cpuId": "", + "detectionState": "", + "domain": "", + "encryptedApplications_b": "", + "externalId": "", + "externalIp": "", + "firewallEnabled_b": "", + "firstFullModeTime [UTC]": "", + "fullDiskScanLastUpdatedAt [UTC]": "", + "groupId": 1733241822456258600, + "groupIp": "", + "groupName": "Test Pinned group", + "inRemoteShellSession_b": "", + "infected_b": "", + "installerType": "", + "isActive_b": "", + "isDecommissioned_b": "", + "isPendingUninstall_b": "", + "isUninstalled_b": "", + "isUpToDate_b": "", + "lastActiveDate [UTC]": "", + "lastIpToMgmt": "", + "lastLoggedInUserName": "", + "licenseKey": "", + "locationEnabled_b": "", + "locationType": "", + "locations": "", + "machineType": "", + "mitigationMode": "", + "mitigationModeSuspicious": "", + "modelName": "", + "networkInterfaces": "", + "networkQuarantineEnabled_b": "", + "networkStatus": "", + "operationalState": "", + "osArch": "", + "osName": "", + "osRevision": "", + "osStartTime [UTC]": "", + "osType": "", + "rangerStatus": "", + "rangerVersion": "", + "registeredAt [UTC]": "", + "remoteProfilingState": "", + "scanFinishedAt [UTC]": "", + "scanStartedAt [UTC]": "", + "scanStatus": "", + "serialNumber": "", + "showAlertIcon_b": "", + "tags_sentinelone": "", + "threatRebootRequired_b": "", + "totalMemory": "", + "userActionsNeeded": "", + "uuid": "", + "osUsername": "", + "scanAbortedAt [UTC]": "", + "activeDirectory_computerDistinguishedName": "", + "activeDirectory_lastUserDistinguishedName": "", + "Type": "SentinelOne_CL", + "_ResourceId": "" + } +] \ No newline at end of file diff --git a/Sample Data/ASIM/SentinelOne_CL_Schema.csv b/Sample Data/ASIM/SentinelOne_CL_Schema.csv new file mode 100644 index 00000000000..ff16136c833 --- /dev/null +++ b/Sample Data/ASIM/SentinelOne_CL_Schema.csv @@ -0,0 +1,314 @@ +ColumnName,ColumnOrdinal,DataType,ColumnType +TenantId,0,"System.String",string +SourceSystem,1,"System.String",string +MG,2,"System.String",string +ManagementGroupName,3,"System.String",string +TimeGenerated,4,"System.DateTime",datetime +Computer,5,"System.String",string +RawData,6,"System.String",string +"alertInfo_indicatorDescription_s",7,"System.String",string +"alertInfo_indicatorName_s",8,"System.String",string +"targetProcessInfo_tgtFileOldPath_s",9,"System.String",string +"alertInfo_indicatorCategory_s",10,"System.String",string +"alertInfo_registryOldValue_g",11,"System.String",string +"alertInfo_dstIp_s",12,"System.String",string +"alertInfo_dstPort_s",13,"System.String",string +"alertInfo_netEventDirection_s",14,"System.String",string +"alertInfo_srcIp_s",15,"System.String",string +"alertInfo_srcPort_s",16,"System.String",string +"containerInfo_id_s",17,"System.String",string +"targetProcessInfo_tgtFileId_g",18,"System.String",string +"alertInfo_registryOldValue_s",19,"System.String",string +"alertInfo_registryOldValueType_s",20,"System.String",string +"alertInfo_dnsRequest_s",21,"System.String",string +"alertInfo_dnsResponse_s",22,"System.String",string +"alertInfo_registryKeyPath_s",23,"System.String",string +"alertInfo_registryPath_s",24,"System.String",string +"alertInfo_registryValue_g",25,"System.String",string +"ruleInfo_description_s",26,"System.String",string +"alertInfo_registryValue_s",27,"System.String",string +"alertInfo_loginAccountDomain_s",28,"System.String",string +"alertInfo_loginAccountSid_s",29,"System.String",string +"alertInfo_loginIsAdministratorEquivalent_s",30,"System.String",string +"alertInfo_loginIsSuccessful_s",31,"System.String",string +"alertInfo_loginType_s",32,"System.String",string +"alertInfo_loginsUserName_s",33,"System.String",string +"alertInfo_srcMachineIp_s",34,"System.String",string +"targetProcessInfo_tgtProcCmdLine_s",35,"System.String",string +"targetProcessInfo_tgtProcImagePath_s",36,"System.String",string +"targetProcessInfo_tgtProcName_s",37,"System.String",string +"targetProcessInfo_tgtProcPid_s",38,"System.String",string +"targetProcessInfo_tgtProcSignedStatus_s",39,"System.String",string +"targetProcessInfo_tgtProcStorylineId_s",40,"System.String",string +"targetProcessInfo_tgtProcUid_s",41,"System.String",string +"sourceParentProcessInfo_storyline_g",42,"System.String",string +"sourceParentProcessInfo_uniqueId_g",43,"System.String",string +"sourceProcessInfo_storyline_g",44,"System.String",string +"sourceProcessInfo_uniqueId_g",45,"System.String",string +"targetProcessInfo_tgtProcStorylineId_g",46,"System.String",string +"targetProcessInfo_tgtProcUid_g",47,"System.String",string +"agentDetectionInfo_machineType_s",48,"System.String",string +"agentDetectionInfo_name_s",49,"System.String",string +"agentDetectionInfo_osFamily_s",50,"System.String",string +"agentDetectionInfo_osName_s",51,"System.String",string +"agentDetectionInfo_osRevision_s",52,"System.String",string +"agentDetectionInfo_uuid_g",53,"System.String",string +"agentDetectionInfo_version_s",54,"System.String",string +"agentRealtimeInfo_id_s",55,"System.String",string +"agentRealtimeInfo_infected_b",56,"System.SByte",bool +"agentRealtimeInfo_isActive_b",57,"System.SByte",bool +"agentRealtimeInfo_isDecommissioned_b",58,"System.SByte",bool +"agentRealtimeInfo_machineType_s",59,"System.String",string +"agentRealtimeInfo_name_s",60,"System.String",string +"agentRealtimeInfo_os_s",61,"System.String",string +"agentRealtimeInfo_uuid_g",62,"System.String",string +"alertInfo_alertId_s",63,"System.String",string +"alertInfo_analystVerdict_s",64,"System.String",string +"alertInfo_createdAt_t",65,"System.DateTime",datetime +"alertInfo_dvEventId_s",66,"System.String",string +"alertInfo_eventType_s",67,"System.String",string +"alertInfo_hitType_s",68,"System.String",string +"alertInfo_incidentStatus_s",69,"System.String",string +"alertInfo_isEdr_b",70,"System.SByte",bool +"alertInfo_reportedAt_t",71,"System.DateTime",datetime +"alertInfo_source_s",72,"System.String",string +"alertInfo_updatedAt_t",73,"System.DateTime",datetime +"ruleInfo_id_s",74,"System.String",string +"ruleInfo_name_s",75,"System.String",string +"ruleInfo_queryLang_s",76,"System.String",string +"ruleInfo_queryType_s",77,"System.String",string +"ruleInfo_s1ql_s",78,"System.String",string +"ruleInfo_scopeLevel_s",79,"System.String",string +"ruleInfo_severity_s",80,"System.String",string +"ruleInfo_treatAsThreat_s",81,"System.String",string +"sourceParentProcessInfo_commandline_s",82,"System.String",string +"sourceParentProcessInfo_fileHashMd5_g",83,"System.String",string +"sourceParentProcessInfo_fileHashSha1_s",84,"System.String",string +"sourceParentProcessInfo_fileHashSha256_s",85,"System.String",string +"sourceParentProcessInfo_filePath_s",86,"System.String",string +"sourceParentProcessInfo_fileSignerIdentity_s",87,"System.String",string +"sourceParentProcessInfo_integrityLevel_s",88,"System.String",string +"sourceParentProcessInfo_name_s",89,"System.String",string +"sourceParentProcessInfo_pid_s",90,"System.String",string +"sourceParentProcessInfo_pidStarttime_t",91,"System.DateTime",datetime +"sourceParentProcessInfo_storyline_s",92,"System.String",string +"sourceParentProcessInfo_subsystem_s",93,"System.String",string +"sourceParentProcessInfo_uniqueId_s",94,"System.String",string +"sourceParentProcessInfo_user_s",95,"System.String",string +"sourceProcessInfo_commandline_s",96,"System.String",string +"sourceProcessInfo_fileHashMd5_g",97,"System.String",string +"sourceProcessInfo_fileHashSha1_s",98,"System.String",string +"sourceProcessInfo_fileHashSha256_s",99,"System.String",string +"sourceProcessInfo_filePath_s",100,"System.String",string +"sourceProcessInfo_fileSignerIdentity_s",101,"System.String",string +"sourceProcessInfo_integrityLevel_s",102,"System.String",string +"sourceProcessInfo_name_s",103,"System.String",string +"sourceProcessInfo_pid_s",104,"System.String",string +"sourceProcessInfo_pidStarttime_t",105,"System.DateTime",datetime +"sourceProcessInfo_storyline_s",106,"System.String",string +"sourceProcessInfo_subsystem_s",107,"System.String",string +"sourceProcessInfo_uniqueId_s",108,"System.String",string +"sourceProcessInfo_user_s",109,"System.String",string +"targetProcessInfo_tgtFileCreatedAt_t",110,"System.DateTime",datetime +"targetProcessInfo_tgtFileHashSha1_s",111,"System.String",string +"targetProcessInfo_tgtFileHashSha256_s",112,"System.String",string +"targetProcessInfo_tgtFileId_s",113,"System.String",string +"targetProcessInfo_tgtFileIsSigned_s",114,"System.String",string +"targetProcessInfo_tgtFileModifiedAt_t",115,"System.DateTime",datetime +"targetProcessInfo_tgtFilePath_s",116,"System.String",string +"targetProcessInfo_tgtProcIntegrityLevel_s",117,"System.String",string +"targetProcessInfo_tgtProcessStartTime_t",118,"System.DateTime",datetime +"agentUpdatedVersion_s",119,"System.String",string +"agentId_s",120,"System.String",string +"hash_s",121,"System.String",string +"osFamily_s",122,"System.String",string +"threatId_s",123,"System.String",string +"creator_s",124,"System.String",string +"creatorId_s",125,"System.String",string +"inherits_b",126,"System.SByte",bool +"isDefault_b",127,"System.SByte",bool +"name_s",128,"System.String",string +"registrationToken_s",129,"System.String",string +"totalAgents_d",130,"System.Double",real +"type_s",131,"System.String",string +"agentDetectionInfo_accountId_s",132,"System.String",string +"agentDetectionInfo_accountName_s",133,"System.String",string +"agentDetectionInfo_agentDetectionState_s",134,"System.String",string +"agentDetectionInfo_agentDomain_s",135,"System.String",string +"agentDetectionInfo_agentIpV4_s",136,"System.String",string +"agentDetectionInfo_agentIpV6_s",137,"System.String",string +"agentDetectionInfo_agentLastLoggedInUserName_s",138,"System.String",string +"agentDetectionInfo_agentMitigationMode_s",139,"System.String",string +"agentDetectionInfo_agentOsName_s",140,"System.String",string +"agentDetectionInfo_agentOsRevision_s",141,"System.String",string +"agentDetectionInfo_agentRegisteredAt_t",142,"System.DateTime",datetime +"agentDetectionInfo_agentUuid_g",143,"System.String",string +"agentDetectionInfo_agentVersion_s",144,"System.String",string +"agentDetectionInfo_externalIp_s",145,"System.String",string +"agentDetectionInfo_groupId_s",146,"System.String",string +"agentDetectionInfo_groupName_s",147,"System.String",string +"agentDetectionInfo_siteId_s",148,"System.String",string +"agentDetectionInfo_siteName_s",149,"System.String",string +"agentRealtimeInfo_accountId_s",150,"System.String",string +"agentRealtimeInfo_accountName_s",151,"System.String",string +"agentRealtimeInfo_activeThreats_d",152,"System.Double",real +"agentRealtimeInfo_agentComputerName_s",153,"System.String",string +"agentRealtimeInfo_agentDomain_s",154,"System.String",string +"agentRealtimeInfo_agentId_s",155,"System.String",string +"agentRealtimeInfo_agentInfected_b",156,"System.SByte",bool +"agentRealtimeInfo_agentIsActive_b",157,"System.SByte",bool +"agentRealtimeInfo_agentIsDecommissioned_b",158,"System.SByte",bool +"agentRealtimeInfo_agentMachineType_s",159,"System.String",string +"agentRealtimeInfo_agentMitigationMode_s",160,"System.String",string +"agentRealtimeInfo_agentNetworkStatus_s",161,"System.String",string +"agentRealtimeInfo_agentOsName_s",162,"System.String",string +"agentRealtimeInfo_agentOsRevision_s",163,"System.String",string +"agentRealtimeInfo_agentOsType_s",164,"System.String",string +"agentRealtimeInfo_agentUuid_g",165,"System.String",string +"agentRealtimeInfo_agentVersion_s",166,"System.String",string +"agentRealtimeInfo_groupId_s",167,"System.String",string +"agentRealtimeInfo_groupName_s",168,"System.String",string +"agentRealtimeInfo_networkInterfaces_s",169,"System.String",string +"agentRealtimeInfo_operationalState_s",170,"System.String",string +"agentRealtimeInfo_rebootRequired_b",171,"System.SByte",bool +"agentRealtimeInfo_scanFinishedAt_t",172,"System.DateTime",datetime +"agentRealtimeInfo_scanStartedAt_t",173,"System.DateTime",datetime +"agentRealtimeInfo_scanStatus_s",174,"System.String",string +"agentRealtimeInfo_siteId_s",175,"System.String",string +"agentRealtimeInfo_siteName_s",176,"System.String",string +"agentRealtimeInfo_userActionsNeeded_s",177,"System.String",string +"indicators_s",178,"System.String",string +"mitigationStatus_s",179,"System.String",string +"threatInfo_analystVerdict_s",180,"System.String",string +"threatInfo_analystVerdictDescription_s",181,"System.String",string +"threatInfo_automaticallyResolved_b",182,"System.SByte",bool +"threatInfo_certificateId_s",183,"System.String",string +"threatInfo_classification_s",184,"System.String",string +"threatInfo_classificationSource_s",185,"System.String",string +"threatInfo_cloudFilesHashVerdict_s",186,"System.String",string +"threatInfo_collectionId_s",187,"System.String",string +"threatInfo_confidenceLevel_s",188,"System.String",string +"threatInfo_createdAt_t",189,"System.DateTime",datetime +"threatInfo_detectionEngines_s",190,"System.String",string +"threatInfo_detectionType_s",191,"System.String",string +"threatInfo_engines_s",192,"System.String",string +"threatInfo_externalTicketExists_b",193,"System.SByte",bool +"threatInfo_failedActions_b",194,"System.SByte",bool +"threatInfo_fileExtension_s",195,"System.String",string +"threatInfo_fileExtensionType_s",196,"System.String",string +"threatInfo_filePath_s",197,"System.String",string +"threatInfo_fileSize_d",198,"System.Double",real +"threatInfo_fileVerificationType_s",199,"System.String",string +"threatInfo_identifiedAt_t",200,"System.DateTime",datetime +"threatInfo_incidentStatus_s",201,"System.String",string +"threatInfo_incidentStatusDescription_s",202,"System.String",string +"threatInfo_initiatedBy_s",203,"System.String",string +"threatInfo_initiatedByDescription_s",204,"System.String",string +"threatInfo_isFileless_b",205,"System.SByte",bool +"threatInfo_isValidCertificate_b",206,"System.SByte",bool +"threatInfo_mitigatedPreemptively_b",207,"System.SByte",bool +"threatInfo_mitigationStatus_s",208,"System.String",string +"threatInfo_mitigationStatusDescription_s",209,"System.String",string +"threatInfo_originatorProcess_s",210,"System.String",string +"threatInfo_pendingActions_b",211,"System.SByte",bool +"threatInfo_processUser_s",212,"System.String",string +"threatInfo_publisherName_s",213,"System.String",string +"threatInfo_reachedEventsLimit_b",214,"System.SByte",bool +"threatInfo_rebootRequired_b",215,"System.SByte",bool +"threatInfo_sha1_s",216,"System.String",string +"threatInfo_storyline_s",217,"System.String",string +"threatInfo_threatId_s",218,"System.String",string +"threatInfo_threatName_s",219,"System.String",string +"threatInfo_updatedAt_t",220,"System.DateTime",datetime +"whiteningOptions_s",221,"System.String",string +"threatInfo_maliciousProcessArguments_s",222,"System.String",string +"threatInfo_fileExtension_g",223,"System.String",string +"threatInfo_threatName_g",224,"System.String",string +"threatInfo_storyline_g",225,"System.String",string +"accountId_s",226,"System.String",string +"accountName_s",227,"System.String",string +"activityType_d",228,"System.Double",real +"activityUuid_g",229,"System.String",string +"createdAt_t",230,"System.DateTime",datetime +"id_s",231,"System.String",string +"primaryDescription_s",232,"System.String",string +"secondaryDescription_s",233,"System.String",string +"siteId_s",234,"System.String",string +"siteName_s",235,"System.String",string +"updatedAt_t",236,"System.DateTime",datetime +"userId_s",237,"System.String",string +"event_name_s",238,"System.String",string +"DataFields_s",239,"System.String",string +"description_s",240,"System.String",string +"comments_s",241,"System.String",string +"activeDirectory_computerMemberOf_s",242,"System.String",string +"activeDirectory_lastUserMemberOf_s",243,"System.String",string +"activeThreats_d",244,"System.Double",real +"agentVersion_s",245,"System.String",string +"allowRemoteShell_b",246,"System.SByte",bool +"appsVulnerabilityStatus_s",247,"System.String",string +"computerName_s",248,"System.String",string +"consoleMigrationStatus_s",249,"System.String",string +"coreCount_d",250,"System.Double",real +"cpuCount_d",251,"System.Double",real +"cpuId_s",252,"System.String",string +"detectionState_s",253,"System.String",string +"domain_s",254,"System.String",string +"encryptedApplications_b",255,"System.SByte",bool +"externalId_s",256,"System.String",string +"externalIp_s",257,"System.String",string +"firewallEnabled_b",258,"System.SByte",bool +"firstFullModeTime_t",259,"System.DateTime",datetime +"fullDiskScanLastUpdatedAt_t",260,"System.DateTime",datetime +"groupId_s",261,"System.String",string +"groupIp_s",262,"System.String",string +"groupName_s",263,"System.String",string +"inRemoteShellSession_b",264,"System.SByte",bool +"infected_b",265,"System.SByte",bool +"installerType_s",266,"System.String",string +"isActive_b",267,"System.SByte",bool +"isDecommissioned_b",268,"System.SByte",bool +"isPendingUninstall_b",269,"System.SByte",bool +"isUninstalled_b",270,"System.SByte",bool +"isUpToDate_b",271,"System.SByte",bool +"lastActiveDate_t",272,"System.DateTime",datetime +"lastIpToMgmt_s",273,"System.String",string +"lastLoggedInUserName_s",274,"System.String",string +"licenseKey_s",275,"System.String",string +"locationEnabled_b",276,"System.SByte",bool +"locationType_s",277,"System.String",string +"locations_s",278,"System.String",string +"machineType_s",279,"System.String",string +"mitigationMode_s",280,"System.String",string +"mitigationModeSuspicious_s",281,"System.String",string +"modelName_s",282,"System.String",string +"networkInterfaces_s",283,"System.String",string +"networkQuarantineEnabled_b",284,"System.SByte",bool +"networkStatus_s",285,"System.String",string +"operationalState_s",286,"System.String",string +"osArch_s",287,"System.String",string +"osName_s",288,"System.String",string +"osRevision_s",289,"System.String",string +"osStartTime_t",290,"System.DateTime",datetime +"osType_s",291,"System.String",string +"rangerStatus_s",292,"System.String",string +"rangerVersion_s",293,"System.String",string +"registeredAt_t",294,"System.DateTime",datetime +"remoteProfilingState_s",295,"System.String",string +"scanFinishedAt_t",296,"System.DateTime",datetime +"scanStartedAt_t",297,"System.DateTime",datetime +"scanStatus_s",298,"System.String",string +"serialNumber_s",299,"System.String",string +"showAlertIcon_b",300,"System.SByte",bool +"tags_sentinelone_s",301,"System.String",string +"threatRebootRequired_b",302,"System.SByte",bool +"totalMemory_d",303,"System.Double",real +"userActionsNeeded_s",304,"System.String",string +"uuid_g",305,"System.String",string +"osUsername_s",306,"System.String",string +"scanAbortedAt_t",307,"System.DateTime",datetime +"activeDirectory_computerDistinguishedName_s",308,"System.String",string +"activeDirectory_lastUserDistinguishedName_s",309,"System.String",string +Type,310,"System.String",string +"_ResourceId",311,"System.String",string +"_ItemId",312,"System.String",string diff --git a/Sample Data/Custom/MimecastDLP_CL.json b/Sample Data/Custom/MimecastDLP_CL.json new file mode 100644 index 00000000000..db78599be2d --- /dev/null +++ b/Sample Data/Custom/MimecastDLP_CL.json @@ -0,0 +1,716 @@ +[ + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/20/2021, 1:06:40.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Tell Us How You Integrate IT Security and App Dev", + "eventTime_t [UTC]": "12/20/2021, 1:06:40.000 PM", + "route_s": "inbound", + "policy_s": "Smart Tag - Confidential", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/20/2021, 1:06:42.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Tell Us How You Integrate IT Security and App Dev", + "eventTime_t [UTC]": "12/20/2021, 1:06:42.000 PM", + "route_s": "inbound", + "policy_s": "Smart Tag - Confidential", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/20/2021, 1:07:17.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Tell Us How You Integrate IT Security and App Dev", + "eventTime_t [UTC]": "12/20/2021, 1:07:17.000 PM", + "route_s": "inbound", + "policy_s": "Smart Tag - Confidential", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/20/2021, 1:08:00.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Tell Us How You Integrate IT Security and App Dev", + "eventTime_t [UTC]": "12/20/2021, 1:08:00.000 PM", + "route_s": "inbound", + "policy_s": "Smart Tag - Confidential", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/20/2021, 1:09:04.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Tell Us How You Integrate IT Security and App Dev", + "eventTime_t [UTC]": "12/20/2021, 1:09:04.000 PM", + "route_s": "inbound", + "policy_s": "Smart Tag - Confidential", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/23/2021, 4:13:39.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "När Stockholm växer måste de flyttas bort", + "eventTime_t [UTC]": "12/23/2021, 4:13:39.000 PM", + "route_s": "inbound", + "policy_s": "Content Inspection - Profanity internal and external", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/23/2021, 12:35:05.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Big Tech salaries revealed: How much engineers, developers, and product managers make at companies including Apple, Amazon, Facebook, Google, Microsoft, Intel, Uber, IBM, and Salesforce", + "eventTime_t [UTC]": "12/23/2021, 12:35:05.000 PM", + "route_s": "inbound", + "policy_s": "Content Inspection - Profanity internal and external", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/23/2021, 9:07:38.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Greetings", + "eventTime_t [UTC]": "12/23/2021, 9:07:38.000 PM", + "route_s": "inbound", + "policy_s": "Smart Tag - Confidential", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/25/2021, 11:56:01.000 AM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Volume 3, Issue 96: Theologians", + "eventTime_t [UTC]": "12/25/2021, 11:56:01.000 AM", + "route_s": "inbound", + "policy_s": "Content Inspection - Profanity internal and external", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/25/2021, 2:07:10.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Xmas with Marjorie Taylor Greene", + "eventTime_t [UTC]": "12/25/2021, 2:07:10.000 PM", + "route_s": "inbound", + "policy_s": "Content Inspection - Profanity internal and external", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/25/2021, 2:11:49.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "How Jonny Greenwood Wrote the Year’s Best Film Score—2021’s Top Cookbooks—Joan Didion", + "eventTime_t [UTC]": "12/25/2021, 2:11:49.000 PM", + "route_s": "inbound", + "policy_s": "Content Inspection - Profanity internal and external", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/24/2021, 10:26:14.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Daily Humor: The Top Ten Holiday Trends of 2021", + "eventTime_t [UTC]": "12/24/2021, 10:26:14.000 PM", + "route_s": "inbound", + "policy_s": "Content Inspection - Profanity internal and external", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/24/2021, 10:30:48.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "“The Matrix Resurrections” Picks Up Where the Trilogy Left Off—Alas", + "eventTime_t [UTC]": "12/24/2021, 10:30:48.000 PM", + "route_s": "inbound", + "policy_s": "Content Inspection - Profanity internal and external", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/25/2021, 8:31:13.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Books & Fiction: Modernism’s Forgotten Mystic", + "eventTime_t [UTC]": "12/25/2021, 8:31:13.000 PM", + "route_s": "inbound", + "policy_s": "Content Inspection - Profanity internal and external", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/22/2021, 8:19:16.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Crossword Puzzles, Anorexia, and the Search for Order", + "eventTime_t [UTC]": "12/22/2021, 8:19:16.000 PM", + "route_s": "inbound", + "policy_s": "Content Inspection - Profanity internal and external", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 2:26:02.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "FW: [EXTERNAL] file with credit card numbers?", + "eventTime_t [UTC]": "12/21/2021, 2:26:02.000 PM", + "route_s": "inbound", + "policy_s": "Smart Tag - Confidential", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 2:26:02.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "FW: [EXTERNAL] file with credit card numbers?", + "eventTime_t [UTC]": "12/21/2021, 2:26:02.000 PM", + "route_s": "inbound", + "policy_s": "Data Leak Prevention - Credit Cards", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 2:26:02.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_hold", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "FW: [EXTERNAL] file with credit card numbers?", + "eventTime_t [UTC]": "12/21/2021, 2:26:02.000 PM", + "route_s": "inbound", + "policy_s": "Data Leak Prevention - Credit Cards", + "action_s": "hold", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 2:26:02.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_secure_delivery", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "FW: [EXTERNAL] file with credit card numbers?", + "eventTime_t [UTC]": "12/21/2021, 2:26:02.000 PM", + "route_s": "inbound", + "policy_s": "Data Leak Prevention - Credit Cards", + "action_s": "secure_delivery", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/20/2021, 8:35:00.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Re: Secure Message Services", + "eventTime_t [UTC]": "12/20/2021, 8:35:00.000 PM", + "route_s": "inbound", + "policy_s": "Smart Tag - Confidential", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/20/2021, 8:49:38.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "FW: Secure Message Services", + "eventTime_t [UTC]": "12/20/2021, 8:49:38.000 PM", + "route_s": "outbound", + "policy_s": "Smart Tag - Confidential", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/20/2021, 8:49:38.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_stationery", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "FW: Secure Message Services", + "eventTime_t [UTC]": "12/20/2021, 8:49:38.000 PM", + "route_s": "outbound", + "policy_s": "Stationery override - no disc", + "action_s": "stationery", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/20/2021, 8:49:38.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "FW: Secure Message Services", + "eventTime_t [UTC]": "12/20/2021, 8:49:38.000 PM", + "route_s": "outbound", + "policy_s": "Stationery override - no disc", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 4:12:27.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_secure_messaging", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "[Secure]", + "eventTime_t [UTC]": "12/21/2021, 4:12:27.000 PM", + "route_s": "outbound", + "policy_s": "Secure Messaging - Keyword Trigger", + "action_s": "secure_messaging", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 2:36:55.000 AM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Google Alert - news", + "eventTime_t [UTC]": "12/21/2021, 2:36:55.000 AM", + "route_s": "inbound", + "policy_s": "Content Inspection - Profanity internal and external", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 3:04:51.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Benedict's Newsletter: No. 419", + "eventTime_t [UTC]": "12/21/2021, 3:04:51.000 PM", + "route_s": "inbound", + "policy_s": "Smart Tag - Confidential", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 5:47:08.000 AM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Test", + "eventTime_t [UTC]": "12/21/2021, 5:47:08.000 AM", + "route_s": "inbound", + "policy_s": "Smart Tag - Confidential", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 5:07:48.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "Hemarbete och avstånd på serveringar igen", + "eventTime_t [UTC]": "12/21/2021, 5:07:48.000 PM", + "route_s": "inbound", + "policy_s": "Content Inspection - Profanity internal and external", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/22/2021, 3:56:34.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_secure_messaging", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "[secure]", + "eventTime_t [UTC]": "12/22/2021, 3:56:34.000 PM", + "route_s": "outbound", + "policy_s": "Secure Messaging - Keyword Trigger", + "action_s": "secure_messaging", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 9:34:49.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "LFS example", + "eventTime_t [UTC]": "12/21/2021, 9:34:49.000 PM", + "route_s": "outbound", + "policy_s": "Smart Tag - Confidential", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 9:34:49.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_hold", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "LFS example", + "eventTime_t [UTC]": "12/21/2021, 9:34:49.000 PM", + "route_s": "outbound", + "policy_s": "Content Inspection - Watermark", + "action_s": "hold", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 9:34:49.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_smart_folder", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "LFS example", + "eventTime_t [UTC]": "12/21/2021, 9:34:49.000 PM", + "route_s": "outbound", + "policy_s": "Content Inspection - Watermark", + "action_s": "smart_folder", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 9:34:49.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "LFS example", + "eventTime_t [UTC]": "12/21/2021, 9:34:49.000 PM", + "route_s": "outbound", + "policy_s": "Content Inspection - Watermark", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "12/21/2021, 11:46:32.000 PM", + "Computer": "", + "RawData": "", + "mimecastEventId_s": "data_leak_prevention_notification", + "mimecastEventCategory_s": "data_leak_prevention", + "senderAddress_s": "sanitized@sanitized.com", + "recipientAddress_s": "sanitized@sanitized.com", + "subject_s": "A final festive thought", + "eventTime_t [UTC]": "12/21/2021, 11:46:32.000 PM", + "route_s": "inbound", + "policy_s": "Content Inspection - Profanity internal and external", + "action_s": "notification", + "messageId_s": "sanitized@sanitized.com", + "Type": "MimecastDLP_CL", + "_ResourceId": "" + } +] diff --git a/Sample Data/Custom/MimecastSIEM_CL.json b/Sample Data/Custom/MimecastSIEM_CL.json new file mode 100644 index 00000000000..c67488466de --- /dev/null +++ b/Sample Data/Custom/MimecastSIEM_CL.json @@ -0,0 +1,5994 @@ +[ + { + "TimeGenerated [UTC]": "12/26/2021, 11:54:50.000 PM", + "datetime_t [UTC]": "12/26/2021, 11:54:50.000 PM", + "aCode_s": "dQ0UKZlCODqTnklj4RXhlA", + "acc_s": "C46A75", + "IP_s": "104.47.20.58", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/26/2021, 11:54:52.000 PM", + "datetime_t [UTC]": "12/26/2021, 11:54:52.000 PM", + "aCode_s": "dQ0UKZlCODqTnklj4RXhlA", + "acc_s": "C46A75", + "IP_s": "142.251.5.26", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/26/2021, 11:54:52.000 PM", + "datetime_t [UTC]": "12/26/2021, 11:54:52.000 PM", + "aCode_s": "dQ0UKZlCODqTnklj4RXhlA", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:49:37.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:49:37.000 AM", + "aCode_s": "pXZMAk_rMlGI5riv5pZOiA", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:27:27.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:27:27.000 AM", + "aCode_s": "xyIUv4fpNb6Stam-xmq0kQ", + "acc_s": "C46A75", + "IP_s": "108.177.15.27", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:36:57.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:36:57.000 AM", + "aCode_s": "0Lto5KlbNYGUdwKh8cLsOg", + "acc_s": "C46A75", + "IP_s": "209.85.219.199", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - news", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:49:34.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:49:34.000 AM", + "aCode_s": "pXZMAk_rMlGI5riv5pZOiA", + "acc_s": "C46A75", + "IP_s": "104.47.21.59", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:37:01.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:37:01.000 AM", + "aCode_s": "0Lto5KlbNYGUdwKh8cLsOg", + "acc_s": "C46A75", + "IP_s": "104.47.21.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - news", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:15:46.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:15:46.000 AM", + "aCode_s": "or0ZcUc5NOqnA-WwVcC89A", + "acc_s": "C46A75", + "IP_s": "50.115.211.65", + "RejType_s": "Manual Envelope Rejection", + "Error_s": "User level block list in force", + "RejCode_s": "550", + "Dir_s": "Inbound", + "Subject_s": "", + "MsgId_s": "", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "Envelope blocked - User Entry", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_rejected", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:49:37.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:49:37.000 AM", + "aCode_s": "pXZMAk_rMlGI5riv5pZOiA", + "acc_s": "C46A75", + "IP_s": "173.194.76.27", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:27:27.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:27:27.000 AM", + "aCode_s": "xyIUv4fpNb6Stam-xmq0kQ", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:49:29.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:49:29.000 AM", + "aCode_s": "9dOJWDALM9-lRqTeKCI9Qw", + "acc_s": "C46A75", + "IP_s": "209.85.219.197", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - china", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:37:00.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:37:00.000 AM", + "aCode_s": "0Lto5KlbNYGUdwKh8cLsOg", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Google Alert - news", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:49:31.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:49:31.000 AM", + "aCode_s": "9dOJWDALM9-lRqTeKCI9Qw", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Google Alert - china", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:49:32.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:49:32.000 AM", + "aCode_s": "9dOJWDALM9-lRqTeKCI9Qw", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - china", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:27:25.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:27:25.000 AM", + "aCode_s": "xyIUv4fpNb6Stam-xmq0kQ", + "acc_s": "C46A75", + "IP_s": "104.47.20.51", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:40:09.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:40:09.000 AM", + "aCode_s": "LUCJT_gVPQWLW7EI2i6Lgw", + "acc_s": "C46A75", + "IP_s": "50.115.211.140", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "EXCLUSIVE ➡️EXTRA 40% OFF", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:02:47.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:02:47.000 AM", + "aCode_s": "MhWTa8qNOkq_JnamQcr5PA", + "acc_s": "C46A75", + "IP_s": "96.47.26.93", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Omicron uncertainty looms large over the holidays", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:50:24.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:50:24.000 AM", + "aCode_s": "o6juwlJJO1CdEwMEY7fC6A", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "EXCLUSIVE ➡️EXTRA 40% OFF", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:54:52.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:54:52.000 AM", + "aCode_s": "0gmN7Tc-NIW26P9bVEbeow", + "acc_s": "C46A75", + "IP_s": "108.177.15.27", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:40:11.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:40:11.000 AM", + "aCode_s": "LUCJT_gVPQWLW7EI2i6Lgw", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "EXCLUSIVE ➡️EXTRA 40% OFF", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:54:51.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:54:51.000 AM", + "aCode_s": "0gmN7Tc-NIW26P9bVEbeow", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:50:21.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:50:21.000 AM", + "aCode_s": "o6juwlJJO1CdEwMEY7fC6A", + "acc_s": "C46A75", + "IP_s": "50.115.211.156", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "EXCLUSIVE ➡️EXTRA 40% OFF", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:02:51.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:02:51.000 AM", + "aCode_s": "MhWTa8qNOkq_JnamQcr5PA", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Omicron uncertainty looms large over the holidays", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 12:54:49.000 AM", + "datetime_t [UTC]": "12/27/2021, 12:54:49.000 AM", + "aCode_s": "0gmN7Tc-NIW26P9bVEbeow", + "acc_s": "C46A75", + "IP_s": "104.47.21.52", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:54:47.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:54:47.000 AM", + "aCode_s": "VGK6mzEbOS-8TX4QSvPCXw", + "acc_s": "C46A75", + "IP_s": "104.47.21.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - dollar", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:02:29.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:02:29.000 AM", + "aCode_s": "IhkqPEj8Mu2VTWWbDNfVGg", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Laser Hair-Removal Sessions Full Brake-Pad Replacement Winter Festival Ticket", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:54:43.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:54:43.000 AM", + "aCode_s": "VGK6mzEbOS-8TX4QSvPCXw", + "acc_s": "C46A75", + "IP_s": "209.85.219.200", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - dollar", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:54:46.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:54:46.000 AM", + "aCode_s": "VGK6mzEbOS-8TX4QSvPCXw", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Google Alert - dollar", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:49:33.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:49:33.000 AM", + "aCode_s": "3aSec30KO4iSLZ6xHviTmQ", + "acc_s": "C46A75", + "IP_s": "104.47.21.59", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:49:36.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:49:36.000 AM", + "aCode_s": "3aSec30KO4iSLZ6xHviTmQ", + "acc_s": "C46A75", + "IP_s": "66.102.1.27", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:49:35.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:49:35.000 AM", + "aCode_s": "3aSec30KO4iSLZ6xHviTmQ", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:02:27.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:02:27.000 AM", + "aCode_s": "IhkqPEj8Mu2VTWWbDNfVGg", + "acc_s": "C46A75", + "IP_s": "50.115.211.218", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Laser Hair-Removal Sessions Full Brake-Pad Replacement Winter Festival Ticket", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:54:49.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:54:49.000 AM", + "aCode_s": "7lz9sTqqODGgueaxzUr9Xw", + "acc_s": "C46A75", + "IP_s": "104.47.20.56", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:54:52.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:54:52.000 AM", + "aCode_s": "7lz9sTqqODGgueaxzUr9Xw", + "acc_s": "C46A75", + "IP_s": "142.251.5.27", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:21:51.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:21:51.000 AM", + "aCode_s": "WYxbh_8mNL2eMmO9j44UcQ", + "acc_s": "C46A75", + "IP_s": "13.111.28.89", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Jami, enrich your life and save 50%", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:54:51.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:54:51.000 AM", + "aCode_s": "7lz9sTqqODGgueaxzUr9Xw", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:58:55.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:58:55.000 AM", + "aCode_s": "zouIbjF_O5inlyMpItlxcw", + "acc_s": "C46A75", + "IP_s": "192.174.91.221", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "OMG, you forgot! THE SALE IS STILL ON!", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:21:54.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:21:54.000 AM", + "aCode_s": "WYxbh_8mNL2eMmO9j44UcQ", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Jami, enrich your life and save 50%", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 1:58:57.000 AM", + "datetime_t [UTC]": "12/27/2021, 1:58:57.000 AM", + "aCode_s": "zouIbjF_O5inlyMpItlxcw", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "OMG, you forgot! THE SALE IS STILL ON!", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:27:19.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:27:19.000 AM", + "aCode_s": "4AHbSOpNM2uQW0Z35zjQig", + "acc_s": "C46A75", + "IP_s": "209.85.219.198", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - Trump", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:27:29.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:27:29.000 AM", + "aCode_s": "xGvutIY5N4uhOAycwQkM8w", + "acc_s": "C46A75", + "IP_s": "104.47.20.58", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:12:31.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:12:31.000 AM", + "aCode_s": "JY8MD4pPNXyCuk-sCGIXnw", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Custom Canvas Prints Custom Holiday Photo Cards Beauty Products", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:12:29.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:12:29.000 AM", + "aCode_s": "JY8MD4pPNXyCuk-sCGIXnw", + "acc_s": "C46A75", + "IP_s": "50.115.222.17", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Custom Canvas Prints Custom Holiday Photo Cards Beauty Products", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:27:22.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:27:22.000 AM", + "aCode_s": "4AHbSOpNM2uQW0Z35zjQig", + "acc_s": "C46A75", + "IP_s": "104.47.21.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - Trump", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:27:34.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:27:34.000 AM", + "aCode_s": "xGvutIY5N4uhOAycwQkM8w", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:27:35.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:27:35.000 AM", + "aCode_s": "xGvutIY5N4uhOAycwQkM8w", + "acc_s": "C46A75", + "IP_s": "142.250.13.26", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:27:22.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:27:22.000 AM", + "aCode_s": "4AHbSOpNM2uQW0Z35zjQig", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Google Alert - Trump", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:38:06.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:38:06.000 AM", + "aCode_s": "l9CagdJHNNq-OT-kRcmxug", + "acc_s": "C46A75", + "IP_s": "104.47.21.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - news", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:36:58.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:36:58.000 AM", + "aCode_s": "l9CagdJHNNq-OT-kRcmxug", + "acc_s": "C46A75", + "IP_s": "209.85.219.198", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - news", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:49:28.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:49:28.000 AM", + "aCode_s": "lFX7-whGMfeYorQht-Izfw", + "acc_s": "C46A75", + "IP_s": "209.85.219.199", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - china", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:49:30.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:49:30.000 AM", + "aCode_s": "lFX7-whGMfeYorQht-Izfw", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Google Alert - china", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:49:31.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:49:31.000 AM", + "aCode_s": "lFX7-whGMfeYorQht-Izfw", + "acc_s": "C46A75", + "IP_s": "104.47.21.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - china", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:38:06.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:38:06.000 AM", + "aCode_s": "l9CagdJHNNq-OT-kRcmxug", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Google Alert - news", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:54:51.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:54:51.000 AM", + "aCode_s": "z2leIhFuMiK4_QEZ3fQw3w", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:54:44.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:54:44.000 AM", + "aCode_s": "qlHN6BrFNTuIjrCwuk_69w", + "acc_s": "C46A75", + "IP_s": "209.85.219.197", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - dollar", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:54:49.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:54:49.000 AM", + "aCode_s": "z2leIhFuMiK4_QEZ3fQw3w", + "acc_s": "C46A75", + "IP_s": "104.47.20.50", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:54:46.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:54:46.000 AM", + "aCode_s": "qlHN6BrFNTuIjrCwuk_69w", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Google Alert - dollar", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:54:52.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:54:52.000 AM", + "aCode_s": "z2leIhFuMiK4_QEZ3fQw3w", + "acc_s": "C46A75", + "IP_s": "173.194.76.26", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 2:54:46.000 AM", + "datetime_t [UTC]": "12/27/2021, 2:54:46.000 AM", + "aCode_s": "qlHN6BrFNTuIjrCwuk_69w", + "acc_s": "C46A75", + "IP_s": "104.47.21.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - dollar", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 3:50:57.000 AM", + "datetime_t [UTC]": "12/27/2021, 3:50:57.000 AM", + "aCode_s": "iRuEEITWN_iUd3IYk3fQOQ", + "acc_s": "C46A75", + "IP_s": "13.70.32.43", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "View your Exchange Online (Plan 1) invoice", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 3:51:04.000 AM", + "datetime_t [UTC]": "12/27/2021, 3:51:04.000 AM", + "aCode_s": "iRuEEITWN_iUd3IYk3fQOQ", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "View your Exchange Online (Plan 1) invoice", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "445472" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 3:51:04.000 AM", + "datetime_t [UTC]": "12/27/2021, 3:51:04.000 AM", + "aCode_s": "iRuEEITWN_iUd3IYk3fQOQ", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "View your Exchange Online (Plan 1) invoice", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "445472" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 3:32:29.000 AM", + "datetime_t [UTC]": "12/27/2021, 3:32:29.000 AM", + "aCode_s": "9J9_qEMcMX2Zuqh9WLyu_g", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Over 10 Yoga Classes Window Tinting Colon Hydrotherapy", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 3:49:36.000 AM", + "datetime_t [UTC]": "12/27/2021, 3:49:36.000 AM", + "aCode_s": "5K5rf7KpPVKVn0CcLn7zpQ", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "12/27/2021, 3:49:36.000 AM", + "datetime_t [UTC]": "12/27/2021, 3:49:36.000 AM", + "aCode_s": "5K5rf7KpPVKVn0CcLn7zpQ", + "acc_s": "C46A75", + "IP_s": "173.194.76.26", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:04:08.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:04:08.000 PM", + "aCode_s": "8Dyy2yduMP2mdiCO6DQ93w", + "acc_s": "C46A75", + "IP_s": "96.47.27.92", + "Dir_s": "Inbound", + "Subject_s": "Why no one has a quick fix for inflation — not even Joe Biden or Jerome Powell", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "SpamLimit_s": "5", + "SpamInfo_s": "[]", + "SpamScore_s": "1", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 9:49:29.000 PM", + "datetime_t [UTC]": "1/13/2022, 9:49:29.000 PM", + "aCode_s": "JlzTQvnvPaStukYUjF7HgQ", + "acc_s": "C46A75", + "IP_s": "209.85.219.199", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - china", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "SpamLimit_s": "0", + "SpamInfo_s": "[]", + "SpamScore_s": "0", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 9:54:48.000 PM", + "datetime_t [UTC]": "1/13/2022, 9:54:48.000 PM", + "aCode_s": "gBZZGJDEM1W5IXEe2Jh7bQ", + "acc_s": "C46A75", + "IP_s": "104.47.20.54", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "SpamLimit_s": "28", + "SpamInfo_s": "[]", + "SpamScore_s": "0", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 9:50:47.000 PM", + "datetime_t [UTC]": "1/13/2022, 9:50:47.000 PM", + "aCode_s": "n6Uwil-nPFm0C4gLUsAiAA", + "acc_s": "C46A75", + "IP_s": "172.82.223.210", + "Dir_s": "Inbound", + "Subject_s": "Tour pro WDs after bizarre injury", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "SpamLimit_s": "5", + "SpamInfo_s": "[]", + "SpamScore_s": "2", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 9:49:34.000 PM", + "datetime_t [UTC]": "1/13/2022, 9:49:34.000 PM", + "aCode_s": "D59ai9rhN4q0-lIF8haqGA", + "acc_s": "C46A75", + "IP_s": "104.47.20.56", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "SpamLimit_s": "28", + "SpamInfo_s": "[]", + "SpamScore_s": "0", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 9:54:44.000 PM", + "datetime_t [UTC]": "1/13/2022, 9:54:44.000 PM", + "aCode_s": "Of_hagvtP4q0-O7eGgy_1g", + "acc_s": "C46A75", + "IP_s": "209.85.219.197", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - dollar", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "SpamLimit_s": "0", + "SpamInfo_s": "[]", + "SpamScore_s": "0", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:14:34.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:14:34.000 PM", + "aCode_s": "dOflNKUSOWaq-l3zvmOFPQ", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "Dir_s": "Inbound", + "Subject_s": "Business Proposal_Final", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "SpamLimit_s": "5", + "SpamInfo_s": "[]", + "SpamScore_s": "4", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:22:12.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:22:12.000 PM", + "aCode_s": "4X500EudPYi-A_pc5gP3RA", + "acc_s": "C46A75", + "IP_s": "50.115.211.222", + "Dir_s": "Inbound", + "Subject_s": "Take in a Show or Head Out for a Game", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "SpamLimit_s": "5", + "SpamInfo_s": "[]", + "SpamScore_s": "1", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:06:24.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:06:24.000 PM", + "aCode_s": "Ijr18tInPG2HCVxQdAUUdw", + "acc_s": "C46A75", + "IP_s": "209.85.219.197", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - news", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "SpamLimit_s": "0", + "SpamInfo_s": "[]", + "SpamScore_s": "0", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:24:02.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:24:02.000 PM", + "aCode_s": "SQT5Jnj0OyaLVlj-1K5t4g", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Anomali:Phishing", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Final Invoice And Packing List", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[cust.Anomali:Phishing]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "TlsVer_s": "TLSv1.2" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:23:19.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:23:19.000 PM", + "aCode_s": "zqblsBWWPlyC04Hex2cbMA", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Anomali:Phishing", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Final Invoice And Packing List", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[cust.Anomali:Phishing]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "TlsVer_s": "TLSv1.2" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:24:06.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:24:06.000 PM", + "aCode_s": "-wQ1MltHNRSwJd0eSe3mwQ", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Anomali:Phishing", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Final Invoice And Packing List", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[cust.Anomali:Phishing]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "TlsVer_s": "TLSv1.2" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:23:16.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:23:16.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Final Invoice And Packing List", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "av", + "mimecastEventId_s": "mail_av", + "mimecastEventCategory_s": "mail_av", + "TlsVer_s": "" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:24:24.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:24:24.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Final Invoice And Packing List", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "av", + "mimecastEventId_s": "mail_av", + "mimecastEventCategory_s": "mail_av", + "TlsVer_s": "" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:23:08.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:23:08.000 PM", + "aCode_s": "q6MG69QKPdaefO1Imf6uRA", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Xls.Dropper.Agent-7464037-0", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Your Withdrawal Request: $2,070.80 Complete!", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[bitd.VB:Trojan.VBA.Agent.AWA, clam.Xls.Dropper.Agent-7464037-0, soph.Troj/DocDl-WEQ, clam.Xls.Dropper.Agent-7464037-0, soph.Troj/DocDl-WEQ, bitd.VB:Trojan.VBA.Agent.AWA]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "TlsVer_s": "TLSv1.2" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:24:07.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:24:07.000 PM", + "aCode_s": "DjV5QW5vP6y63cxVTIHEcA", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Xls.Dropper.Agent-7464037-0", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Your Withdrawal Request: $2,070.80 Complete!", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[bitd.VB:Trojan.VBA.Agent.AWA, clam.Xls.Dropper.Agent-7464037-0, soph.Troj/DocDl-WEQ, clam.Xls.Dropper.Agent-7464037-0, soph.Troj/DocDl-WEQ, bitd.VB:Trojan.VBA.Agent.AWA]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "TlsVer_s": "TLSv1.2" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:23:57.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:23:57.000 PM", + "aCode_s": "BQwJovbyM0KQK-ejYdcrqA", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Xls.Dropper.Agent-7464037-0", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Your Withdrawal Request: $2,070.80 Complete!", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[bitd.VB:Trojan.VBA.Agent.AWA, clam.Xls.Dropper.Agent-7464037-0, soph.Troj/DocDl-WEQ, clam.Xls.Dropper.Agent-7464037-0, soph.Troj/DocDl-WEQ, bitd.VB:Trojan.VBA.Agent.AWA]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "TlsVer_s": "TLSv1.2" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:23:38.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:23:38.000 PM", + "aCode_s": "wVjx2As2OYefiejMVUFX8w", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Xls.Dropper.Agent-7464037-0", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Your Withdrawal Request: $2,070.80 Complete!", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[bitd.VB:Trojan.VBA.Agent.AWA, soph.Troj/DocDl-WEQ, clam.Xls.Dropper.Agent-7464037-0, clam.Xls.Dropper.Agent-7464037-0, soph.Troj/DocDl-WEQ, bitd.VB:Trojan.VBA.Agent.AWA]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "TlsVer_s": "TLSv1.2" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:24:20.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:24:20.000 PM", + "aCode_s": "vhIcdbJzOyeK3hZpzSi0uQ", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Anomali:Phishing", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Final Invoice And Packing List", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[cust.Anomali:Phishing]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "TlsVer_s": "TLSv1.2" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "TimeGenerated [UTC]": "1/13/2022, 10:04:10.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/13/2022, 10:04:10.000 PM", + "aCode_s": "8Dyy2yduMP2mdiCO6DQ93w", + "acc_s": "C46A75", + "Subject_s": "Why no one has a quick fix for inflation — not even Joe Biden or Jerome Powell", + "MsgId_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Act_s": "Hld", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0", + "AttCnt_s": "0", + "MsgSize_s": "137612", + "Hld_s": "Spm", + "Type": "MimecastSIEM_CL" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "TimeGenerated [UTC]": "1/13/2022, 10:22:15.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/13/2022, 10:22:15.000 PM", + "aCode_s": "4X500EudPYi-A_pc5gP3RA", + "acc_s": "C46A75", + "Subject_s": "Take in a Show or Head Out for a Game", + "MsgId_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Act_s": "Hld", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0", + "AttCnt_s": "0", + "MsgSize_s": "129626", + "Hld_s": "Spm", + "Type": "MimecastSIEM_CL" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 9:54:51.000 PM", + "datetime_t [UTC]": "1/13/2022, 9:54:51.000 PM", + "aCode_s": "gBZZGJDEM1W5IXEe2Jh7bQ", + "acc_s": "C46A75", + "IP_s": "66.102.1.26", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "Delivered_s": "true", + "ReceiptAck_s": "250 2.0.0 OK 1642110891 e12si2696561wrt.942 - gsmtp", + "Latency_s": "2882", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 9:54:47.000 PM", + "datetime_t [UTC]": "1/13/2022, 9:54:47.000 PM", + "aCode_s": "Of_hagvtP4q0-O7eGgy_1g", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - dollar", + "MsgId_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "4926", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:14:38.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:14:38.000 PM", + "aCode_s": "dOflNKUSOWaq-l3zvmOFPQ", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "Dir_s": "Inbound", + "Subject_s": "Business Proposal_Final", + "MsgId_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "363901", + "AttCnt_s": "1", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "16713", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:06:27.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:06:27.000 PM", + "aCode_s": "Ijr18tInPG2HCVxQdAUUdw", + "acc_s": "C46A75", + "IP_s": "104.47.21.36", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - news", + "MsgId_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "4979", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 9:54:51.000 PM", + "datetime_t [UTC]": "1/13/2022, 9:54:51.000 PM", + "aCode_s": "gBZZGJDEM1W5IXEe2Jh7bQ", + "acc_s": "C46A75", + "IP_s": "66.102.1.26", + "Dir_s": "Outbound", + "Subject_s": "This is an autogenerated email", + "MsgId_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "Delivered_s": "true", + "ReceiptAck_s": "250 2.0.0 OK 1642110891 e12si2696561wrt.942 - gsmtp", + "Latency_s": "2882", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:10:10.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:10:10.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "Dir_s": "", + "Subject_s": "BANK TRANSFER COPY/ ACH", + "MsgId_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "logType_s": "av", + "mimecastEventId_s": "mail_av", + "mimecastEventCategory_s": "mail_av", + "AttSize_s": "", + "AttCnt_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:12:35.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:12:35.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "Dir_s": "", + "Subject_s": "Re: Outstanding balance", + "MsgId_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "logType_s": "av", + "mimecastEventId_s": "mail_av", + "mimecastEventCategory_s": "mail_av", + "AttSize_s": "", + "AttCnt_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:12:28.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:12:28.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "Dir_s": "", + "Subject_s": "AW: PURCHASE ORDER", + "MsgId_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "logType_s": "av", + "mimecastEventId_s": "mail_av", + "mimecastEventCategory_s": "mail_av", + "AttSize_s": "", + "AttCnt_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "" + }, + { + "TimeGenerated [UTC]": "1/13/2022, 10:12:19.000 PM", + "datetime_t [UTC]": "1/13/2022, 10:12:19.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "Dir_s": "", + "Subject_s": "[VM:]Caller (XXX) XXX-3646 left you a message.", + "MsgId_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "logType_s": "av", + "mimecastEventId_s": "mail_av", + "mimecastEventCategory_s": "mail_av", + "AttSize_s": "", + "AttCnt_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:45:10.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:45:10.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "1274", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "25168", + "UseTls_s": "Yes", + "Route_s": "Office365", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "0bc18e02-e0ec-32c4-9c26-212dc9057edd", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:45:10.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:45:10.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "1289", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "25170", + "UseTls_s": "Yes", + "Route_s": "Office365", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "4b19123d-e4ab-3f38-93c9-b88127d36004", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:45:23.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:45:23.000 PM", + "aCode_s": "QgeVF96pOfuktH7nkM2a5g", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Google Alert - news", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "36978", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:36:49.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:36:49.000 PM", + "aCode_s": "djhVBhztP5-PStLYoXUIiA", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "COVID-19 Strain: Healthcare Workers Increasingly Seek Mental Health Help", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "84669", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "Spm", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:45:23.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:45:23.000 PM", + "aCode_s": "QgeVF96pOfuktH7nkM2a5g", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - news", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "5496", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "40758", + "UseTls_s": "Yes", + "Route_s": "Office365", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:21:06.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:21:06.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "10.96.39.240", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Important Updated Numbers from the Center for Disease Control", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "<>", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered_notls", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "3029", + "Attempt_s": "1", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "4776", + "UseTls_s": "No", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "2194fe4e-6e4d-3d7a-9d70-a12653a32ec7", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:21:06.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:21:06.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "10.96.39.240", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Important Updated Numbers from the Center for Disease Control", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "<>", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received_notls", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "2194fe4e-6e4d-3d7a-9d70-a12653a32ec7", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:45:20.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:45:20.000 PM", + "aCode_s": "QgeVF96pOfuktH7nkM2a5g", + "acc_s": "C46A75", + "IP_s": "209.85.219.200", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - news", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "0", + "SpamInfo_s": "[]", + "SpamScore_s": "0", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:36:41.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:36:41.000 PM", + "aCode_s": "djhVBhztP5-PStLYoXUIiA", + "acc_s": "C46A75", + "IP_s": "192.64.237.37", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "COVID-19 Strain: Healthcare Workers Increasingly Seek Mental Health Help", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_received_notls", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "5", + "SpamInfo_s": "[]", + "SpamScore_s": "0", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:45:07.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:45:07.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "", + "MsgId_s": "", + "headerFrom_s": "", + "Sender_s": "", + "Rcpt_s": "", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "ttp_url", + "mimecastEventId_s": "mail_ttp_url", + "mimecastEventCategory_s": "mail_ttp_url", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "malicious", + "subject_s": "Google Security alert", + "msgid_s": "sanitized@sanitized.com", + "url_s": "https://accounts.google.login-mctp.com/google/", + "route_s": "inbound", + "SourceIP": "64.235.46.113", + "sender_s": "sanitized@sanitized.com", + "recipient_s": "sanitized@sanitized.com", + "action_s": "Block", + "urlCategory_s": "Customer managed url block list", + "credentialTheft_s": "null", + "senderDomain_s": "notifications.twotoeight.co", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 10:25:47.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 10:25:47.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Transaction notice", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "av", + "mimecastEventId_s": "mail_av", + "mimecastEventCategory_s": "mail_av", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "Inbound", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "sanitized@sanitized.com", + "SenderDomain_s": "zenz.us", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "false", + "fileName_s": "Transaction notice", + "sha256_s": "efe51c2453821310c7a34dca3054021d0f6d453b7133c381d75e3140901efd12", + "Size_s": "1648832", + "fileExt_s": "xlsm", + "Virus_s": "Anomali:Phishing", + "sha1_s": "816b013c8be6e5708690645964b5d442c085041e", + "SenderDomainInternal_s": "false", + "fileMime_s": "application/vnd.ms-excel.sheet.macroEnabled.12", + "CustomerIP_s": "true", + "md5_g": "4dbe9dbf-b534-38d9-ce41-0535355cd973", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 10:25:21.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 10:25:21.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Transaction notice", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "av", + "mimecastEventId_s": "mail_av", + "mimecastEventCategory_s": "mail_av", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "Inbound", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "sanitized@sanitized.com", + "SenderDomain_s": "zenz.us", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "false", + "fileName_s": "Transaction notice", + "sha256_s": "efe51c2453821310c7a34dca3054021d0f6d453b7133c381d75e3140901efd12", + "Size_s": "1648832", + "fileExt_s": "xlsm", + "Virus_s": "Anomali:Phishing", + "sha1_s": "816b013c8be6e5708690645964b5d442c085041e", + "SenderDomainInternal_s": "false", + "fileMime_s": "application/vnd.ms-excel.sheet.macroEnabled.12", + "CustomerIP_s": "true", + "md5_g": "4dbe9dbf-b534-38d9-ce41-0535355cd973", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 10:24:10.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 10:24:10.000 PM", + "aCode_s": "RESYifthNmaMRytwNlbo0A", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Doc.Dropper.Valyria-6680506-0", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Application pack - TwoToEight", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[clam.Doc.Dropper.Valyria-6680506-0, tlav.Doc.Dropper.Valyria-6680506-0, clam.Doc.Dropper.Valyria-6680506-0, bitd.VB:Trojan.Valyria.3489]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "Doc.Dropper.Valyria-6680506-0", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 10:24:39.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 10:24:39.000 PM", + "aCode_s": "p5jAh3BqOteaygt_u_UKfQ", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Anomali:Phishing", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Transaction notice", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[clam.Doc.Dropper.Agent-6940774-0, soph.Troj/DocDro-BI, tlav.Doc.Dropper.Agent-6940774-0, bitd.W97m.Downloader.ICB, cust.Anomali:Phishing]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "Anomali:Phishing", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 10:25:15.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 10:25:15.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Transaction notice", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "av", + "mimecastEventId_s": "mail_av", + "mimecastEventCategory_s": "mail_av", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "Inbound", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "sanitized@sanitized.com", + "SenderDomain_s": "zenz.us", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "false", + "fileName_s": "Transaction notice", + "sha256_s": "efe51c2453821310c7a34dca3054021d0f6d453b7133c381d75e3140901efd12", + "Size_s": "1648832", + "fileExt_s": "xlsm", + "Virus_s": "Anomali:Phishing", + "sha1_s": "816b013c8be6e5708690645964b5d442c085041e", + "SenderDomainInternal_s": "false", + "fileMime_s": "application/vnd.ms-excel.sheet.macroEnabled.12", + "CustomerIP_s": "true", + "md5_g": "4dbe9dbf-b534-38d9-ce41-0535355cd973", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 10:24:00.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 10:24:00.000 PM", + "aCode_s": "0nSl-6cVO-2H3nRvrZmS-A", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Anomali:Phishing", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Transaction notice", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[clam.Doc.Dropper.Agent-6940774-0, soph.Troj/DocDro-BI, tlav.Doc.Dropper.Agent-6940774-0, bitd.W97m.Downloader.ICB, cust.Anomali:Phishing]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "Anomali:Phishing", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 10:24:37.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 10:24:37.000 PM", + "aCode_s": "cPxYvoFHNsKGhBeyHwb3Sw", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Doc.Dropper.Valyria-6680506-0", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Application pack - TwoToEight", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[clam.Doc.Dropper.Valyria-6680506-0, tlav.Doc.Dropper.Valyria-6680506-0, clam.Doc.Dropper.Valyria-6680506-0, bitd.VB:Trojan.Valyria.3489]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "Doc.Dropper.Valyria-6680506-0", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 10:25:23.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 10:25:23.000 PM", + "aCode_s": "RX2th6VYN4u77n4tyDzT3w", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Anomali:Phishing", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Transaction notice", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[clam.Doc.Dropper.Agent-6940774-0, soph.Troj/DocDro-BI, tlav.Doc.Dropper.Agent-6940774-0, bitd.W97m.Downloader.ICB, cust.Anomali:Phishing]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "Anomali:Phishing", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 10:25:26.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 10:25:26.000 PM", + "aCode_s": "Xrm-0oS2MXuJLahdDEt3fA", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "Virus Signature Detection", + "Error_s": "Malware detected by AV Scan policy: Anomali:Phishing", + "RejCode_s": "554", + "Dir_s": "Inbound", + "Subject_s": "Transaction notice", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "sanitized@sanitized.com", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "Rej", + "RejInfo_s": "[clam.Doc.Dropper.Agent-6940774-0, soph.Troj/DocDro-BI, tlav.Doc.Dropper.Agent-6940774-0, bitd.W97m.Downloader.ICB, cust.Anomali:Phishing]", + "logType_s": "receipt", + "mimecastEventId_s": "mail_receipt_virus", + "mimecastEventCategory_s": "mail_receipt", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "Anomali:Phishing", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 10:25:26.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 10:25:26.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "52.190.31.120", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Transaction notice", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "av", + "mimecastEventId_s": "mail_av", + "mimecastEventCategory_s": "mail_av", + "AttSize_s": "", + "AttCnt_s": "", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "Inbound", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "sanitized@sanitized.com", + "SenderDomain_s": "zenz.us", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "false", + "fileName_s": "Transaction notice", + "sha256_s": "efe51c2453821310c7a34dca3054021d0f6d453b7133c381d75e3140901efd12", + "Size_s": "1648832", + "fileExt_s": "xlsm", + "Virus_s": "Anomali:Phishing", + "sha1_s": "816b013c8be6e5708690645964b5d442c085041e", + "SenderDomainInternal_s": "false", + "fileMime_s": "application/vnd.ms-excel.sheet.macroEnabled.12", + "CustomerIP_s": "true", + "md5_g": "4dbe9dbf-b534-38d9-ce41-0535355cd973", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:45:10.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:45:10.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "1274", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "25168", + "UseTls_s": "Yes", + "Route_s": "Office365", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "0bc18e02-e0ec-32c4-9c26-212dc9057edd", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:45:10.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:45:10.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "1289", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "25170", + "UseTls_s": "Yes", + "Route_s": "Office365", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "4b19123d-e4ab-3f38-93c9-b88127d36004", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:45:23.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:45:23.000 PM", + "aCode_s": "QgeVF96pOfuktH7nkM2a5g", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Google Alert - news", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "5496", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "40758", + "UseTls_s": "Yes", + "Route_s": "Office365", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:21:06.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:21:06.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "10.96.39.240", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Important Updated Numbers from the Center for Disease Control", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "<>", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered_notls", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "3029", + "Attempt_s": "1", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "4776", + "UseTls_s": "No", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "2194fe4e-6e4d-3d7a-9d70-a12653a32ec7", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:52:56.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:52:56.000 PM", + "aCode_s": "DdnuY-66NG-3Eatk5FIsDA", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Pierre, Denis & Jean-Jacques: Doisy-Daëne & L’Extravagance 1942-2013", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "5723", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "111436", + "UseTls_s": "Yes", + "Route_s": "Office365", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:45:41.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:45:41.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "104.47.21.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "1419", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "25170", + "UseTls_s": "Yes", + "Route_s": "Office365", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "770b6474-4024-35d4-8a6b-7df0c5249bfa", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:59:02.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:59:02.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "10.91.27.240", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered_notls", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "1961", + "Attempt_s": "1", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "30455", + "UseTls_s": "No", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "4ed0044b-9a60-38be-b23f-78501595ccfb", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:59:03.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:59:03.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "Your message has been read", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "1998", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "30858", + "UseTls_s": "Yes", + "Route_s": "Office365", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "4ed0044b-9a60-38be-b23f-78501595ccfb", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:45:43.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:45:43.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "104.47.20.36", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Inbound", + "Subject_s": "", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "1061", + "Attempt_s": "1", + "TlsVer_s": "TLSv1.2", + "Cphr_s": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "Snt_s": "25167", + "UseTls_s": "Yes", + "Route_s": "Office365", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "7646e51e-2a0a-3907-9176-1ed9b74076b0", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/25/2022, 4:57:43.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/25/2022, 4:57:43.000 PM", + "aCode_s": "aPQg9Ak7PpG2MlD8gpa_ng", + "acc_s": "C46A75", + "IP_s": "10.7.186.240", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "Outbound", + "Subject_s": "", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "sanitized@sanitized.com", + "Act_s": "", + "RejInfo_s": "", + "logType_s": "delivery", + "mimecastEventId_s": "mail_delivery_delivered_notls", + "mimecastEventCategory_s": "mail_delivery", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "", + "MsgSize_s": "", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "true", + "ReceiptAck_s": "sanitized@sanitized.com", + "Latency_s": "1219", + "Attempt_s": "1", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "28436", + "UseTls_s": "No", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 8:00:35.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 8:00:35.000 PM", + "aCode_s": "TR0dPou1P-6waSde0VvE_g", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "0-99", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "19057954", + "AttCnt_s": "1", + "AttNames_s": "\"0-99 Demo [Autosaved].pptx\"", + "MsgSize_s": "19081589", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 9:41:31.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 9:41:31.000 PM", + "aCode_s": "4Y4P0satOfyES4ZtgH3R7Q", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Undelivered Mail Returned to Sender", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "<>", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "\"status.txt\"", + "MsgSize_s": "5063", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "Ctnt", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 9:41:17.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 9:41:17.000 PM", + "aCode_s": "cR4odbz_NoCCAJe7IU2UTg", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Undelivered Mail Returned to Sender", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "<>", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "\"status.txt\"", + "MsgSize_s": "6713", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "Ctnt", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 9:41:29.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 9:41:29.000 PM", + "aCode_s": "ls12VifUOG-0eB4hEoNy9A", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Undelivered Mail Returned to Sender", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "<>", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "\"status.txt\"", + "MsgSize_s": "4995", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "Ctnt", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 9:41:19.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 9:41:19.000 PM", + "aCode_s": "FJh_CnnbPuqGSxBZYoUMwQ", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Undelivered Mail Returned to Sender", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "<>", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "\"status.txt\"", + "MsgSize_s": "5035", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "Ctnt", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 9:41:24.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 9:41:24.000 PM", + "aCode_s": "4QtONP_DPdm4IxBx8FpUNw", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Undelivered Mail Returned to Sender", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "<>", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "\"status.txt\"", + "MsgSize_s": "5159", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "Ctnt", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 9:41:23.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 9:41:23.000 PM", + "aCode_s": "efCbswdWM3CJ41nJ-LkQNw", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Undelivered Mail Returned to Sender", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "<>", + "Rcpt_s": "", + "Act_s": "Hld", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_held", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "0", + "AttCnt_s": "0", + "AttNames_s": "\"status.txt\"", + "MsgSize_s": "5629", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "Ctnt", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 7:54:46.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 7:54:46.000 PM", + "aCode_s": "AsD4BZWUM1Gl7sxig-ZXLA", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "FW: testing", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "13303", + "AttCnt_s": "1", + "AttNames_s": "\"LoopBack_Reverseshell.docm\"", + "MsgSize_s": "47734", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 8:58:31.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 8:58:31.000 PM", + "aCode_s": "qEa_lRlGNaC8mh4j0ApHNw", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Customer Info", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "sanitized@sanitized.com", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "24", + "AttCnt_s": "1", + "AttNames_s": "\"0.png\", \"1.png\", \"2.png\", \"3.png\", \"4.gif\", \"5.jpg\", \"6.gif\", \"BadFile.txt\"", + "MsgSize_s": "226839", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + }, + { + "TenantId": "637cb6cc-0133-433d-8c16-f919f141ce76", + "SourceSystem": "RestAPI", + "MG": "", + "ManagementGroupName": "", + "TimeGenerated [UTC]": "1/24/2022, 8:34:06.000 PM", + "Computer": "", + "RawData": "", + "datetime_t [UTC]": "1/24/2022, 8:34:06.000 PM", + "aCode_s": "", + "acc_s": "C46A75", + "IP_s": "", + "RejType_s": "", + "Error_s": "", + "RejCode_s": "", + "Dir_s": "", + "Subject_s": "Executive Secretary / Administrative Assistant (228 Open Position)", + "MsgId_s": "sanitized@sanitized.com", + "headerFrom_s": "", + "Sender_s": "<>", + "Rcpt_s": "", + "Act_s": "Acc", + "RejInfo_s": "", + "logType_s": "process", + "mimecastEventId_s": "mail_process_accepted", + "mimecastEventCategory_s": "mail_process", + "AttSize_s": "17172", + "AttCnt_s": "1", + "AttNames_s": "\"Benito_Harbard _Resume.docx\"", + "MsgSize_s": "23235", + "SpamLimit_s": "", + "SpamInfo_s": "", + "SpamScore_s": "", + "Hld_s": "", + "Delivered_s": "", + "ReceiptAck_s": "", + "Latency_s": "", + "Attempt_s": "", + "TlsVer_s": "", + "Cphr_s": "", + "Snt_s": "", + "UseTls_s": "", + "Route_s": "", + "reason_s": "", + "subject_s": "", + "msgid_s": "", + "url_s": "", + "route_s": "", + "SourceIP": "", + "sender_s": "", + "recipient_s": "", + "action_s": "", + "urlCategory_s": "", + "credentialTheft_s": "", + "senderDomain_s": "", + "RcptActType_s": "", + "RcptHdrType_s": "", + "Recipient_s": "", + "SenderDomain_s": "", + "aCode_g": "d4f5a5cd-3f1a-3b3c-b6ff-198b3235c464", + "Err_s": "", + "MimecastIP_s": "", + "fileName_s": "", + "sha256_s": "", + "Size_s": "", + "fileExt_s": "", + "Virus_s": "", + "sha1_s": "", + "SenderDomainInternal_s": "", + "fileMime_s": "", + "CustomerIP_s": "", + "md5_g": "", + "UrlCategory_s": "", + "ScanResultInfo_s": "", + "URL_s": "", + "CustomThreatDictionary_s": "", + "Action_s": "", + "Hits_s": "", + "SimilarCustomExternalDomain_s": "", + "TaggedExternal_s": "", + "SimilarInternalDomain_s": "", + "Definition_s": "", + "NewDomain_s": "", + "InternalName_s": "", + "ThreatDictionary_s": "", + "SimilarMimecastExternalDomain_s": "", + "CustomName_s": "", + "TaggedMalicious_s": "", + "ReplyMismatch_s": "", + "IPNewDomain_s": "", + "IPThreadDict_s": "", + "IPSimilarDomain_s": "", + "IPReplyMismatch_s": "", + "IPInternalName_s": "", + "Type": "MimecastSIEM_CL", + "_ResourceId": "" + } +] diff --git a/Solutions/Akamai Security Events/Data Connectors/Connector_CEF_Akamai.json b/Solutions/Akamai Security Events/Data Connectors/Connector_CEF_Akamai.json index aab42d433b9..9b4d7be2584 100644 --- a/Solutions/Akamai Security Events/Data Connectors/Connector_CEF_Akamai.json +++ b/Solutions/Akamai Security Events/Data Connectors/Connector_CEF_Akamai.json @@ -1,8 +1,8 @@ { "id": "AkamaiSecurityEvents", - "title": "Akamai Security Events", + "title": "[Deprecated] Akamai Security Events via Legacy Agent", "publisher": "Akamai", - "descriptionMarkdown": "Akamai Solution for Sentinel provides the capability to ingest [Akamai Security Events](https://www.akamai.com/us/en/products/security/) into Microsoft Sentinel. Refer to [Akamai SIEM Integration documentation](https://developer.akamai.com/tools/integrations/siem) for more information.", + "descriptionMarkdown": "Akamai Solution for Microsoft Sentinel provides the capability to ingest [Akamai Security Events](https://www.akamai.com/us/en/products/security/) into Microsoft Sentinel. Refer to [Akamai SIEM Integration documentation](https://developer.akamai.com/tools/integrations/siem) for more information.", "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", "graphQueries": [ { @@ -61,7 +61,7 @@ }, "instructionSteps": [ { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias Akamai Security Events and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Akamai%20Security%20Events/Parsers/AkamaiSIEMEvent.txt), on the second line of the query, enter the hostname(s) of your Akamai Security Events device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update." + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias Akamai Security Events and load the function code or click [here](https://aka.ms/sentinel-akamaisecurityevents-parser), on the second line of the query, enter the hostname(s) of your Akamai Security Events device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update." }, { "title": "1. Linux Syslog agent configuration", diff --git a/Solutions/Akamai Security Events/Data Connectors/template_AkamaiSecurityEventsAMA.json b/Solutions/Akamai Security Events/Data Connectors/template_AkamaiSecurityEventsAMA.json new file mode 100644 index 00000000000..08952b887c8 --- /dev/null +++ b/Solutions/Akamai Security Events/Data Connectors/template_AkamaiSecurityEventsAMA.json @@ -0,0 +1,117 @@ +{ + "id": "AkamaiSecurityEventsAma", + "title": "[Recommended] Akamai Security Events via AMA", + "publisher": "Akamai", + "descriptionMarkdown": "Akamai Solution for Microsoft Sentinel provides the capability to ingest [Akamai Security Events](https://www.akamai.com/us/en/products/security/) into Microsoft Sentinel. Refer to [Akamai SIEM Integration documentation](https://developer.akamai.com/tools/integrations/siem) for more information.", + "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "AkamaiSecurityEvents", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Akamai' \n |where DeviceProduct =~ 'akamai_siem'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description": "Top 10 Countries", + "query": "AkamaiSIEMEvent\n | summarize count() by SrcGeoCountry\n | top 10 by count_" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (AkamaiSecurityEvents)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Akamai' \n |where DeviceProduct =~ 'akamai_siem'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Akamai' \n |where DeviceProduct =~ 'akamai_siem'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "title": "", + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias Akamai Security Events and load the function code or click [here](https://aka.ms/sentinel-akamaisecurityevents-parser), on the second line of the query, enter the hostname(s) of your Akamai Security Events device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine", + "instructions": [ + ] + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "[Follow these steps](https://developer.akamai.com/tools/integrations/siem) to configure Akamai CEF connector to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address.", + "instructions": [ + ] + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + + + { + "title": "2. Secure your machine ", + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)" + } + ] +} \ No newline at end of file diff --git a/Solutions/Akamai Security Events/Data/Solution_Akamai.json b/Solutions/Akamai Security Events/Data/Solution_Akamai.json index 4ab9fe64706..14251dbf7f7 100644 --- a/Solutions/Akamai Security Events/Data/Solution_Akamai.json +++ b/Solutions/Akamai Security Events/Data/Solution_Akamai.json @@ -2,16 +2,17 @@ "Name": "Akamai Security Events", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The Akamai Security Solution for Microsoft Sentinel enables ingestion of [Akamai Security Solutions](https://www.akamai.com/solutions/security) events using the Common Event Format (CEF) into Microsoft Sentinel for Security Monitoring. \n\n\r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Common Event Format (CEF) formatted logs in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)", + "Description": "The Akamai Security Solution for Microsoft Sentinel enables ingestion of [Akamai Security Solutions](https://www.akamai.com/solutions/security) events using the Common Event Format (CEF) into Microsoft Sentinel for Security Monitoring. \n\r\n1. **Akamai Security Events via AMA** - This data connector helps in ingesting Akamai Security Events logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Akamai Security Events via Legacy Agent** - This data connector helps in ingesting Akamai Security Events logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Akamai Security Events via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", "Data Connectors": [ - "Data Connectors/Connector_CEF_Akamai.json" + "Data Connectors/Connector_CEF_Akamai.json", + "Data Connectors/template_AkamaiSecurityEventsAMA.json" ], "Parsers": [ - "Parsers/AkamaiSIEMEvent.txt" + "Parsers/AkamaiSIEMEvent.yaml" ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Akamai Security Events", - "Version": "2.0.2", + "Version": "3.0.0", "TemplateSpec": true, "Is1PConnector": false } \ No newline at end of file diff --git a/Solutions/Akamai Security Events/Data/system_generated_metadata.json b/Solutions/Akamai Security Events/Data/system_generated_metadata.json new file mode 100644 index 00000000000..a350a287baa --- /dev/null +++ b/Solutions/Akamai Security Events/Data/system_generated_metadata.json @@ -0,0 +1,30 @@ +{ + "Name": "Akamai Security Events", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "The Akamai Security Solution for Microsoft Sentinel enables ingestion of [Akamai Security Solutions](https://www.akamai.com/solutions/security) events using the Common Event Format (CEF) into Microsoft Sentinel for Security Monitoring. \n\r\n1. **Akamai Security Events via AMA** - This data connector helps in ingesting Akamai Security Events logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Akamai Security Events via Legacy Agent** - This data connector helps in ingesting Akamai Security Events logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Akamai Security Events via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "Metadata": "SolutionMetadata.json", + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Akamai Security Events", + "Version": "3.0.0", + "TemplateSpec": true, + "Is1PConnector": false, + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-akamai", + "providers": [ + "Akamai" + ], + "categories": { + "domains": [ + "Security - Cloud Security" + ] + }, + "firstPublishDate": "2022-03-23", + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "Data Connectors": "[\n \"Data Connectors/Connector_CEF_Akamai.json\",\n \"Data Connectors/template_AkamaiSecurityEventsAMA.json\"\n]", + "Parsers": "[\n \"AkamaiSIEMEvent.yaml\"\n]" +} diff --git a/Solutions/Akamai Security Events/Package/3.0.0.zip b/Solutions/Akamai Security Events/Package/3.0.0.zip new file mode 100644 index 00000000000..8a43e678930 Binary files /dev/null and b/Solutions/Akamai Security Events/Package/3.0.0.zip differ diff --git a/Solutions/Akamai Security Events/Package/createUiDefinition.json b/Solutions/Akamai Security Events/Package/createUiDefinition.json index 8d1ed7f7b5b..e5a264907d2 100644 --- a/Solutions/Akamai Security Events/Package/createUiDefinition.json +++ b/Solutions/Akamai Security Events/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe Akamai Security Solution for Microsoft Sentinel enables ingestion of [Akamai Security Solutions](https://www.akamai.com/solutions/security) events using the Common Event Format (CEF) into Microsoft Sentinel for Security Monitoring. \n\n\r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Common Event Format (CEF) formatted logs in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)\n\n**Data Connectors:** 1, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Akamai%20Security%20Events/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Akamai Security Solution for Microsoft Sentinel enables ingestion of [Akamai Security Solutions](https://www.akamai.com/solutions/security) events using the Common Event Format (CEF) into Microsoft Sentinel for Security Monitoring. \n\r\n1. **Akamai Security Events via AMA** - This data connector helps in ingesting Akamai Security Events logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Akamai Security Events via Legacy Agent** - This data connector helps in ingesting Akamai Security Events logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Akamai Security Events via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -80,6 +80,7 @@ } } } + ] } ], diff --git a/Solutions/Akamai Security Events/Package/mainTemplate.json b/Solutions/Akamai Security Events/Package/mainTemplate.json index ea6fd868dea..184b4615a9b 100644 --- a/Solutions/Akamai Security Events/Package/mainTemplate.json +++ b/Solutions/Akamai Security Events/Package/mainTemplate.json @@ -34,53 +34,48 @@ "_solutionId": "[variables('solutionId')]", "email": "support@microsoft.com", "_email": "[variables('email')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_solutionName": "Akamai Security Events", + "_solutionVersion": "3.0.0", "uiConfigId1": "AkamaiSecurityEvents", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "AkamaiSecurityEvents", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", - "parserVersion1": "1.0.0", - "parserContentId1": "AkamaiSIEMEvent-Parser", - "_parserContentId1": "[variables('parserContentId1')]", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "uiConfigId2": "AkamaiSecurityEventsAma", + "_uiConfigId2": "[variables('uiConfigId2')]", + "dataConnectorContentId2": "AkamaiSecurityEventsAma", + "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", + "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "_dataConnectorId2": "[variables('dataConnectorId2')]", + "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", + "dataConnectorVersion2": "1.0.0", + "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "parserName1": "AkamaiSIEMEvent", "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1')))]" + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", + "parserVersion1": "1.0.0", + "parserContentId1": "AkamaiSIEMEvent-Parser", + "_parserContentId1": "[variables('parserContentId1')]", + "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "Akamai Security Events data connector with template", - "displayName": "Akamai Security Events template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Akamai Security Events data connector with template version 2.0.2", + "description": "Akamai Security Events data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -96,9 +91,9 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId1')]", - "title": "Akamai Security Events", + "title": "[Deprecated] Akamai Security Events via Legacy Agent", "publisher": "Akamai", - "descriptionMarkdown": "Akamai Solution for Sentinel provides the capability to ingest [Akamai Security Events](https://www.akamai.com/us/en/products/security/) into Microsoft Sentinel. Refer to [Akamai SIEM Integration documentation](https://developer.akamai.com/tools/integrations/siem) for more information.", + "descriptionMarkdown": "Akamai Solution for Microsoft Sentinel provides the capability to ingest [Akamai Security Events](https://www.akamai.com/us/en/products/security/) into Microsoft Sentinel. Refer to [Akamai SIEM Integration documentation](https://developer.akamai.com/tools/integrations/siem) for more information.", "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", "graphQueries": [ { @@ -157,7 +152,7 @@ }, "instructionSteps": [ { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias Akamai Security Events and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Akamai%20Security%20Events/Parsers/AkamaiSIEMEvent.txt), on the second line of the query, enter the hostname(s) of your Akamai Security Events device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update." + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias Akamai Security Events and load the function code or click [here](https://aka.ms/sentinel-akamaisecurityevents-parser), on the second line of the query, enter the hostname(s) of your Akamai Security Events device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update." }, { "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", @@ -216,7 +211,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -241,12 +236,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "[Deprecated] Akamai Security Events via Legacy Agent", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -282,9 +288,9 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Akamai Security Events", + "title": "[Deprecated] Akamai Security Events via Legacy Agent", "publisher": "Akamai", - "descriptionMarkdown": "Akamai Solution for Sentinel provides the capability to ingest [Akamai Security Events](https://www.akamai.com/us/en/products/security/) into Microsoft Sentinel. Refer to [Akamai SIEM Integration documentation](https://developer.akamai.com/tools/integrations/siem) for more information.", + "descriptionMarkdown": "Akamai Solution for Microsoft Sentinel provides the capability to ingest [Akamai Security Events](https://www.akamai.com/us/en/products/security/) into Microsoft Sentinel. Refer to [Akamai SIEM Integration documentation](https://developer.akamai.com/tools/integrations/siem) for more information.", "graphQueries": [ { "metricName": "Total data received", @@ -342,7 +348,7 @@ }, "instructionSteps": [ { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias Akamai Security Events and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Akamai%20Security%20Events/Parsers/AkamaiSIEMEvent.txt), on the second line of the query, enter the hostname(s) of your Akamai Security Events device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update." + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias Akamai Security Events and load the function code or click [here](https://aka.ms/sentinel-akamaisecurityevents-parser), on the second line of the query, enter the hostname(s) of your Akamai Security Events device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update." }, { "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", @@ -402,33 +408,344 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('parserTemplateSpecName1')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "description": "AkamaiSIEMEvent Data Parser with template", - "displayName": "AkamaiSIEMEvent Data Parser template" + "description": "Akamai Security Events data connector with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion2')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId2')]", + "title": "[Recommended] Akamai Security Events via AMA", + "publisher": "Akamai", + "descriptionMarkdown": "Akamai Solution for Microsoft Sentinel provides the capability to ingest [Akamai Security Events](https://www.akamai.com/us/en/products/security/) into Microsoft Sentinel. Refer to [Akamai SIEM Integration documentation](https://developer.akamai.com/tools/integrations/siem) for more information.", + "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "AkamaiSecurityEvents", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Akamai' \n |where DeviceProduct =~ 'akamai_siem'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description": "Top 10 Countries", + "query": "AkamaiSIEMEvent\n | summarize count() by SrcGeoCountry\n | top 10 by count_" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (AkamaiSecurityEvents)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Akamai' \n |where DeviceProduct =~ 'akamai_siem'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Akamai' \n |where DeviceProduct =~ 'akamai_siem'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias Akamai Security Events and load the function code or click [here](https://aka.ms/sentinel-akamaisecurityevents-parser), on the second line of the query, enter the hostname(s) of your Akamai Security Events device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "[Follow these steps](https://developer.akamai.com/tools/integrations/siem) to configure Akamai CEF connector to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "Akamai Security Events", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId2')]", + "contentKind": "DataConnector", + "displayName": "[Recommended] Akamai Security Events via AMA", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", + "version": "[variables('dataConnectorVersion2')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('parserTemplateSpecName1'),'/',variables('parserVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId2')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "Akamai Security Events", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "[Recommended] Akamai Security Events via AMA", + "publisher": "Akamai", + "descriptionMarkdown": "Akamai Solution for Microsoft Sentinel provides the capability to ingest [Akamai Security Events](https://www.akamai.com/us/en/products/security/) into Microsoft Sentinel. Refer to [Akamai SIEM Integration documentation](https://developer.akamai.com/tools/integrations/siem) for more information.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "AkamaiSecurityEvents", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Akamai' \n |where DeviceProduct =~ 'akamai_siem'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (AkamaiSecurityEvents)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Akamai' \n |where DeviceProduct =~ 'akamai_siem'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Akamai' \n |where DeviceProduct =~ 'akamai_siem'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Top 10 Countries", + "query": "AkamaiSIEMEvent\n | summarize count() by SrcGeoCountry\n | top 10 by count_" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias Akamai Security Events and load the function code or click [here](https://aka.ms/sentinel-akamaisecurityevents-parser), on the second line of the query, enter the hostname(s) of your Akamai Security Events device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "[Follow these steps](https://developer.akamai.com/tools/integrations/siem) to configure Akamai CEF connector to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ], + "id": "[variables('_uiConfigId2')]", + "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution." + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('parserTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AkamaiSIEMEvent Data Parser with template version 2.0.2", + "description": "AkamaiSIEMEvent Data Parser with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserVersion1')]", @@ -437,20 +754,21 @@ "resources": [ { "name": "[variables('_parserName1')]", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "AkamaiSIEMEvent", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "AkamaiSIEMEvent", - "query": "\nCommonSecurityLog \r\n| where DeviceVendor == 'Akamai'\r\n| where DeviceProduct == 'akamai_siem'\r\n| extend EventVendor = 'Akamai'\r\n| extend EventProduct = 'akamai_siem'\r\n| extend EventProductVersion = '1.0'\r\n| extend EventId = DeviceEventClassID\r\n| extend EventCategory = Activity\r\n| extend EventSeverity = LogSeverity\r\n| extend DvcAction = DeviceAction\r\n| extend NetworkApplicationProtocol = ApplicationProtocol\r\n| extend Ipv6Src = DeviceCustomIPv6Address2\r\n| extend RuleName = DeviceCustomString1\r\n| extend RuleMessages = DeviceCustomString2\r\n| extend RuleData = DeviceCustomString3\r\n| extend RuleSelectors = DeviceCustomString4\r\n| extend ClientReputation = DeviceCustomString5\r\n| extend ApiId = DeviceCustomString6\r\n| extend RequestId = DevicePayloadId\r\n| extend DstDvcHostname = DestinationHostName\r\n| extend DstPortNumber = DestinationPort\r\n| extend ConfigId = FlexString1\r\n| extend PolicyId = FlexString2\r\n| extend NetworkBytes = SentBytes\r\n| extend UrlOriginal = RequestURL\r\n| extend HttpRequestMethod = RequestMethod\r\n| extend SrcIpAddr = SourceIP\r\n| extend EventStartTime = datetime(1970-01-01) + coalesce(\r\n tolong(extract(@'.*start=(.*?);', 1, AdditionalExtensions)),\r\n tolong(column_ifexists(\"StartTime\", long(null)))\r\n ) * 1s \r\n| extend SlowPostAction = extract(@'.*AkamaiSiemSlowPostAction=(.*?);', 1, AdditionalExtensions)\r\n| extend SlowPostRate = extract(@'.*AkamaiSiemSlowPostRate=(.*?);', 1, AdditionalExtensions)\r\n| extend RuleVersions = extract(@'.*AkamaiSiemRuleVersions=,?(.*?);', 1, AdditionalExtensions)\r\n| extend RuleTags = extract(@'.*AkamaiSiemRuleTags=(.*?);', 1, AdditionalExtensions)\r\n| extend ApiKey = extract(@'.*AkamaiSiemApiKey=(.*?);', 1, AdditionalExtensions)\r\n| extend Tls = extract(@'.*AkamaiSiemTLSVersion=(.*?);', 1, AdditionalExtensions)\r\n| extend RequestHeaders = extract(@'.*AkamaiSiemRequestHeaders=;?(.*?);', 1, AdditionalExtensions)\r\n| extend ResponseHeaders = extract(@'.*AkamaiSiemResponseHeaders=(.*?);', 1, AdditionalExtensions)\r\n| extend HttpStatusCode = extract(@'.*AkamaiSiemResponseStatus=(.*?);', 1, AdditionalExtensions)\r\n| extend GeoContinent = extract(@'.*AkamaiSiemContinent=(.*?);', 1, AdditionalExtensions)\r\n| extend SrcGeoCountry = extract(@'.*AkamaiSiemCountry=(.*?);', 1, AdditionalExtensions)\r\n| extend SrcGeoCity = extract(@'.*AkamaiSiemCity=(.*?);', 1, AdditionalExtensions)\r\n| extend SrcGeoRegion = extract(@'.*AkamaiSiemRegion=(.*?);', 1, AdditionalExtensions)\r\n| extend GeoAsn = extract(@'.*AkamaiSiemASN=(\\d+)', 1, AdditionalExtensions)\r\n| extend Custom = extract(@'.*AkamaiSiemCusomData=(.*?)', 1, AdditionalExtensions)\r\n| project TimeGenerated\r\n , EventVendor\r\n , EventProduct\r\n , EventProductVersion\r\n , EventStartTime\r\n , EventId\r\n , EventCategory\r\n , EventSeverity\r\n , DvcAction\r\n , NetworkApplicationProtocol\r\n , Ipv6Src\r\n , RuleName\r\n , RuleMessages\r\n , RuleData\r\n , RuleSelectors\r\n , ClientReputation\r\n , ApiId\r\n , RequestId\r\n , DstDvcHostname\r\n , DstPortNumber\r\n , ConfigId\r\n , PolicyId\r\n , NetworkBytes\r\n , UrlOriginal\r\n , HttpRequestMethod\r\n , SrcIpAddr\r\n , SlowPostAction\r\n , SlowPostRate\r\n , RuleVersions\r\n , RuleTags\r\n , ApiKey\r\n , Tls\r\n , RequestHeaders\r\n , ResponseHeaders\r\n , HttpStatusCode\r\n , GeoContinent\r\n , SrcGeoCountry\r\n , SrcGeoCity\r\n , SrcGeoRegion\r\n , GeoAsn\r\n , Custom\r\n", - "version": 1, + "query": "CommonSecurityLog \n| where DeviceVendor == 'Akamai'\n| where DeviceProduct == 'akamai_siem'\n| extend EventVendor = 'Akamai'\n| extend EventProduct = 'akamai_siem'\n| extend EventProductVersion = '1.0'\n| extend EventId = DeviceEventClassID\n| extend EventCategory = Activity\n| extend EventSeverity = LogSeverity\n| extend DvcAction = DeviceAction\n| extend NetworkApplicationProtocol = ApplicationProtocol\n| extend Ipv6Src = DeviceCustomIPv6Address2\n| extend RuleName = DeviceCustomString1\n| extend RuleMessages = DeviceCustomString2\n| extend RuleData = DeviceCustomString3\n| extend RuleSelectors = DeviceCustomString4\n| extend ClientReputation = DeviceCustomString5\n| extend ApiId = DeviceCustomString6\n| extend RequestId = DevicePayloadId\n| extend DstDvcHostname = DestinationHostName\n| extend DstPortNumber = DestinationPort\n| extend ConfigId = FlexString1\n| extend PolicyId = FlexString2\n| extend NetworkBytes = SentBytes\n| extend UrlOriginal = RequestURL\n| extend HttpRequestMethod = RequestMethod\n| extend SrcIpAddr = SourceIP\n| extend EventStartTime = datetime(1970-01-01) + coalesce(\n tolong(extract(@'.*start=(.*?);', 1, AdditionalExtensions)),\n tolong(column_ifexists(\"StartTime\", long(null)))\n ) * 1s \n| extend SlowPostAction = extract(@'.*AkamaiSiemSlowPostAction=(.*?);', 1, AdditionalExtensions)\n| extend SlowPostRate = extract(@'.*AkamaiSiemSlowPostRate=(.*?);', 1, AdditionalExtensions)\n| extend RuleVersions = extract(@'.*AkamaiSiemRuleVersions=,?(.*?);', 1, AdditionalExtensions)\n| extend RuleTags = extract(@'.*AkamaiSiemRuleTags=(.*?);', 1, AdditionalExtensions)\n| extend ApiKey = extract(@'.*AkamaiSiemApiKey=(.*?);', 1, AdditionalExtensions)\n| extend Tls = extract(@'.*AkamaiSiemTLSVersion=(.*?);', 1, AdditionalExtensions)\n| extend RequestHeaders = extract(@'.*AkamaiSiemRequestHeaders=;?(.*?);', 1, AdditionalExtensions)\n| extend ResponseHeaders = extract(@'.*AkamaiSiemResponseHeaders=(.*?);', 1, AdditionalExtensions)\n| extend HttpStatusCode = extract(@'.*AkamaiSiemResponseStatus=(.*?);', 1, AdditionalExtensions)\n| extend GeoContinent = extract(@'.*AkamaiSiemContinent=(.*?);', 1, AdditionalExtensions)\n| extend SrcGeoCountry = extract(@'.*AkamaiSiemCountry=(.*?);', 1, AdditionalExtensions)\n| extend SrcGeoCity = extract(@'.*AkamaiSiemCity=(.*?);', 1, AdditionalExtensions)\n| extend SrcGeoRegion = extract(@'.*AkamaiSiemRegion=(.*?);', 1, AdditionalExtensions)\n| extend GeoAsn = extract(@'.*AkamaiSiemASN=(\\d+)', 1, AdditionalExtensions)\n| extend Custom = extract(@'.*AkamaiSiemCusomData=(.*?)', 1, AdditionalExtensions)\n| project TimeGenerated\n , EventVendor\n , EventProduct\n , EventProductVersion\n , EventStartTime\n , EventId\n , EventCategory\n , EventSeverity\n , DvcAction\n , NetworkApplicationProtocol\n , Ipv6Src\n , RuleName\n , RuleMessages\n , RuleData\n , RuleSelectors\n , ClientReputation\n , ApiId\n , RequestId\n , DstDvcHostname\n , DstPortNumber\n , ConfigId\n , PolicyId\n , NetworkBytes\n , UrlOriginal\n , HttpRequestMethod\n , SrcIpAddr\n , SlowPostAction\n , SlowPostRate\n , RuleVersions\n , RuleTags\n , ApiKey\n , Tls\n , RequestHeaders\n , ResponseHeaders\n , HttpStatusCode\n , GeoContinent\n , SrcGeoCountry\n , SrcGeoCity\n , SrcGeoRegion\n , GeoAsn\n , Custom\n", + "functionParameters": "", + "version": 2, "tags": [ { "name": "description", - "value": "AkamaiSIEMEvent" + "value": "" } ] } @@ -460,7 +778,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", "dependsOn": [ - "[variables('_parserName1')]" + "[variables('_parserId1')]" ], "properties": { "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", @@ -485,21 +803,39 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_parserContentId1')]", + "contentKind": "Parser", + "displayName": "AkamaiSIEMEvent", + "contentProductId": "[variables('_parsercontentProductId1')]", + "id": "[variables('_parsercontentProductId1')]", + "version": "[variables('parserVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2021-06-01", + "apiVersion": "2022-10-01", "name": "[variables('_parserName1')]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "AkamaiSIEMEvent", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "AkamaiSIEMEvent", - "query": "\nCommonSecurityLog \r\n| where DeviceVendor == 'Akamai'\r\n| where DeviceProduct == 'akamai_siem'\r\n| extend EventVendor = 'Akamai'\r\n| extend EventProduct = 'akamai_siem'\r\n| extend EventProductVersion = '1.0'\r\n| extend EventId = DeviceEventClassID\r\n| extend EventCategory = Activity\r\n| extend EventSeverity = LogSeverity\r\n| extend DvcAction = DeviceAction\r\n| extend NetworkApplicationProtocol = ApplicationProtocol\r\n| extend Ipv6Src = DeviceCustomIPv6Address2\r\n| extend RuleName = DeviceCustomString1\r\n| extend RuleMessages = DeviceCustomString2\r\n| extend RuleData = DeviceCustomString3\r\n| extend RuleSelectors = DeviceCustomString4\r\n| extend ClientReputation = DeviceCustomString5\r\n| extend ApiId = DeviceCustomString6\r\n| extend RequestId = DevicePayloadId\r\n| extend DstDvcHostname = DestinationHostName\r\n| extend DstPortNumber = DestinationPort\r\n| extend ConfigId = FlexString1\r\n| extend PolicyId = FlexString2\r\n| extend NetworkBytes = SentBytes\r\n| extend UrlOriginal = RequestURL\r\n| extend HttpRequestMethod = RequestMethod\r\n| extend SrcIpAddr = SourceIP\r\n| extend EventStartTime = datetime(1970-01-01) + coalesce(\r\n tolong(extract(@'.*start=(.*?);', 1, AdditionalExtensions)),\r\n tolong(column_ifexists(\"StartTime\", long(null)))\r\n ) * 1s \r\n| extend SlowPostAction = extract(@'.*AkamaiSiemSlowPostAction=(.*?);', 1, AdditionalExtensions)\r\n| extend SlowPostRate = extract(@'.*AkamaiSiemSlowPostRate=(.*?);', 1, AdditionalExtensions)\r\n| extend RuleVersions = extract(@'.*AkamaiSiemRuleVersions=,?(.*?);', 1, AdditionalExtensions)\r\n| extend RuleTags = extract(@'.*AkamaiSiemRuleTags=(.*?);', 1, AdditionalExtensions)\r\n| extend ApiKey = extract(@'.*AkamaiSiemApiKey=(.*?);', 1, AdditionalExtensions)\r\n| extend Tls = extract(@'.*AkamaiSiemTLSVersion=(.*?);', 1, AdditionalExtensions)\r\n| extend RequestHeaders = extract(@'.*AkamaiSiemRequestHeaders=;?(.*?);', 1, AdditionalExtensions)\r\n| extend ResponseHeaders = extract(@'.*AkamaiSiemResponseHeaders=(.*?);', 1, AdditionalExtensions)\r\n| extend HttpStatusCode = extract(@'.*AkamaiSiemResponseStatus=(.*?);', 1, AdditionalExtensions)\r\n| extend GeoContinent = extract(@'.*AkamaiSiemContinent=(.*?);', 1, AdditionalExtensions)\r\n| extend SrcGeoCountry = extract(@'.*AkamaiSiemCountry=(.*?);', 1, AdditionalExtensions)\r\n| extend SrcGeoCity = extract(@'.*AkamaiSiemCity=(.*?);', 1, AdditionalExtensions)\r\n| extend SrcGeoRegion = extract(@'.*AkamaiSiemRegion=(.*?);', 1, AdditionalExtensions)\r\n| extend GeoAsn = extract(@'.*AkamaiSiemASN=(\\d+)', 1, AdditionalExtensions)\r\n| extend Custom = extract(@'.*AkamaiSiemCusomData=(.*?)', 1, AdditionalExtensions)\r\n| project TimeGenerated\r\n , EventVendor\r\n , EventProduct\r\n , EventProductVersion\r\n , EventStartTime\r\n , EventId\r\n , EventCategory\r\n , EventSeverity\r\n , DvcAction\r\n , NetworkApplicationProtocol\r\n , Ipv6Src\r\n , RuleName\r\n , RuleMessages\r\n , RuleData\r\n , RuleSelectors\r\n , ClientReputation\r\n , ApiId\r\n , RequestId\r\n , DstDvcHostname\r\n , DstPortNumber\r\n , ConfigId\r\n , PolicyId\r\n , NetworkBytes\r\n , UrlOriginal\r\n , HttpRequestMethod\r\n , SrcIpAddr\r\n , SlowPostAction\r\n , SlowPostRate\r\n , RuleVersions\r\n , RuleTags\r\n , ApiKey\r\n , Tls\r\n , RequestHeaders\r\n , ResponseHeaders\r\n , HttpStatusCode\r\n , GeoContinent\r\n , SrcGeoCountry\r\n , SrcGeoCity\r\n , SrcGeoRegion\r\n , GeoAsn\r\n , Custom\r\n", - "version": 1 + "query": "CommonSecurityLog \n| where DeviceVendor == 'Akamai'\n| where DeviceProduct == 'akamai_siem'\n| extend EventVendor = 'Akamai'\n| extend EventProduct = 'akamai_siem'\n| extend EventProductVersion = '1.0'\n| extend EventId = DeviceEventClassID\n| extend EventCategory = Activity\n| extend EventSeverity = LogSeverity\n| extend DvcAction = DeviceAction\n| extend NetworkApplicationProtocol = ApplicationProtocol\n| extend Ipv6Src = DeviceCustomIPv6Address2\n| extend RuleName = DeviceCustomString1\n| extend RuleMessages = DeviceCustomString2\n| extend RuleData = DeviceCustomString3\n| extend RuleSelectors = DeviceCustomString4\n| extend ClientReputation = DeviceCustomString5\n| extend ApiId = DeviceCustomString6\n| extend RequestId = DevicePayloadId\n| extend DstDvcHostname = DestinationHostName\n| extend DstPortNumber = DestinationPort\n| extend ConfigId = FlexString1\n| extend PolicyId = FlexString2\n| extend NetworkBytes = SentBytes\n| extend UrlOriginal = RequestURL\n| extend HttpRequestMethod = RequestMethod\n| extend SrcIpAddr = SourceIP\n| extend EventStartTime = datetime(1970-01-01) + coalesce(\n tolong(extract(@'.*start=(.*?);', 1, AdditionalExtensions)),\n tolong(column_ifexists(\"StartTime\", long(null)))\n ) * 1s \n| extend SlowPostAction = extract(@'.*AkamaiSiemSlowPostAction=(.*?);', 1, AdditionalExtensions)\n| extend SlowPostRate = extract(@'.*AkamaiSiemSlowPostRate=(.*?);', 1, AdditionalExtensions)\n| extend RuleVersions = extract(@'.*AkamaiSiemRuleVersions=,?(.*?);', 1, AdditionalExtensions)\n| extend RuleTags = extract(@'.*AkamaiSiemRuleTags=(.*?);', 1, AdditionalExtensions)\n| extend ApiKey = extract(@'.*AkamaiSiemApiKey=(.*?);', 1, AdditionalExtensions)\n| extend Tls = extract(@'.*AkamaiSiemTLSVersion=(.*?);', 1, AdditionalExtensions)\n| extend RequestHeaders = extract(@'.*AkamaiSiemRequestHeaders=;?(.*?);', 1, AdditionalExtensions)\n| extend ResponseHeaders = extract(@'.*AkamaiSiemResponseHeaders=(.*?);', 1, AdditionalExtensions)\n| extend HttpStatusCode = extract(@'.*AkamaiSiemResponseStatus=(.*?);', 1, AdditionalExtensions)\n| extend GeoContinent = extract(@'.*AkamaiSiemContinent=(.*?);', 1, AdditionalExtensions)\n| extend SrcGeoCountry = extract(@'.*AkamaiSiemCountry=(.*?);', 1, AdditionalExtensions)\n| extend SrcGeoCity = extract(@'.*AkamaiSiemCity=(.*?);', 1, AdditionalExtensions)\n| extend SrcGeoRegion = extract(@'.*AkamaiSiemRegion=(.*?);', 1, AdditionalExtensions)\n| extend GeoAsn = extract(@'.*AkamaiSiemASN=(\\d+)', 1, AdditionalExtensions)\n| extend Custom = extract(@'.*AkamaiSiemCusomData=(.*?)', 1, AdditionalExtensions)\n| project TimeGenerated\n , EventVendor\n , EventProduct\n , EventProductVersion\n , EventStartTime\n , EventId\n , EventCategory\n , EventSeverity\n , DvcAction\n , NetworkApplicationProtocol\n , Ipv6Src\n , RuleName\n , RuleMessages\n , RuleData\n , RuleSelectors\n , ClientReputation\n , ApiId\n , RequestId\n , DstDvcHostname\n , DstPortNumber\n , ConfigId\n , PolicyId\n , NetworkBytes\n , UrlOriginal\n , HttpRequestMethod\n , SrcIpAddr\n , SlowPostAction\n , SlowPostRate\n , RuleVersions\n , RuleTags\n , ApiKey\n , Tls\n , RequestHeaders\n , ResponseHeaders\n , HttpStatusCode\n , GeoContinent\n , SrcGeoCountry\n , SrcGeoCity\n , SrcGeoRegion\n , GeoAsn\n , Custom\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { @@ -533,13 +869,20 @@ } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.2", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "Akamai Security Events", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Akamai Security Solution for Microsoft Sentinel enables ingestion of Akamai Security Solutions events using the Common Event Format (CEF) into Microsoft Sentinel for Security Monitoring.

\n
    \n

  1. Akamai Security Events via AMA - This data connector helps in ingesting Akamai Security Events logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. Akamai Security Events via Legacy Agent - This data connector helps in ingesting Akamai Security Events logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends installation of Akamai Security Events via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { @@ -565,6 +908,11 @@ "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId2')]", + "version": "[variables('dataConnectorVersion2')]" + }, { "kind": "Parser", "contentId": "[variables('_parserContentId1')]", diff --git a/Solutions/Akamai Security Events/Parsers/AkamaiSIEMEvent.txt b/Solutions/Akamai Security Events/Parsers/AkamaiSIEMEvent.txt deleted file mode 100644 index 61b9b545a55..00000000000 --- a/Solutions/Akamai Security Events/Parsers/AkamaiSIEMEvent.txt +++ /dev/null @@ -1,88 +0,0 @@ -// Reference : Using functions in Azure monitor log queries : https://docs.microsoft.com/azure/azure-monitor/log-query/functions -CommonSecurityLog -| where DeviceVendor == 'Akamai' -| where DeviceProduct == 'akamai_siem' -| extend EventVendor = 'Akamai' -| extend EventProduct = 'akamai_siem' -| extend EventProductVersion = '1.0' -| extend EventId = DeviceEventClassID -| extend EventCategory = Activity -| extend EventSeverity = LogSeverity -| extend DvcAction = DeviceAction -| extend NetworkApplicationProtocol = ApplicationProtocol -| extend Ipv6Src = DeviceCustomIPv6Address2 -| extend RuleName = DeviceCustomString1 -| extend RuleMessages = DeviceCustomString2 -| extend RuleData = DeviceCustomString3 -| extend RuleSelectors = DeviceCustomString4 -| extend ClientReputation = DeviceCustomString5 -| extend ApiId = DeviceCustomString6 -| extend RequestId = DevicePayloadId -| extend DstDvcHostname = DestinationHostName -| extend DstPortNumber = DestinationPort -| extend ConfigId = FlexString1 -| extend PolicyId = FlexString2 -| extend NetworkBytes = SentBytes -| extend UrlOriginal = RequestURL -| extend HttpRequestMethod = RequestMethod -| extend SrcIpAddr = SourceIP -| extend EventStartTime = datetime(1970-01-01) + coalesce( - tolong(extract(@'.*start=(.*?);', 1, AdditionalExtensions)), - tolong(column_ifexists("StartTime", long(null))) - ) * 1s -| extend SlowPostAction = extract(@'.*AkamaiSiemSlowPostAction=(.*?);', 1, AdditionalExtensions) -| extend SlowPostRate = extract(@'.*AkamaiSiemSlowPostRate=(.*?);', 1, AdditionalExtensions) -| extend RuleVersions = extract(@'.*AkamaiSiemRuleVersions=,?(.*?);', 1, AdditionalExtensions) -| extend RuleTags = extract(@'.*AkamaiSiemRuleTags=(.*?);', 1, AdditionalExtensions) -| extend ApiKey = extract(@'.*AkamaiSiemApiKey=(.*?);', 1, AdditionalExtensions) -| extend Tls = extract(@'.*AkamaiSiemTLSVersion=(.*?);', 1, AdditionalExtensions) -| extend RequestHeaders = extract(@'.*AkamaiSiemRequestHeaders=;?(.*?);', 1, AdditionalExtensions) -| extend ResponseHeaders = extract(@'.*AkamaiSiemResponseHeaders=(.*?);', 1, AdditionalExtensions) -| extend HttpStatusCode = extract(@'.*AkamaiSiemResponseStatus=(.*?);', 1, AdditionalExtensions) -| extend GeoContinent = extract(@'.*AkamaiSiemContinent=(.*?);', 1, AdditionalExtensions) -| extend SrcGeoCountry = extract(@'.*AkamaiSiemCountry=(.*?);', 1, AdditionalExtensions) -| extend SrcGeoCity = extract(@'.*AkamaiSiemCity=(.*?);', 1, AdditionalExtensions) -| extend SrcGeoRegion = extract(@'.*AkamaiSiemRegion=(.*?);', 1, AdditionalExtensions) -| extend GeoAsn = extract(@'.*AkamaiSiemASN=(\d+)', 1, AdditionalExtensions) -| extend Custom = extract(@'.*AkamaiSiemCusomData=(.*?)', 1, AdditionalExtensions) -| project TimeGenerated - , EventVendor - , EventProduct - , EventProductVersion - , EventStartTime - , EventId - , EventCategory - , EventSeverity - , DvcAction - , NetworkApplicationProtocol - , Ipv6Src - , RuleName - , RuleMessages - , RuleData - , RuleSelectors - , ClientReputation - , ApiId - , RequestId - , DstDvcHostname - , DstPortNumber - , ConfigId - , PolicyId - , NetworkBytes - , UrlOriginal - , HttpRequestMethod - , SrcIpAddr - , SlowPostAction - , SlowPostRate - , RuleVersions - , RuleTags - , ApiKey - , Tls - , RequestHeaders - , ResponseHeaders - , HttpStatusCode - , GeoContinent - , SrcGeoCountry - , SrcGeoCity - , SrcGeoRegion - , GeoAsn - , Custom diff --git a/Solutions/Akamai Security Events/ReleaseNotes.md b/Solutions/Akamai Security Events/ReleaseNotes.md new file mode 100644 index 00000000000..079c01c0a83 --- /dev/null +++ b/Solutions/Akamai Security Events/ReleaseNotes.md @@ -0,0 +1,5 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------| +| 3.0.0 | 20-09-2023 | Addition of new Akamai Security Events AMA **Data Connector** | | + + diff --git a/Solutions/Aruba ClearPass/Data Connectors/Connector_Syslog_ArubaClearPass.json b/Solutions/Aruba ClearPass/Data Connectors/Connector_Syslog_ArubaClearPass.json index 7bcd8068372..74369318b04 100644 --- a/Solutions/Aruba ClearPass/Data Connectors/Connector_Syslog_ArubaClearPass.json +++ b/Solutions/Aruba ClearPass/Data Connectors/Connector_Syslog_ArubaClearPass.json @@ -1,6 +1,6 @@ { "id": "ArubaClearPass", - "title": "Aruba ClearPass", + "title": "[Deprecated] Aruba ClearPass via Legacy Agent", "publisher": "Aruba Networks", "descriptionMarkdown": "The [Aruba ClearPass](https://www.arubanetworks.com/products/security/network-access-control/secure-access/) connector allows you to easily connect your Aruba ClearPass with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities.", "additionalRequirementBanner":"These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", @@ -54,7 +54,7 @@ "instructionSteps": [ { "title": "", - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Aruba%20ClearPass/Parsers/ArubaClearPass.txt).The function usually takes 10-15 minutes to activate after solution installation/update.", + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://aka.ms/sentinel-arubaclearpass-parser).The function usually takes 10-15 minutes to activate after solution installation/update.", "instructions": [ ] }, diff --git a/Solutions/Aruba ClearPass/Data Connectors/template_ArubaClearPassAMA.json b/Solutions/Aruba ClearPass/Data Connectors/template_ArubaClearPassAMA.json new file mode 100644 index 00000000000..940dd63ed98 --- /dev/null +++ b/Solutions/Aruba ClearPass/Data Connectors/template_ArubaClearPassAMA.json @@ -0,0 +1,108 @@ +{ + "id": "ArubaClearPassAma", + "title": "[Recommended] Aruba ClearPass via AMA", + "publisher": "Aruba Networks", + "descriptionMarkdown": "The [Aruba ClearPass](https://www.arubanetworks.com/products/security/network-access-control/secure-access/) connector allows you to easily connect your Aruba ClearPass with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities.", + "additionalRequirementBanner":"These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", + "graphQueries": [{ + "metricName": "Total data received", + "legend": "ArubaClearPass", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Aruba Networks'\n |where DeviceProduct =~ 'ClearPass'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + }], + "sampleQueries": [{ + "description": "Top 10 Events by Username", + "query": "ArubaClearPass \n | summarize count() by UserName \n| top 10 by count_" + }, { + "description": "Top 10 Error Codes", + "query": "ArubaClearPass \n | summarize count() by ErrorCode \n| top 10 by count_" + }], + "connectivityCriterias": [{ + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Aruba Networks'\n |where DeviceProduct =~ 'ClearPass'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + }], + "dataTypes": [{ + "name": "CommonSecurityLog (ArubaClearPass)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Aruba Networks'\n |where DeviceProduct =~ 'ClearPass'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [{ + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + }], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "title": "", + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://aka.ms/sentinel-arubaclearpass-parser).The function usually takes 10-15 minutes to activate after solution installation/update.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine", + "instructions": [ + ] + }, + { + "title": "Step B. Forward Aruba ClearPass logs to a Syslog agent", + "description": "Configure Aruba ClearPass to forward Syslog messages in CEF format to your Microsoft Sentinel workspace via the Syslog agent.\n1. [Follow these instructions](https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/Content/CPPM_UserGuide/Admin/syslogExportFilters_add_syslog_filter_general.htm) to configure the Aruba ClearPass to forward syslog.\n2. Use the IP address or hostname for the Linux device with the Linux agent installed as the Destination IP address.", + "instructions": [ + ] + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "title": "2. Secure your machine ", + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)" + } + + ] +} diff --git a/Solutions/Aruba ClearPass/Data/Solution_Aruba.json b/Solutions/Aruba ClearPass/Data/Solution_Aruba.json index f3f5bdbce47..2e56770a67a 100644 --- a/Solutions/Aruba ClearPass/Data/Solution_Aruba.json +++ b/Solutions/Aruba ClearPass/Data/Solution_Aruba.json @@ -2,15 +2,16 @@ "Name": "Aruba ClearPass", "Author": "Aruba Networks", "Logo": "", - "Description": "The [Aruba ClearPass](https://www.arubanetworks.com/products/security/network-access-control/secure-access/) solution allows you to easily connect your Aruba ClearPass with Microsoft Sentinel. solution for Microsoft Sentinel enables you to ingest Symantec VIP's authentication logs into Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs\n\n- [Agent-based log collection (CEF)](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)", + "Description": "The [Aruba ClearPass](https://www.arubanetworks.com/products/security/network-access-control/secure-access/) solution allows you to easily connect your Aruba ClearPass with Microsoft Sentinel. \n\r\n1. **Aruba ClearPass via AMA** - This data connector helps in ingesting Aruba ClearPass logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Aruba ClearPass via Legacy Agent** - This data connector helps in ingesting Aruba ClearPass logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Aruba ClearPass via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", "Data Connectors": [ - "Solutions/Aruba ClearPass/Data Connectors/Connector_Syslog_ArubaClearPass.json" + "Solutions/Aruba ClearPass/Data Connectors/Connector_Syslog_ArubaClearPass.json", + "Solutions/Aruba ClearPass/Data Connectors/template_ArubaClearPassAMA.json" ], "Parsers": [ - "Solutions/Aruba ClearPass/Parsers/ArubaClearPass.txt" + "Solutions/Aruba ClearPass/Parsers/ArubaClearPass.yaml" ], "BasePath": "C:\\GitHub\\Azure-Sentinel", - "Version": "2.0.2", + "Version": "3.0.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Aruba ClearPass/Data/system_generated_metadata.json b/Solutions/Aruba ClearPass/Data/system_generated_metadata.json new file mode 100644 index 00000000000..34d058d2ea1 --- /dev/null +++ b/Solutions/Aruba ClearPass/Data/system_generated_metadata.json @@ -0,0 +1,31 @@ +{ + "Name": "Aruba ClearPass", + "Author": "Aruba Networks", + "Logo": "", + "Description": "The [Aruba ClearPass](https://www.arubanetworks.com/products/security/network-access-control/secure-access/) solution allows you to easily connect your Aruba ClearPass with Microsoft Sentinel. \n\r\n1. **Aruba ClearPass via AMA** - This data connector helps in ingesting Aruba ClearPass logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Aruba ClearPass via Legacy Agent** - This data connector helps in ingesting Aruba ClearPass logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Aruba ClearPass via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "BasePath": "C:\\GitHub\\Azure-Sentinel", + "Version": "3.0.0", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false, + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-arubaclearpass", + "providers": [ + "Aruba" + ], + "categories": { + "domains": [ + "Security - Threat Protection" + ], + "verticals": [] + }, + "firstPublishDate": "2022-05-23", + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + }, + "Data Connectors": "[\n \"Connector_Syslog_ArubaClearPass.json\",\n \"template_ArubaClearPassAMA.json\"\n]", + "Parsers": "[\n \"ArubaClearPass.yaml\"\n]" +} diff --git a/Solutions/Aruba ClearPass/Package/3.0.0.zip b/Solutions/Aruba ClearPass/Package/3.0.0.zip new file mode 100644 index 00000000000..088fd756d98 Binary files /dev/null and b/Solutions/Aruba ClearPass/Package/3.0.0.zip differ diff --git a/Solutions/Aruba ClearPass/Package/3.0.1.zip b/Solutions/Aruba ClearPass/Package/3.0.1.zip new file mode 100644 index 00000000000..92d4c3602aa Binary files /dev/null and b/Solutions/Aruba ClearPass/Package/3.0.1.zip differ diff --git a/Solutions/Aruba ClearPass/Package/createUiDefinition.json b/Solutions/Aruba ClearPass/Package/createUiDefinition.json index b54986ca34a..c5be275e43f 100644 --- a/Solutions/Aruba ClearPass/Package/createUiDefinition.json +++ b/Solutions/Aruba ClearPass/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Aruba ClearPass](https://www.arubanetworks.com/products/security/network-access-control/secure-access/) solution allows you to easily connect your Aruba ClearPass with Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs\n\n- [Agent-based log collection (CEF)](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)\n\n**Data Connectors:** 1, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Aruba%20ClearPass/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Aruba ClearPass](https://www.arubanetworks.com/products/security/network-access-control/secure-access/) solution allows you to easily connect your Aruba ClearPass with Microsoft Sentinel. \n\r\n1. **Aruba ClearPass via AMA** - This data connector helps in ingesting Aruba ClearPass logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Aruba ClearPass via Legacy Agent** - This data connector helps in ingesting Aruba ClearPass logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Aruba ClearPass via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -63,6 +63,7 @@ "text": "The solution installs the data connector ingesting Aruba ClearPass to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, + { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", diff --git a/Solutions/Aruba ClearPass/Package/mainTemplate.json b/Solutions/Aruba ClearPass/Package/mainTemplate.json index 3a2d4d9b15b..ce7574a75c2 100644 --- a/Solutions/Aruba ClearPass/Package/mainTemplate.json +++ b/Solutions/Aruba ClearPass/Package/mainTemplate.json @@ -30,55 +30,50 @@ } }, "variables": { + "_solutionName": "Aruba ClearPass", + "_solutionVersion": "3.0.1", "solutionId": "azuresentinel.azure-sentinel-solution-arubaclearpass", "_solutionId": "[variables('solutionId')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "uiConfigId1": "ArubaClearPass", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "ArubaClearPass", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", - "parserVersion1": "1.0.0", - "parserContentId1": "ArubaClearPass-Parser", - "_parserContentId1": "[variables('parserContentId1')]", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "uiConfigId2": "ArubaClearPassAma", + "_uiConfigId2": "[variables('uiConfigId2')]", + "dataConnectorContentId2": "ArubaClearPassAma", + "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", + "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "_dataConnectorId2": "[variables('dataConnectorId2')]", + "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", + "dataConnectorVersion2": "1.0.0", + "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "parserName1": "ArubaClearPass", "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1')))]" + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", + "parserVersion1": "1.0.0", + "parserContentId1": "ArubaClearPass-Parser", + "_parserContentId1": "[variables('parserContentId1')]", + "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "Aruba ClearPass data connector with template", - "displayName": "Aruba ClearPass template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Aruba ClearPass data connector with template version 2.0.2", + "description": "Aruba ClearPass data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -94,7 +89,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId1')]", - "title": "Aruba ClearPass", + "title": "[Deprecated] Aruba ClearPass via Legacy Agent", "publisher": "Aruba Networks", "descriptionMarkdown": "The [Aruba ClearPass](https://www.arubanetworks.com/products/security/network-access-control/secure-access/) connector allows you to easily connect your Aruba ClearPass with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities.", "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", @@ -159,7 +154,7 @@ }, "instructionSteps": [ { - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Aruba%20ClearPass/Parsers/ArubaClearPass.txt).The function usually takes 10-15 minutes to activate after solution installation/update." + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://aka.ms/sentinel-arubaclearpass-parser).The function usually takes 10-15 minutes to activate after solution installation/update." }, { "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", @@ -218,7 +213,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -242,12 +237,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "[Deprecated] Aruba ClearPass via Legacy Agent", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -282,7 +288,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Aruba ClearPass", + "title": "[Deprecated] Aruba ClearPass via Legacy Agent", "publisher": "Aruba Networks", "descriptionMarkdown": "The [Aruba ClearPass](https://www.arubanetworks.com/products/security/network-access-control/secure-access/) connector allows you to easily connect your Aruba ClearPass with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities.", "graphQueries": [ @@ -346,7 +352,7 @@ }, "instructionSteps": [ { - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Aruba%20ClearPass/Parsers/ArubaClearPass.txt).The function usually takes 10-15 minutes to activate after solution installation/update." + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://aka.ms/sentinel-arubaclearpass-parser).The function usually takes 10-15 minutes to activate after solution installation/update." }, { "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", @@ -406,33 +412,350 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('parserTemplateSpecName1')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "description": "ArubaClearPass Data Parser with template", - "displayName": "ArubaClearPass Data Parser template" + "description": "Aruba ClearPass data connector with template version 3.0.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion2')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId2')]", + "title": "[Recommended] Aruba ClearPass via AMA", + "publisher": "Aruba Networks", + "descriptionMarkdown": "The [Aruba ClearPass](https://www.arubanetworks.com/products/security/network-access-control/secure-access/) connector allows you to easily connect your Aruba ClearPass with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities.", + "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "ArubaClearPass", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Aruba Networks'\n |where DeviceProduct =~ 'ClearPass'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description": "Top 10 Events by Username", + "query": "ArubaClearPass \n | summarize count() by UserName \n| top 10 by count_" + }, + { + "description": "Top 10 Error Codes", + "query": "ArubaClearPass \n | summarize count() by ErrorCode \n| top 10 by count_" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Aruba Networks'\n |where DeviceProduct =~ 'ClearPass'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (ArubaClearPass)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Aruba Networks'\n |where DeviceProduct =~ 'ClearPass'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://aka.ms/sentinel-arubaclearpass-parser).The function usually takes 10-15 minutes to activate after solution installation/update.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Aruba ClearPass logs to a Syslog agent", + "description": "Configure Aruba ClearPass to forward Syslog messages in CEF format to your Microsoft Sentinel workspace via the Syslog agent.\n1. [Follow these instructions](https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/Content/CPPM_UserGuide/Admin/syslogExportFilters_add_syslog_filter_general.htm) to configure the Aruba ClearPass to forward syslog.\n2. Use the IP address or hostname for the Linux device with the Linux agent installed as the Destination IP address." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "Aruba ClearPass", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Aruba Networks" + }, + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId2')]", + "contentKind": "DataConnector", + "displayName": "[Recommended] Aruba ClearPass via AMA", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", + "version": "[variables('dataConnectorVersion2')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('parserTemplateSpecName1'),'/',variables('parserVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId2')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "Aruba ClearPass", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Aruba Networks" + }, + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "[Recommended] Aruba ClearPass via AMA", + "publisher": "Aruba Networks", + "descriptionMarkdown": "The [Aruba ClearPass](https://www.arubanetworks.com/products/security/network-access-control/secure-access/) connector allows you to easily connect your Aruba ClearPass with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "ArubaClearPass", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Aruba Networks'\n |where DeviceProduct =~ 'ClearPass'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (ArubaClearPass)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Aruba Networks'\n |where DeviceProduct =~ 'ClearPass'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Aruba Networks'\n |where DeviceProduct =~ 'ClearPass'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Top 10 Events by Username", + "query": "ArubaClearPass \n | summarize count() by UserName \n| top 10 by count_" + }, + { + "description": "Top 10 Error Codes", + "query": "ArubaClearPass \n | summarize count() by ErrorCode \n| top 10 by count_" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://aka.ms/sentinel-arubaclearpass-parser).The function usually takes 10-15 minutes to activate after solution installation/update.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Aruba ClearPass logs to a Syslog agent", + "description": "Configure Aruba ClearPass to forward Syslog messages in CEF format to your Microsoft Sentinel workspace via the Syslog agent.\n1. [Follow these instructions](https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/Content/CPPM_UserGuide/Admin/syslogExportFilters_add_syslog_filter_general.htm) to configure the Aruba ClearPass to forward syslog.\n2. Use the IP address or hostname for the Linux device with the Linux agent installed as the Destination IP address." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ], + "id": "[variables('_uiConfigId2')]", + "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution." + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('parserTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ArubaClearPass Data Parser with template version 2.0.2", + "description": "ArubaClearPass Data Parser with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserVersion1')]", @@ -441,20 +764,21 @@ "resources": [ { "name": "[variables('_parserName1')]", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "ArubaClearPass", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "ArubaClearPass", - "query": "\nlet LogHeader =\r\nCommonSecurityLog\r\n| where DeviceVendor == \"Aruba Networks\" and DeviceProduct == \"ClearPass\"\r\n| extend Category = coalesce(\r\n extract(@'cat=([^;]+)(\\;|$)',1, AdditionalExtensions), \r\n column_ifexists(\"DeviceEventCategory\", \"\")\r\n ),\r\n Outcome = coalesce(\r\n extract(@'outcome=([^;]+)\\;',1, AdditionalExtensions), \r\n column_ifexists(\"EventOutcome\", \"\")\r\n )\r\n| project-rename DvcIpAddr = DeviceAddress,\r\n DvcVersion = DeviceVersion,\r\n SrcIpAddr = SourceIP;\r\nlet InsightLogs = LogHeader\r\n| where Activity == \"Insight Logs\" or Category == \"Insight Logs\"\r\n| extend UserName = extract(@'Auth.Username=([^;]+)\\;',1, AdditionalExtensions),\r\n AuthorizationSources = extract(@'Auth.Authorization-Sources=([^;]+)\\;',1, AdditionalExtensions),\r\n NetworkProtocol = extract(@'Auth.Protocol=([^;]+)\\;',1, AdditionalExtensions),\r\n RequestTimestamp = extract(@'Auth.Request-Timestamp=([^;]+)\\;',1, AdditionalExtensions),\r\n LoginStatus = extract(@'Auth.Login-Status=([^;]+)\\;',1, AdditionalExtensions),\r\n Source = extract(@'Auth.Source=([^;]+)\\;',1, AdditionalExtensions),\r\n EnforcementProfiles = extract(@'Auth.Enforcement-Profiles=([^;]+)\\;',1, AdditionalExtensions),\r\n NasPort = extract(@'Auth.NAS-Port=([^;]+)\\;',1, AdditionalExtensions),\r\n TimestampFormat = extract(@'TimestampFormat=([^;]+)\\;',1, AdditionalExtensions),\r\n Ssid = extract(@'Auth.SSID=([^;]+)\\;',1, AdditionalExtensions),\r\n NasPortType = extract(@'Auth.NAS-Port-Type=([^;]+)\\;',1, AdditionalExtensions),\r\n ErrorCode = extract(@'Auth.Error-Code=([^;]+)\\;',1, AdditionalExtensions),\r\n Roles = extract(@'Auth.Roles=([^;]+)\\;',1, AdditionalExtensions),\r\n Service = extract(@'Auth.Service=([^;]+)\\;',1, AdditionalExtensions),\r\n SrcMacAddr = extract(@'Auth.Host-MAC-Address=([^;]+)\\;',1, AdditionalExtensions),\r\n Unhealthy = extract(@'Auth.Unhealthy=([^;]+)\\;',1, AdditionalExtensions),\r\n NasIpAddr = extract(@'Auth.NAS-IP-Address=([^;]+)\\;',1, AdditionalExtensions),\r\n CalledStationId = extract(@'Auth.CalledStationId=([^;]+)\\;',1, AdditionalExtensions),\r\n NasIdentifier = extract(@'Auth.NAS-Identifier=([^;]+)\\;',1, AdditionalExtensions)\r\n| extend EndpointStatus = extract(@'ArubaClearpassEndpointStatus=([^;]+)\\;',1, AdditionalExtensions),\r\n EndpointConflict = extract(@'ArubaClearpassEndpointConflict=([^;]+)\\;',1, AdditionalExtensions),\r\n EndpointDvcCategory = iif(DeviceCustomString3Label == \"Endpoint.Device-Category\", DeviceCustomString3, \"\"),\r\n EndpointDvcFamily = iif(DeviceCustomString4Label == \"Endpoint.Device-Family\", DeviceCustomString4, \"\"),\r\n EndpointDvcName = iif(DeviceCustomString5Label == \"Endpoint.Device-Name\", DeviceCustomString5, \"\"),\r\n EndpointMacVendor = iif(DeviceCustomString6Label == \"Endpoint.MAC-Vendor\", DeviceCustomString6, \"\"), \r\n EndpointAddedDate= iif(DeviceCustomDate1Label == \"Endpoint.Added-At\", todatetime(DeviceCustomDate1), todatetime(\"\"))\r\n| extend Category = iif(isempty(Category), \"Insight Logs\", Category); \r\nlet AuditRecords = LogHeader\r\n| where Activity == \"Audit Records\" or Category == \"Audit Records\"\r\n| extend TimestampFormat = extract(@'timeFormat=([^;]+)\\;',1, AdditionalExtensions),\r\n UserName = extract(@'usrName=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| extend Category = iif(isempty(Category), \"Audit Records\", Category);\r\nlet SessionLogs = LogHeader\r\n| where Activity == \"Session Logs\" or Category == \"Session Logs\"\r\n| extend Timestamp = extract(@'RADIUS.Acct-Timestamp=([^;]+)\\;',1, AdditionalExtensions),\r\n CallingStationId = extract(@'RADIUS.Acct-Calling-Station-Id=([^;]+)\\;',1, AdditionalExtensions),\r\n InputOctets = extract(@'RADIUS.Acct-Input-Octets=([^;]+)\\;',1, AdditionalExtensions),\r\n TimestampFormat = extract(@'TimestampFormat=([^;]+)\\;',1, AdditionalExtensions),\r\n SessionTime = extract(@'RADIUS.Acct-Session-Time=([^;]+)\\;',1, AdditionalExtensions),\r\n FramedIpAddr = extract(@'RADIUS.Acct-Framed-IP-Address=([^;]+)\\;',1, AdditionalExtensions),\r\n Source = extract(@'RADIUS.Auth-Source=([^;]+)\\;',1, AdditionalExtensions),\r\n Method = extract(@'RADIUS.Auth-Method=([^;]+)\\;',1, AdditionalExtensions),\r\n SessionId = extract(@'RADIUS.Acct-Session-Id=([^;]+)\\;',1, AdditionalExtensions),\r\n ServiceName = extract(@'RADIUS.Acct-Service-Name=([^;]+)\\;',1, AdditionalExtensions),\r\n NasPortNumber = extract(@'RADIUS.Acct-NAS-Port=([^;]+)\\;',1, AdditionalExtensions),\r\n NasPortType = extract(@'RADIUS.Acct-NAS-Port-Type=([^;]+)\\;',1, AdditionalExtensions),\r\n OutputOctets = extract(@'RADIUS.Acct-Output-Octets=([^;]+)\\;',1, AdditionalExtensions),\r\n UserName = extract(@'RADIUS.Acct-Username=([^;]+)\\;',1, AdditionalExtensions),\r\n NasIpAddr = extract(@'RADIUS.Acct-NAS-IP-Address=([^;]+)\\;',1, AdditionalExtensions)\r\n| project-rename DstServiceName = DestinationServiceName,\r\n DstUserPriviledges = DestinationUserPrivileges,\r\n DstUserName = DestinationUserName,\r\n DstMacAddr = DestinationMACAddress\r\n| extend Category = iif(isempty(Category), \"Sessions Logs\", Category);\r\nlet SystemLogs = LogHeader\r\n| where Activity == \"System Logs\" or Category == \"ClearPass System Events\"\r\n| extend Description = extract(@'description=([^;]+)\\;',1, AdditionalExtensions),\r\n Action = extract(@'daction=([^;]+)\\;',1, AdditionalExtensions),\r\n InputOctets = extract(@'RADIUS.Acct-Input-Octets=([^;]+)\\;',1, AdditionalExtensions),\r\n TimeFormat = extract(@'devTimeFormat=([^;]+)\\;',1, AdditionalExtensions)\r\n| extend Category = iif(isempty(Category), \"System Logs\", \"System Logs\");\r\nunion SessionLogs, InsightLogs, AuditRecords, SystemLogs", - "version": 1, + "query": "let LogHeader =\nCommonSecurityLog\n| where DeviceVendor == \"Aruba Networks\" and DeviceProduct == \"ClearPass\"\n| extend Category = coalesce(\n extract(@'cat=([^;]+)(\\;|$)',1, AdditionalExtensions), \n column_ifexists(\"DeviceEventCategory\", \"\")\n ),\n Outcome = coalesce(\n extract(@'outcome=([^;]+)\\;',1, AdditionalExtensions), \n column_ifexists(\"EventOutcome\", \"\")\n )\n| project-rename DvcIpAddr = DeviceAddress,\n DvcVersion = DeviceVersion,\n SrcIpAddr = SourceIP;\nlet InsightLogs = LogHeader\n| where Activity == \"Insight Logs\" or Category == \"Insight Logs\"\n// Version 6.5\n| extend UserName = extract(@'Auth.Username=([^;]+)\\;',1, AdditionalExtensions),\n AuthorizationSources = extract(@'Auth.Authorization-Sources=([^;]+)\\;',1, AdditionalExtensions),\n NetworkProtocol = extract(@'Auth.Protocol=([^;]+)\\;',1, AdditionalExtensions),\n RequestTimestamp = extract(@'Auth.Request-Timestamp=([^;]+)\\;',1, AdditionalExtensions),\n LoginStatus = extract(@'Auth.Login-Status=([^;]+)\\;',1, AdditionalExtensions),\n Source = extract(@'Auth.Source=([^;]+)\\;',1, AdditionalExtensions),\n EnforcementProfiles = extract(@'Auth.Enforcement-Profiles=([^;]+)\\;',1, AdditionalExtensions),\n NasPort = extract(@'Auth.NAS-Port=([^;]+)\\;',1, AdditionalExtensions),\n TimestampFormat = extract(@'TimestampFormat=([^;]+)\\;',1, AdditionalExtensions),\n Ssid = extract(@'Auth.SSID=([^;]+)\\;',1, AdditionalExtensions),\n NasPortType = extract(@'Auth.NAS-Port-Type=([^;]+)\\;',1, AdditionalExtensions),\n ErrorCode = extract(@'Auth.Error-Code=([^;]+)\\;',1, AdditionalExtensions),\n Roles = extract(@'Auth.Roles=([^;]+)\\;',1, AdditionalExtensions),\n Service = extract(@'Auth.Service=([^;]+)\\;',1, AdditionalExtensions),\n SrcMacAddr = extract(@'Auth.Host-MAC-Address=([^;]+)\\;',1, AdditionalExtensions),\n Unhealthy = extract(@'Auth.Unhealthy=([^;]+)\\;',1, AdditionalExtensions),\n NasIpAddr = extract(@'Auth.NAS-IP-Address=([^;]+)\\;',1, AdditionalExtensions),\n CalledStationId = extract(@'Auth.CalledStationId=([^;]+)\\;',1, AdditionalExtensions),\n NasIdentifier = extract(@'Auth.NAS-Identifier=([^;]+)\\;',1, AdditionalExtensions)\n// Version 6.6+\n| extend EndpointStatus = extract(@'ArubaClearpassEndpointStatus=([^;]+)\\;',1, AdditionalExtensions),\n EndpointConflict = extract(@'ArubaClearpassEndpointConflict=([^;]+)\\;',1, AdditionalExtensions),\n EndpointDvcCategory = iif(DeviceCustomString3Label == \"Endpoint.Device-Category\", DeviceCustomString3, \"\"),\n EndpointDvcFamily = iif(DeviceCustomString4Label == \"Endpoint.Device-Family\", DeviceCustomString4, \"\"),\n EndpointDvcName = iif(DeviceCustomString5Label == \"Endpoint.Device-Name\", DeviceCustomString5, \"\"),\n EndpointMacVendor = iif(DeviceCustomString6Label == \"Endpoint.MAC-Vendor\", DeviceCustomString6, \"\"), \n EndpointAddedDate= iif(DeviceCustomDate1Label == \"Endpoint.Added-At\", todatetime(DeviceCustomDate1), todatetime(\"\"))\n| extend Category = iif(isempty(Category), \"Insight Logs\", Category); \nlet AuditRecords = LogHeader\n| where Activity == \"Audit Records\" or Category == \"Audit Records\"\n| extend TimestampFormat = extract(@'timeFormat=([^;]+)\\;',1, AdditionalExtensions),\n UserName = extract(@'usrName=([^;]+)(\\;|$)',1, AdditionalExtensions)\n| extend Category = iif(isempty(Category), \"Audit Records\", Category);\nlet SessionLogs = LogHeader\n| where Activity == \"Session Logs\" or Category == \"Session Logs\"\n| extend Timestamp = extract(@'RADIUS.Acct-Timestamp=([^;]+)\\;',1, AdditionalExtensions),\n CallingStationId = extract(@'RADIUS.Acct-Calling-Station-Id=([^;]+)\\;',1, AdditionalExtensions),\n InputOctets = extract(@'RADIUS.Acct-Input-Octets=([^;]+)\\;',1, AdditionalExtensions),\n TimestampFormat = extract(@'TimestampFormat=([^;]+)\\;',1, AdditionalExtensions),\n SessionTime = extract(@'RADIUS.Acct-Session-Time=([^;]+)\\;',1, AdditionalExtensions),\n FramedIpAddr = extract(@'RADIUS.Acct-Framed-IP-Address=([^;]+)\\;',1, AdditionalExtensions),\n Source = extract(@'RADIUS.Auth-Source=([^;]+)\\;',1, AdditionalExtensions),\n Method = extract(@'RADIUS.Auth-Method=([^;]+)\\;',1, AdditionalExtensions),\n SessionId = extract(@'RADIUS.Acct-Session-Id=([^;]+)\\;',1, AdditionalExtensions),\n ServiceName = extract(@'RADIUS.Acct-Service-Name=([^;]+)\\;',1, AdditionalExtensions),\n NasPortNumber = extract(@'RADIUS.Acct-NAS-Port=([^;]+)\\;',1, AdditionalExtensions),\n NasPortType = extract(@'RADIUS.Acct-NAS-Port-Type=([^;]+)\\;',1, AdditionalExtensions),\n OutputOctets = extract(@'RADIUS.Acct-Output-Octets=([^;]+)\\;',1, AdditionalExtensions),\n UserName = extract(@'RADIUS.Acct-Username=([^;]+)\\;',1, AdditionalExtensions),\n NasIpAddr = extract(@'RADIUS.Acct-NAS-IP-Address=([^;]+)\\;',1, AdditionalExtensions)\n| project-rename DstServiceName = DestinationServiceName,\n DstUserPriviledges = DestinationUserPrivileges,\n DstUserName = DestinationUserName,\n DstMacAddr = DestinationMACAddress\n| extend Category = iif(isempty(Category), \"Sessions Logs\", Category);\nlet SystemLogs = LogHeader\n| where Activity == \"System Logs\" or Category == \"ClearPass System Events\"\n| extend Description = extract(@'description=([^;]+)\\;',1, AdditionalExtensions),\n Action = extract(@'daction=([^;]+)\\;',1, AdditionalExtensions),\n InputOctets = extract(@'RADIUS.Acct-Input-Octets=([^;]+)\\;',1, AdditionalExtensions),\n TimeFormat = extract(@'devTimeFormat=([^;]+)\\;',1, AdditionalExtensions)\n| extend Category = iif(isempty(Category), \"System Logs\", \"System Logs\");\nunion SessionLogs, InsightLogs, AuditRecords, SystemLogs\n", + "functionParameters": "", + "version": 2, "tags": [ { "name": "description", - "value": "ArubaClearPass" + "value": "" } ] } @@ -464,7 +788,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", "dependsOn": [ - "[variables('_parserName1')]" + "[variables('_parserId1')]" ], "properties": { "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", @@ -488,21 +812,39 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_parserContentId1')]", + "contentKind": "Parser", + "displayName": "ArubaClearPass", + "contentProductId": "[variables('_parsercontentProductId1')]", + "id": "[variables('_parsercontentProductId1')]", + "version": "[variables('parserVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2021-06-01", + "apiVersion": "2022-10-01", "name": "[variables('_parserName1')]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "ArubaClearPass", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "ArubaClearPass", - "query": "\nlet LogHeader =\r\nCommonSecurityLog\r\n| where DeviceVendor == \"Aruba Networks\" and DeviceProduct == \"ClearPass\"\r\n| extend Category = coalesce(\r\n extract(@'cat=([^;]+)(\\;|$)',1, AdditionalExtensions), \r\n column_ifexists(\"DeviceEventCategory\", \"\")\r\n ),\r\n Outcome = coalesce(\r\n extract(@'outcome=([^;]+)\\;',1, AdditionalExtensions), \r\n column_ifexists(\"EventOutcome\", \"\")\r\n )\r\n| project-rename DvcIpAddr = DeviceAddress,\r\n DvcVersion = DeviceVersion,\r\n SrcIpAddr = SourceIP;\r\nlet InsightLogs = LogHeader\r\n| where Activity == \"Insight Logs\" or Category == \"Insight Logs\"\r\n| extend UserName = extract(@'Auth.Username=([^;]+)\\;',1, AdditionalExtensions),\r\n AuthorizationSources = extract(@'Auth.Authorization-Sources=([^;]+)\\;',1, AdditionalExtensions),\r\n NetworkProtocol = extract(@'Auth.Protocol=([^;]+)\\;',1, AdditionalExtensions),\r\n RequestTimestamp = extract(@'Auth.Request-Timestamp=([^;]+)\\;',1, AdditionalExtensions),\r\n LoginStatus = extract(@'Auth.Login-Status=([^;]+)\\;',1, AdditionalExtensions),\r\n Source = extract(@'Auth.Source=([^;]+)\\;',1, AdditionalExtensions),\r\n EnforcementProfiles = extract(@'Auth.Enforcement-Profiles=([^;]+)\\;',1, AdditionalExtensions),\r\n NasPort = extract(@'Auth.NAS-Port=([^;]+)\\;',1, AdditionalExtensions),\r\n TimestampFormat = extract(@'TimestampFormat=([^;]+)\\;',1, AdditionalExtensions),\r\n Ssid = extract(@'Auth.SSID=([^;]+)\\;',1, AdditionalExtensions),\r\n NasPortType = extract(@'Auth.NAS-Port-Type=([^;]+)\\;',1, AdditionalExtensions),\r\n ErrorCode = extract(@'Auth.Error-Code=([^;]+)\\;',1, AdditionalExtensions),\r\n Roles = extract(@'Auth.Roles=([^;]+)\\;',1, AdditionalExtensions),\r\n Service = extract(@'Auth.Service=([^;]+)\\;',1, AdditionalExtensions),\r\n SrcMacAddr = extract(@'Auth.Host-MAC-Address=([^;]+)\\;',1, AdditionalExtensions),\r\n Unhealthy = extract(@'Auth.Unhealthy=([^;]+)\\;',1, AdditionalExtensions),\r\n NasIpAddr = extract(@'Auth.NAS-IP-Address=([^;]+)\\;',1, AdditionalExtensions),\r\n CalledStationId = extract(@'Auth.CalledStationId=([^;]+)\\;',1, AdditionalExtensions),\r\n NasIdentifier = extract(@'Auth.NAS-Identifier=([^;]+)\\;',1, AdditionalExtensions)\r\n| extend EndpointStatus = extract(@'ArubaClearpassEndpointStatus=([^;]+)\\;',1, AdditionalExtensions),\r\n EndpointConflict = extract(@'ArubaClearpassEndpointConflict=([^;]+)\\;',1, AdditionalExtensions),\r\n EndpointDvcCategory = iif(DeviceCustomString3Label == \"Endpoint.Device-Category\", DeviceCustomString3, \"\"),\r\n EndpointDvcFamily = iif(DeviceCustomString4Label == \"Endpoint.Device-Family\", DeviceCustomString4, \"\"),\r\n EndpointDvcName = iif(DeviceCustomString5Label == \"Endpoint.Device-Name\", DeviceCustomString5, \"\"),\r\n EndpointMacVendor = iif(DeviceCustomString6Label == \"Endpoint.MAC-Vendor\", DeviceCustomString6, \"\"), \r\n EndpointAddedDate= iif(DeviceCustomDate1Label == \"Endpoint.Added-At\", todatetime(DeviceCustomDate1), todatetime(\"\"))\r\n| extend Category = iif(isempty(Category), \"Insight Logs\", Category); \r\nlet AuditRecords = LogHeader\r\n| where Activity == \"Audit Records\" or Category == \"Audit Records\"\r\n| extend TimestampFormat = extract(@'timeFormat=([^;]+)\\;',1, AdditionalExtensions),\r\n UserName = extract(@'usrName=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| extend Category = iif(isempty(Category), \"Audit Records\", Category);\r\nlet SessionLogs = LogHeader\r\n| where Activity == \"Session Logs\" or Category == \"Session Logs\"\r\n| extend Timestamp = extract(@'RADIUS.Acct-Timestamp=([^;]+)\\;',1, AdditionalExtensions),\r\n CallingStationId = extract(@'RADIUS.Acct-Calling-Station-Id=([^;]+)\\;',1, AdditionalExtensions),\r\n InputOctets = extract(@'RADIUS.Acct-Input-Octets=([^;]+)\\;',1, AdditionalExtensions),\r\n TimestampFormat = extract(@'TimestampFormat=([^;]+)\\;',1, AdditionalExtensions),\r\n SessionTime = extract(@'RADIUS.Acct-Session-Time=([^;]+)\\;',1, AdditionalExtensions),\r\n FramedIpAddr = extract(@'RADIUS.Acct-Framed-IP-Address=([^;]+)\\;',1, AdditionalExtensions),\r\n Source = extract(@'RADIUS.Auth-Source=([^;]+)\\;',1, AdditionalExtensions),\r\n Method = extract(@'RADIUS.Auth-Method=([^;]+)\\;',1, AdditionalExtensions),\r\n SessionId = extract(@'RADIUS.Acct-Session-Id=([^;]+)\\;',1, AdditionalExtensions),\r\n ServiceName = extract(@'RADIUS.Acct-Service-Name=([^;]+)\\;',1, AdditionalExtensions),\r\n NasPortNumber = extract(@'RADIUS.Acct-NAS-Port=([^;]+)\\;',1, AdditionalExtensions),\r\n NasPortType = extract(@'RADIUS.Acct-NAS-Port-Type=([^;]+)\\;',1, AdditionalExtensions),\r\n OutputOctets = extract(@'RADIUS.Acct-Output-Octets=([^;]+)\\;',1, AdditionalExtensions),\r\n UserName = extract(@'RADIUS.Acct-Username=([^;]+)\\;',1, AdditionalExtensions),\r\n NasIpAddr = extract(@'RADIUS.Acct-NAS-IP-Address=([^;]+)\\;',1, AdditionalExtensions)\r\n| project-rename DstServiceName = DestinationServiceName,\r\n DstUserPriviledges = DestinationUserPrivileges,\r\n DstUserName = DestinationUserName,\r\n DstMacAddr = DestinationMACAddress\r\n| extend Category = iif(isempty(Category), \"Sessions Logs\", Category);\r\nlet SystemLogs = LogHeader\r\n| where Activity == \"System Logs\" or Category == \"ClearPass System Events\"\r\n| extend Description = extract(@'description=([^;]+)\\;',1, AdditionalExtensions),\r\n Action = extract(@'daction=([^;]+)\\;',1, AdditionalExtensions),\r\n InputOctets = extract(@'RADIUS.Acct-Input-Octets=([^;]+)\\;',1, AdditionalExtensions),\r\n TimeFormat = extract(@'devTimeFormat=([^;]+)\\;',1, AdditionalExtensions)\r\n| extend Category = iif(isempty(Category), \"System Logs\", \"System Logs\");\r\nunion SessionLogs, InsightLogs, AuditRecords, SystemLogs", - "version": 1 + "query": "let LogHeader =\nCommonSecurityLog\n| where DeviceVendor == \"Aruba Networks\" and DeviceProduct == \"ClearPass\"\n| extend Category = coalesce(\n extract(@'cat=([^;]+)(\\;|$)',1, AdditionalExtensions), \n column_ifexists(\"DeviceEventCategory\", \"\")\n ),\n Outcome = coalesce(\n extract(@'outcome=([^;]+)\\;',1, AdditionalExtensions), \n column_ifexists(\"EventOutcome\", \"\")\n )\n| project-rename DvcIpAddr = DeviceAddress,\n DvcVersion = DeviceVersion,\n SrcIpAddr = SourceIP;\nlet InsightLogs = LogHeader\n| where Activity == \"Insight Logs\" or Category == \"Insight Logs\"\n// Version 6.5\n| extend UserName = extract(@'Auth.Username=([^;]+)\\;',1, AdditionalExtensions),\n AuthorizationSources = extract(@'Auth.Authorization-Sources=([^;]+)\\;',1, AdditionalExtensions),\n NetworkProtocol = extract(@'Auth.Protocol=([^;]+)\\;',1, AdditionalExtensions),\n RequestTimestamp = extract(@'Auth.Request-Timestamp=([^;]+)\\;',1, AdditionalExtensions),\n LoginStatus = extract(@'Auth.Login-Status=([^;]+)\\;',1, AdditionalExtensions),\n Source = extract(@'Auth.Source=([^;]+)\\;',1, AdditionalExtensions),\n EnforcementProfiles = extract(@'Auth.Enforcement-Profiles=([^;]+)\\;',1, AdditionalExtensions),\n NasPort = extract(@'Auth.NAS-Port=([^;]+)\\;',1, AdditionalExtensions),\n TimestampFormat = extract(@'TimestampFormat=([^;]+)\\;',1, AdditionalExtensions),\n Ssid = extract(@'Auth.SSID=([^;]+)\\;',1, AdditionalExtensions),\n NasPortType = extract(@'Auth.NAS-Port-Type=([^;]+)\\;',1, AdditionalExtensions),\n ErrorCode = extract(@'Auth.Error-Code=([^;]+)\\;',1, AdditionalExtensions),\n Roles = extract(@'Auth.Roles=([^;]+)\\;',1, AdditionalExtensions),\n Service = extract(@'Auth.Service=([^;]+)\\;',1, AdditionalExtensions),\n SrcMacAddr = extract(@'Auth.Host-MAC-Address=([^;]+)\\;',1, AdditionalExtensions),\n Unhealthy = extract(@'Auth.Unhealthy=([^;]+)\\;',1, AdditionalExtensions),\n NasIpAddr = extract(@'Auth.NAS-IP-Address=([^;]+)\\;',1, AdditionalExtensions),\n CalledStationId = extract(@'Auth.CalledStationId=([^;]+)\\;',1, AdditionalExtensions),\n NasIdentifier = extract(@'Auth.NAS-Identifier=([^;]+)\\;',1, AdditionalExtensions)\n// Version 6.6+\n| extend EndpointStatus = extract(@'ArubaClearpassEndpointStatus=([^;]+)\\;',1, AdditionalExtensions),\n EndpointConflict = extract(@'ArubaClearpassEndpointConflict=([^;]+)\\;',1, AdditionalExtensions),\n EndpointDvcCategory = iif(DeviceCustomString3Label == \"Endpoint.Device-Category\", DeviceCustomString3, \"\"),\n EndpointDvcFamily = iif(DeviceCustomString4Label == \"Endpoint.Device-Family\", DeviceCustomString4, \"\"),\n EndpointDvcName = iif(DeviceCustomString5Label == \"Endpoint.Device-Name\", DeviceCustomString5, \"\"),\n EndpointMacVendor = iif(DeviceCustomString6Label == \"Endpoint.MAC-Vendor\", DeviceCustomString6, \"\"), \n EndpointAddedDate= iif(DeviceCustomDate1Label == \"Endpoint.Added-At\", todatetime(DeviceCustomDate1), todatetime(\"\"))\n| extend Category = iif(isempty(Category), \"Insight Logs\", Category); \nlet AuditRecords = LogHeader\n| where Activity == \"Audit Records\" or Category == \"Audit Records\"\n| extend TimestampFormat = extract(@'timeFormat=([^;]+)\\;',1, AdditionalExtensions),\n UserName = extract(@'usrName=([^;]+)(\\;|$)',1, AdditionalExtensions)\n| extend Category = iif(isempty(Category), \"Audit Records\", Category);\nlet SessionLogs = LogHeader\n| where Activity == \"Session Logs\" or Category == \"Session Logs\"\n| extend Timestamp = extract(@'RADIUS.Acct-Timestamp=([^;]+)\\;',1, AdditionalExtensions),\n CallingStationId = extract(@'RADIUS.Acct-Calling-Station-Id=([^;]+)\\;',1, AdditionalExtensions),\n InputOctets = extract(@'RADIUS.Acct-Input-Octets=([^;]+)\\;',1, AdditionalExtensions),\n TimestampFormat = extract(@'TimestampFormat=([^;]+)\\;',1, AdditionalExtensions),\n SessionTime = extract(@'RADIUS.Acct-Session-Time=([^;]+)\\;',1, AdditionalExtensions),\n FramedIpAddr = extract(@'RADIUS.Acct-Framed-IP-Address=([^;]+)\\;',1, AdditionalExtensions),\n Source = extract(@'RADIUS.Auth-Source=([^;]+)\\;',1, AdditionalExtensions),\n Method = extract(@'RADIUS.Auth-Method=([^;]+)\\;',1, AdditionalExtensions),\n SessionId = extract(@'RADIUS.Acct-Session-Id=([^;]+)\\;',1, AdditionalExtensions),\n ServiceName = extract(@'RADIUS.Acct-Service-Name=([^;]+)\\;',1, AdditionalExtensions),\n NasPortNumber = extract(@'RADIUS.Acct-NAS-Port=([^;]+)\\;',1, AdditionalExtensions),\n NasPortType = extract(@'RADIUS.Acct-NAS-Port-Type=([^;]+)\\;',1, AdditionalExtensions),\n OutputOctets = extract(@'RADIUS.Acct-Output-Octets=([^;]+)\\;',1, AdditionalExtensions),\n UserName = extract(@'RADIUS.Acct-Username=([^;]+)\\;',1, AdditionalExtensions),\n NasIpAddr = extract(@'RADIUS.Acct-NAS-IP-Address=([^;]+)\\;',1, AdditionalExtensions)\n| project-rename DstServiceName = DestinationServiceName,\n DstUserPriviledges = DestinationUserPrivileges,\n DstUserName = DestinationUserName,\n DstMacAddr = DestinationMACAddress\n| extend Category = iif(isempty(Category), \"Sessions Logs\", Category);\nlet SystemLogs = LogHeader\n| where Activity == \"System Logs\" or Category == \"ClearPass System Events\"\n| extend Description = extract(@'description=([^;]+)\\;',1, AdditionalExtensions),\n Action = extract(@'daction=([^;]+)\\;',1, AdditionalExtensions),\n InputOctets = extract(@'RADIUS.Acct-Input-Octets=([^;]+)\\;',1, AdditionalExtensions),\n TimeFormat = extract(@'devTimeFormat=([^;]+)\\;',1, AdditionalExtensions)\n| extend Category = iif(isempty(Category), \"System Logs\", \"System Logs\");\nunion SessionLogs, InsightLogs, AuditRecords, SystemLogs\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { @@ -535,13 +877,20 @@ } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.2", + "version": "3.0.1", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "Aruba ClearPass", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Aruba ClearPass solution allows you to easily connect your Aruba ClearPass with Microsoft Sentinel.

\n
    \n

  1. Aruba ClearPass via AMA - This data connector helps in ingesting Aruba ClearPass logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. Aruba ClearPass via Legacy Agent - This data connector helps in ingesting Aruba ClearPass logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends installation of Aruba ClearPass via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { @@ -566,6 +915,11 @@ "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId2')]", + "version": "[variables('dataConnectorVersion2')]" + }, { "kind": "Parser", "contentId": "[variables('_parserContentId1')]", diff --git a/Solutions/Aruba ClearPass/Parsers/ArubaClearPass.txt b/Solutions/Aruba ClearPass/Parsers/ArubaClearPass.txt deleted file mode 100644 index 04530bf446b..00000000000 --- a/Solutions/Aruba ClearPass/Parsers/ArubaClearPass.txt +++ /dev/null @@ -1,104 +0,0 @@ -// Title: Aruba ClearPass Parser -// Author: Microsoft -// Version: 1.1 -// Last Updated: 01/23/2020 -// Comment: Added Supported for Version 6.6+ -// -// DESCRIPTION: -// This parser takes raw Aruba ClearPass logs from a Syslog (CEF) stream and parses the logs into a normalized schema. -// -// -// REFERENCES: -// Using functions in Azure monitor log queries: https://docs.microsoft.com/azure/azure-monitor/log-query/functions -// -// LOG SAMPLES: -// This parser assumes the raw log are formatted as follows: -// -// Dec 03 2017 16:31:28.861 IST 10.17.4.208 CEF:0|Aruba Networks|ClearPass|6.5.0.69058|0-1-0|Insight Logs|0|Auth.Username=host/Asif-Test-PC2 Auth.Authorization-Sources=null Auth.Login-Status=216 Auth.Request-Timestamp=2017-12-03 16:28:20+05:30 Auth.Protocol=RADIUS Auth.Source=null Auth.Enforcement-Profiles=[Allow Access Profile] Auth.NAS-Port=null Auth.SSID=cppm-dot1x-test TimestampFormat=MMM dd yyyy HH:mm:ss.SSS zzz Auth.NAS-Port-Type=19 Auth.Error-Code=216 Auth.Roles=null Auth.Service=Test Wireless Auth.Host-MAC-Address=6817294b0636 Auth.Unhealthy=null Auth.NAS-IP-Address=10.17.4.7 src=10.17.4.208 Auth.CalledStationId=000B8661CD70 Auth.NAS-Identifier=ClearPassLab3600 -// -// Nov 19 2017 18:22:40.700 IST 10.17.4.221 CEF:0|Aruba Networks|ClearPass|6.5.0.68754|13-1-0|Audit Records|5|cat=Role timeFormat=MMM dd yyyy HH:mm:ss.SSS zzz rt=Nov 19, 2014 18:21:13 IST src=Test Role 10 act=ADD usrName=admin -// -// Dec 01 2017 15:28:40.540 IST 10.17.4.206 CEF:0Aruba Networks|ClearPass|6.5.0.68878|1604-1-0|Session Logs|0|RADIUS.Acct-Calling-Station-Id=00:32:b6:2c:28:95 RADIUS.Acct-Framed-IP-Address=192.167.230.129 RADIUS.Auth-Source=AD:10.17.4.130 RADIUS.Acct-Timestamp=2014-12-01 15:26:43+05:30 RADIUS.Auth-Method=PAP RADIUS.Acct-Service-Name=Authenticate-Only RADIUS.Acct-Session-Time=3155 TimestampFormat=MMM dd yyyy HH:mm:ss.SSS zzz RADIUS.Acct-NAS-Port=0 RADIUS.Acct-Session-Id=R00001316-01-547c3b5a RADIUS.Acct-NAS-Port-Type=Wireless-802.11 RADIUS.Acct-Output-Octets=578470212 RADIUS.Acct-Username=A_user2 RADIUS.Acct-NAS-IP-Address=10.17.6.124 RADIUS.Acct-Input-Octets=786315664 -// -// <143>Aug 10 2016 15:18:04 172.20.21.100 CEF:0|Aruba Networks|ClearPass|6.6.1.84176|2006|Guest Access|1|duser=bob dmac=784b877a4155 dpriv=[User Authenticated] cs2=UNKNOWN cs2Label=System Posture Token outcome=[Allow Access Profile] rt=Aug 10 2016 15:16:51 dvc=172.20.21.100 cat=Session Logs -// -let LogHeader = -CommonSecurityLog -| where DeviceVendor == "Aruba Networks" and DeviceProduct == "ClearPass" -| extend Category = coalesce( - extract(@'cat=([^;]+)(\;|$)',1, AdditionalExtensions), - column_ifexists("DeviceEventCategory", "") - ), - Outcome = coalesce( - extract(@'outcome=([^;]+)\;',1, AdditionalExtensions), - column_ifexists("EventOutcome", "") - ) -| project-rename DvcIpAddr = DeviceAddress, - DvcVersion = DeviceVersion, - SrcIpAddr = SourceIP; -let InsightLogs = LogHeader -| where Activity == "Insight Logs" or Category == "Insight Logs" -// Version 6.5 -| extend UserName = extract(@'Auth.Username=([^;]+)\;',1, AdditionalExtensions), - AuthorizationSources = extract(@'Auth.Authorization-Sources=([^;]+)\;',1, AdditionalExtensions), - NetworkProtocol = extract(@'Auth.Protocol=([^;]+)\;',1, AdditionalExtensions), - RequestTimestamp = extract(@'Auth.Request-Timestamp=([^;]+)\;',1, AdditionalExtensions), - LoginStatus = extract(@'Auth.Login-Status=([^;]+)\;',1, AdditionalExtensions), - Source = extract(@'Auth.Source=([^;]+)\;',1, AdditionalExtensions), - EnforcementProfiles = extract(@'Auth.Enforcement-Profiles=([^;]+)\;',1, AdditionalExtensions), - NasPort = extract(@'Auth.NAS-Port=([^;]+)\;',1, AdditionalExtensions), - TimestampFormat = extract(@'TimestampFormat=([^;]+)\;',1, AdditionalExtensions), - Ssid = extract(@'Auth.SSID=([^;]+)\;',1, AdditionalExtensions), - NasPortType = extract(@'Auth.NAS-Port-Type=([^;]+)\;',1, AdditionalExtensions), - ErrorCode = extract(@'Auth.Error-Code=([^;]+)\;',1, AdditionalExtensions), - Roles = extract(@'Auth.Roles=([^;]+)\;',1, AdditionalExtensions), - Service = extract(@'Auth.Service=([^;]+)\;',1, AdditionalExtensions), - SrcMacAddr = extract(@'Auth.Host-MAC-Address=([^;]+)\;',1, AdditionalExtensions), - Unhealthy = extract(@'Auth.Unhealthy=([^;]+)\;',1, AdditionalExtensions), - NasIpAddr = extract(@'Auth.NAS-IP-Address=([^;]+)\;',1, AdditionalExtensions), - CalledStationId = extract(@'Auth.CalledStationId=([^;]+)\;',1, AdditionalExtensions), - NasIdentifier = extract(@'Auth.NAS-Identifier=([^;]+)\;',1, AdditionalExtensions) -// Version 6.6+ -| extend EndpointStatus = extract(@'ArubaClearpassEndpointStatus=([^;]+)\;',1, AdditionalExtensions), - EndpointConflict = extract(@'ArubaClearpassEndpointConflict=([^;]+)\;',1, AdditionalExtensions), - EndpointDvcCategory = iif(DeviceCustomString3Label == "Endpoint.Device-Category", DeviceCustomString3, ""), - EndpointDvcFamily = iif(DeviceCustomString4Label == "Endpoint.Device-Family", DeviceCustomString4, ""), - EndpointDvcName = iif(DeviceCustomString5Label == "Endpoint.Device-Name", DeviceCustomString5, ""), - EndpointMacVendor = iif(DeviceCustomString6Label == "Endpoint.MAC-Vendor", DeviceCustomString6, ""), - EndpointAddedDate= iif(DeviceCustomDate1Label == "Endpoint.Added-At", todatetime(DeviceCustomDate1), todatetime("")) -| extend Category = iif(isempty(Category), "Insight Logs", Category); -let AuditRecords = LogHeader -| where Activity == "Audit Records" or Category == "Audit Records" -| extend TimestampFormat = extract(@'timeFormat=([^;]+)\;',1, AdditionalExtensions), - UserName = extract(@'usrName=([^;]+)(\;|$)',1, AdditionalExtensions) -| extend Category = iif(isempty(Category), "Audit Records", Category); -let SessionLogs = LogHeader -| where Activity == "Session Logs" or Category == "Session Logs" -| extend Timestamp = extract(@'RADIUS.Acct-Timestamp=([^;]+)\;',1, AdditionalExtensions), - CallingStationId = extract(@'RADIUS.Acct-Calling-Station-Id=([^;]+)\;',1, AdditionalExtensions), - InputOctets = extract(@'RADIUS.Acct-Input-Octets=([^;]+)\;',1, AdditionalExtensions), - TimestampFormat = extract(@'TimestampFormat=([^;]+)\;',1, AdditionalExtensions), - SessionTime = extract(@'RADIUS.Acct-Session-Time=([^;]+)\;',1, AdditionalExtensions), - FramedIpAddr = extract(@'RADIUS.Acct-Framed-IP-Address=([^;]+)\;',1, AdditionalExtensions), - Source = extract(@'RADIUS.Auth-Source=([^;]+)\;',1, AdditionalExtensions), - Method = extract(@'RADIUS.Auth-Method=([^;]+)\;',1, AdditionalExtensions), - SessionId = extract(@'RADIUS.Acct-Session-Id=([^;]+)\;',1, AdditionalExtensions), - ServiceName = extract(@'RADIUS.Acct-Service-Name=([^;]+)\;',1, AdditionalExtensions), - NasPortNumber = extract(@'RADIUS.Acct-NAS-Port=([^;]+)\;',1, AdditionalExtensions), - NasPortType = extract(@'RADIUS.Acct-NAS-Port-Type=([^;]+)\;',1, AdditionalExtensions), - OutputOctets = extract(@'RADIUS.Acct-Output-Octets=([^;]+)\;',1, AdditionalExtensions), - UserName = extract(@'RADIUS.Acct-Username=([^;]+)\;',1, AdditionalExtensions), - NasIpAddr = extract(@'RADIUS.Acct-NAS-IP-Address=([^;]+)\;',1, AdditionalExtensions) -| project-rename DstServiceName = DestinationServiceName, - DstUserPriviledges = DestinationUserPrivileges, - DstUserName = DestinationUserName, - DstMacAddr = DestinationMACAddress -| extend Category = iif(isempty(Category), "Sessions Logs", Category); -let SystemLogs = LogHeader -| where Activity == "System Logs" or Category == "ClearPass System Events" -| extend Description = extract(@'description=([^;]+)\;',1, AdditionalExtensions), - Action = extract(@'daction=([^;]+)\;',1, AdditionalExtensions), - InputOctets = extract(@'RADIUS.Acct-Input-Octets=([^;]+)\;',1, AdditionalExtensions), - TimeFormat = extract(@'devTimeFormat=([^;]+)\;',1, AdditionalExtensions) -| extend Category = iif(isempty(Category), "System Logs", "System Logs"); -union SessionLogs, InsightLogs, AuditRecords, SystemLogs \ No newline at end of file diff --git a/Solutions/Aruba ClearPass/ReleaseNotes.md b/Solutions/Aruba ClearPass/ReleaseNotes.md new file mode 100644 index 00000000000..ebe1ea7cfaa --- /dev/null +++ b/Solutions/Aruba ClearPass/ReleaseNotes.md @@ -0,0 +1,5 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------| +| 3.0.0 | 21-09-2023 | Addition of new Aruba ClearPass AMA **Data Connector** | | + + diff --git a/Solutions/Azure Active Directory/Analytic Rules/NRT_AuthenticationMethodsChangedforVIPUsers.yaml b/Solutions/Azure Active Directory/Analytic Rules/NRT_AuthenticationMethodsChangedforVIPUsers.yaml index d6fb35b5517..1dc8dc1eb4c 100644 --- a/Solutions/Azure Active Directory/Analytic Rules/NRT_AuthenticationMethodsChangedforVIPUsers.yaml +++ b/Solutions/Azure Active Directory/Analytic Rules/NRT_AuthenticationMethodsChangedforVIPUsers.yaml @@ -15,7 +15,7 @@ tags: - AADSecOpsGuide query: | let security_info_actions = dynamic(["User registered security info", "User changed default security info", "User deleted security info", "Admin updated security info", "User reviewed security info", "Admin deleted security info", "Admin registered security info"]); - let VIPUsers = (_GetWatchlist('VIPUsers') | distinct ["User Principal Name"]); + let VIPUsers = (_GetWatchlist('VIPUsers') | distinct "User Principal Name"); AuditLogs | where Category =~ "UserManagement" | where ActivityDisplayName in (security_info_actions) @@ -40,5 +40,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IP -version: 1.0.1 +version: 1.0.2 kind: NRT diff --git a/Solutions/Azure Active Directory/Analytic Rules/PIMElevationRequestRejected.yaml b/Solutions/Azure Active Directory/Analytic Rules/PIMElevationRequestRejected.yaml index b76ed73cfce..80483912104 100644 --- a/Solutions/Azure Active Directory/Analytic Rules/PIMElevationRequestRejected.yaml +++ b/Solutions/Azure Active Directory/Analytic Rules/PIMElevationRequestRejected.yaml @@ -21,8 +21,7 @@ tags: - AADSecOpsGuide query: | AuditLogs - | where ActivityDisplayName =~'Add member to role completed (PIM activation)' - | where Result =~ "failure" + | where (ActivityDisplayName =~'Add member to role completed (PIM activation)' and Result =~ "failure") or ActivityDisplayName =~'Add member to role request denied (PIM activation)' | mv-apply ResourceItem = TargetResources on ( where ResourceItem.type =~ "Role" @@ -55,5 +54,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: InitiatingIpAddress -version: 1.0.5 +version: 1.0.6 kind: Scheduled diff --git a/Solutions/Azure Active Directory/Data/Solution_AAD.json b/Solutions/Azure Active Directory/Data/Solution_AAD.json index f4f35a9a0ca..5e70ac37944 100644 --- a/Solutions/Azure Active Directory/Data/Solution_AAD.json +++ b/Solutions/Azure Active Directory/Data/Solution_AAD.json @@ -85,7 +85,7 @@ "Solutions/Azure Active Directory/Playbooks/Revoke-AADSignInSessions/entity-trigger/azuredeploy.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel", - "Version": "3.0.2", + "Version": "3.0.3", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": true diff --git a/Solutions/Azure Active Directory/Data/system_generated_metadata.json b/Solutions/Azure Active Directory/Data/system_generated_metadata.json new file mode 100644 index 00000000000..74556428f5b --- /dev/null +++ b/Solutions/Azure Active Directory/Data/system_generated_metadata.json @@ -0,0 +1,45 @@ +{ + "Name": "Azure Active Directory", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "The [ Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) solution for Microsoft Sentinel enables you to ingest Azure Active Directory [Audit](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-audit-logs), [Sign-in](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-sign-ins), [Provisioning](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-provisioning-logs), [Risk Events and Risky User/Service Principal](https://docs.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#risky-users) logs using Diagnostic Settings into Microsoft Sentinel.", + "BasePath": "C:\\GitHub\\Azure-Sentinel", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": true, + "Version": "3.0.3", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-azureactivedirectory", + "providers": [ + "Microsoft" + ], + "categories": { + "domains": [ + "Identity", + "Security - Automation (SOAR)" + ] + }, + "firstPublishDate": "2022-05-16", + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + }, + "Data Connectors": "[\n \"template_AzureActiveDirectory.json\"\n]", + "Playbooks": [ + "Playbooks/Block-AADUser/alert-trigger/azuredeploy.json", + "Playbooks/Block-AADUser/entity-trigger/azuredeploy.json", + "Playbooks/Block-AADUser/incident-trigger/azuredeploy.json", + "Playbooks/Prompt-User/alert-trigger/azuredeploy.json", + "Playbooks/Prompt-User/incident-trigger/azuredeploy.json", + "Playbooks/Reset-AADUserPassword/alert-trigger/azuredeploy.json", + "Playbooks/Reset-AADUserPassword/entity-trigger/azuredeploy.json", + "Playbooks/Reset-AADUserPassword/incident-trigger/azuredeploy.json", + "Playbooks/Revoke-AADSignInSessions/alert-trigger/azuredeploy.json", + "Playbooks/Revoke-AADSignInSessions/entity-trigger/azuredeploy.json", + "Playbooks/Revoke-AADSignInSessions/incident-trigger/azuredeploy.json" + ], + "Workbooks": "[\n \"AzureActiveDirectoryAuditLogs.json\",\n \"AzureActiveDirectorySignins.json\"\n]", + "Analytic Rules": "[\n \"AccountCreatedandDeletedinShortTimeframe.yaml\",\n \"AccountCreatedDeletedByNonApprovedUser.yaml\",\n \"ADFSDomainTrustMods.yaml\",\n \"ADFSSignInLogsPasswordSpray.yaml\",\n \"AdminPromoAfterRoleMgmtAppPermissionGrant.yaml\",\n \"AnomalousUserAppSigninLocationIncrease-detection.yaml\",\n \"AuthenticationMethodsChangedforPrivilegedAccount.yaml\",\n \"AzureAADPowerShellAnomaly.yaml\",\n \"AzureADRoleManagementPermissionGrant.yaml\",\n \"AzurePortalSigninfromanotherAzureTenant.yaml\",\n \"Brute Force Attack against GitHub Account.yaml\",\n \"BruteForceCloudPC.yaml\",\n \"BulkChangestoPrivilegedAccountPermissions.yaml\",\n \"BypassCondAccessRule.yaml\",\n \"CredentialAddedAfterAdminConsent.yaml\",\n \"Cross-tenantAccessSettingsOrganizationAdded.yaml\",\n \"Cross-tenantAccessSettingsOrganizationDeleted.yaml\",\n \"Cross-tenantAccessSettingsOrganizationInboundCollaborationSettingsChanged.yaml\",\n \"Cross-tenantAccessSettingsOrganizationInboundDirectSettingsChanged.yaml\",\n \"Cross-tenantAccessSettingsOrganizationOutboundCollaborationSettingsChanged.yaml\",\n \"Cross-tenantAccessSettingsOrganizationOutboundDirectSettingsChanged.yaml\",\n \"DisabledAccountSigninsAcrossManyApplications.yaml\",\n \"DistribPassCrackAttempt.yaml\",\n \"ExplicitMFADeny.yaml\",\n \"ExchangeFullAccessGrantedToApp.yaml\",\n \"FailedLogonToAzurePortal.yaml\",\n \"FirstAppOrServicePrincipalCredential.yaml\",\n \"GuestAccountsAddedinAADGroupsOtherThanTheOnesSpecified.yaml\",\n \"MailPermissionsAddedToApplication.yaml\",\n \"MaliciousOAuthApp_O365AttackToolkit.yaml\",\n \"MaliciousOAuthApp_PwnAuth.yaml\",\n \"MFARejectedbyUser.yaml\",\n \"MultipleAdmin_membership_removals_from_NewAdmin.yaml\",\n \"NewAppOrServicePrincipalCredential.yaml\",\n \"NRT_ADFSDomainTrustMods.yaml\",\n \"NRT_AuthenticationMethodsChangedforVIPUsers.yaml\",\n \"nrt_FirstAppOrServicePrincipalCredential.yaml\",\n \"NRT_NewAppOrServicePrincipalCredential.yaml\",\n \"NRT_PIMElevationRequestRejected.yaml\",\n \"NRT_PrivlegedRoleAssignedOutsidePIM.yaml\",\n \"NRT_UseraddedtoPrivilgedGroups.yaml\",\n \"PIMElevationRequestRejected.yaml\",\n \"PrivilegedAccountsSigninFailureSpikes.yaml\",\n \"PrivlegedRoleAssignedOutsidePIM.yaml\",\n \"RareApplicationConsent.yaml\",\n \"SeamlessSSOPasswordSpray.yaml\",\n \"Sign-in Burst from Multiple Locations.yaml\",\n \"SigninAttemptsByIPviaDisabledAccounts.yaml\",\n \"SigninBruteForce-AzurePortal.yaml\",\n \"SigninPasswordSpray.yaml\",\n \"SuccessThenFail_DiffIP_SameUserandApp.yaml\",\n \"SuspiciousAADJoinedDeviceUpdate.yaml\",\n \"SuspiciousOAuthApp_OfflineAccess.yaml\",\n \"SuspiciousServicePrincipalcreationactivity.yaml\",\n \"UnusualGuestActivity.yaml\",\n \"UserAccounts-CABlockedSigninSpikes.yaml\",\n \"UseraddedtoPrivilgedGroups.yaml\",\n \"UserAssignedPrivilegedRole.yaml\",\n \"NewOnmicrosoftDomainAdded.yaml\"\n]" +} diff --git a/Solutions/Azure Active Directory/Package/3.0.3.zip b/Solutions/Azure Active Directory/Package/3.0.3.zip new file mode 100644 index 00000000000..7a61443d3de Binary files /dev/null and b/Solutions/Azure Active Directory/Package/3.0.3.zip differ diff --git a/Solutions/Azure Active Directory/Package/createUiDefinition.json b/Solutions/Azure Active Directory/Package/createUiDefinition.json index ef08ad1cf97..2530be72fb7 100644 --- a/Solutions/Azure Active Directory/Package/createUiDefinition.json +++ b/Solutions/Azure Active Directory/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Active%20Directory/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [ Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) solution for Microsoft Sentinel enables you to ingest Azure Active Directory [Audit](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-audit-logs), [Sign-in](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-sign-ins), [Provisioning](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-provisioning-logs), [Risk Events and Risky User/Service Principal](https://docs.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#risky-users) logs using Diagnostic Settings into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 2, **Analytic Rules:** 59, **Playbooks:** 11\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [ Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) solution for Microsoft Sentinel enables you to ingest Azure Active Directory [Audit](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-audit-logs), [Sign-in](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-sign-ins), [Provisioning](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-provisioning-logs), [Risk Events and Risky User/Service Principal](https://docs.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#risky-users) logs using Diagnostic Settings into Microsoft Sentinel.\n\n**Workbooks:** 2, **Analytic Rules:** 59, **Playbooks:** 11\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -104,19 +104,13 @@ { "name": "workbook1", "type": "Microsoft.Common.Section", - "label": [ - "Azure AD Audit logs", - "Azure AD Audit logs" - ], + "label": "Azure AD Audit logs", "elements": [ { "name": "workbook1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": [ - "Gain insights into Azure Active Directory by connecting Microsoft Sentinel and using the audit logs to gather insights around Azure AD scenarios. \nYou can learn about user operations, including password and group management, device activities, and top active users and apps.", - "Gain insights into Azure Active Directory by connecting Microsoft Sentinel and using the audit logs to gather insights around Azure AD scenarios. \nYou can learn about user operations, including password and group management, device activities, and top active users and apps." - ] + "text": "Gain insights into Azure Active Directory by connecting Microsoft Sentinel and using the audit logs to gather insights around Azure AD scenarios. \nYou can learn about user operations, including password and group management, device activities, and top active users and apps." } } ] @@ -124,19 +118,13 @@ { "name": "workbook2", "type": "Microsoft.Common.Section", - "label": [ - "Azure AD Sign-in logs", - "Azure AD Sign-in logs" - ], + "label": "Azure AD Sign-in logs", "elements": [ { "name": "workbook2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": [ - "Gain insights into Azure Active Directory by connecting Microsoft Sentinel and using the sign-in logs to gather insights around Azure AD scenarios. \nYou can learn about sign-in operations, such as user sign-ins and locations, email addresses, and IP addresses of your users, as well as failed activities and the errors that triggered the failures.", - "Gain insights into Azure Active Directory by connecting Microsoft Sentinel and using the sign-in logs to gather insights around Azure AD scenarios. \nYou can learn about sign-in operations, such as user sign-ins and locations, email addresses, and IP addresses of your users, as well as failed activities and the errors that triggered the failures." - ] + "text": "Gain insights into Azure Active Directory by connecting Microsoft Sentinel and using the sign-in logs to gather insights around Azure AD scenarios. \nYou can learn about sign-in operations, such as user sign-ins and locations, email addresses, and IP addresses of your users, as well as failed activities and the errors that triggered the failures." } } ] @@ -878,7 +866,7 @@ "name": "analytic51-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Identifies when a user account successfully logs onto an Azure App from one IP and within 10 mins failed to logon to the same App via a different IP.\nThis may indicate a malicious attempt at password guessing based on knowledge of the users account. This query has also been updated to include UEBA \nlogs IdentityInfo and BehaviorAnalytics for contextual information around the results." + "text": "Identifies when a user account successfully logs onto an Azure App from one IP and within 10 mins failed to logon to the same App via a different IP (may indicate a malicious attempt at password guessing with known account). UEBA added for context." } } ] diff --git a/Solutions/Azure Active Directory/Package/mainTemplate.json b/Solutions/Azure Active Directory/Package/mainTemplate.json index 364f880ca1f..67f37493196 100644 --- a/Solutions/Azure Active Directory/Package/mainTemplate.json +++ b/Solutions/Azure Active Directory/Package/mainTemplate.json @@ -49,7 +49,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Azure Active Directory", - "_solutionVersion": "3.0.2", + "_solutionVersion": "3.0.3", "solutionId": "azuresentinel.azure-sentinel-solution-azureactivedirectory", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "AzureActiveDirectory", @@ -284,7 +284,7 @@ "analyticRuleId35": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId35'))]", "analyticRuleTemplateSpecName35": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId35'))))]", "_analyticRulecontentProductId35": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId35'),'-', variables('analyticRuleVersion35'))))]", - "analyticRuleVersion36": "1.0.1", + "analyticRuleVersion36": "1.0.2", "analyticRulecontentId36": "29e99017-e28d-47be-8b9a-c8c711f8a903", "_analyticRulecontentId36": "[variables('analyticRulecontentId36')]", "analyticRuleId36": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId36'))]", @@ -296,7 +296,7 @@ "analyticRuleId37": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId37'))]", "analyticRuleTemplateSpecName37": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId37'))))]", "_analyticRulecontentProductId37": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId37'),'-', variables('analyticRuleVersion37'))))]", - "analyticRuleVersion38": "1.0.1", + "analyticRuleVersion38": "1.0.2", "analyticRulecontentId38": "e42e889a-caaf-4dbb-aec6-371b37d64298", "_analyticRulecontentId38": "[variables('analyticRulecontentId38')]", "analyticRuleId38": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId38'))]", @@ -320,7 +320,7 @@ "analyticRuleId41": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId41'))]", "analyticRuleTemplateSpecName41": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId41'))))]", "_analyticRulecontentProductId41": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId41'),'-', variables('analyticRuleVersion41'))))]", - "analyticRuleVersion42": "1.0.5", + "analyticRuleVersion42": "1.0.6", "analyticRulecontentId42": "7d7e20f8-3384-4b71-811c-f5e950e8306c", "_analyticRulecontentId42": "[variables('analyticRulecontentId42')]", "analyticRuleId42": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId42'))]", @@ -356,7 +356,7 @@ "analyticRuleId47": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId47'))]", "analyticRuleTemplateSpecName47": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId47'))))]", "_analyticRulecontentProductId47": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId47'),'-', variables('analyticRuleVersion47'))))]", - "analyticRuleVersion48": "2.1.2", + "analyticRuleVersion48": "2.1.3", "analyticRulecontentId48": "500c103a-0319-4d56-8e99-3cec8d860757", "_analyticRulecontentId48": "[variables('analyticRulecontentId48')]", "analyticRuleId48": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId48'))]", @@ -374,7 +374,7 @@ "analyticRuleId50": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId50'))]", "analyticRuleTemplateSpecName50": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId50'))))]", "_analyticRulecontentProductId50": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId50'),'-', variables('analyticRuleVersion50'))))]", - "analyticRuleVersion51": "2.1.3", + "analyticRuleVersion51": "2.1.6", "analyticRulecontentId51": "02ef8d7e-fc3a-4d86-a457-650fa571d8d2", "_analyticRulecontentId51": "[variables('analyticRulecontentId51')]", "analyticRuleId51": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId51'))]", @@ -416,7 +416,7 @@ "analyticRuleId57": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId57'))]", "analyticRuleTemplateSpecName57": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId57'))))]", "_analyticRulecontentProductId57": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId57'),'-', variables('analyticRuleVersion57'))))]", - "analyticRuleVersion58": "1.0.5", + "analyticRuleVersion58": "1.0.6", "analyticRulecontentId58": "050b9b3d-53d0-4364-a3da-1b678b8211ec", "_analyticRulecontentId58": "[variables('analyticRulecontentId58')]", "analyticRuleId58": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId58'))]", @@ -529,7 +529,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Azure Active Directory data connector with template version 3.0.2", + "description": "Azure Active Directory data connector with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -908,7 +908,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AzureActiveDirectoryAuditLogsWorkbook Workbook with template version 3.0.2", + "description": "AzureActiveDirectoryAuditLogsWorkbook Workbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -996,7 +996,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AzureActiveDirectorySigninsWorkbook Workbook with template version 3.0.2", + "description": "AzureActiveDirectorySigninsWorkbook Workbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -1084,7 +1084,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AccountCreatedandDeletedinShortTimeframe_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AccountCreatedandDeletedinShortTimeframe_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion1')]", @@ -1201,7 +1201,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AccountCreatedDeletedByNonApprovedUser_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AccountCreatedDeletedByNonApprovedUser_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion2')]", @@ -1318,7 +1318,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ADFSDomainTrustMods_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ADFSDomainTrustMods_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion3')]", @@ -1432,7 +1432,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ADFSSignInLogsPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ADFSSignInLogsPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion4')]", @@ -1536,7 +1536,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AdminPromoAfterRoleMgmtAppPermissionGrant_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AdminPromoAfterRoleMgmtAppPermissionGrant_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion5')]", @@ -1655,7 +1655,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AnomalousUserAppSigninLocationIncrease-detection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AnomalousUserAppSigninLocationIncrease-detection_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion6')]", @@ -1783,7 +1783,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AuthenticationMethodsChangedforPrivilegedAccount_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AuthenticationMethodsChangedforPrivilegedAccount_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion7')]", @@ -1913,7 +1913,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AzureAADPowerShellAnomaly_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AzureAADPowerShellAnomaly_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion8')]", @@ -2040,7 +2040,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AzureADRoleManagementPermissionGrant_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AzureADRoleManagementPermissionGrant_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion9')]", @@ -2159,7 +2159,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AzurePortalSigninfromanotherAzureTenant_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AzurePortalSigninfromanotherAzureTenant_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion10')]", @@ -2284,7 +2284,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Brute Force Attack against GitHub Account_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "Brute Force Attack against GitHub Account_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion11')]", @@ -2398,7 +2398,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BruteForceCloudPC_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "BruteForceCloudPC_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion12')]", @@ -2515,7 +2515,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BulkChangestoPrivilegedAccountPermissions_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "BulkChangestoPrivilegedAccountPermissions_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion13')]", @@ -2640,7 +2640,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BypassCondAccessRule_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "BypassCondAccessRule_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion14')]", @@ -2765,7 +2765,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CredentialAddedAfterAdminConsent_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "CredentialAddedAfterAdminConsent_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion15')]", @@ -2879,7 +2879,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cross-tenantAccessSettingsOrganizationAdded_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "Cross-tenantAccessSettingsOrganizationAdded_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion16')]", @@ -3000,7 +3000,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cross-tenantAccessSettingsOrganizationDeleted_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "Cross-tenantAccessSettingsOrganizationDeleted_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion17')]", @@ -3121,7 +3121,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cross-tenantAccessSettingsOrganizationInboundCollaborationSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "Cross-tenantAccessSettingsOrganizationInboundCollaborationSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion18')]", @@ -3242,7 +3242,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cross-tenantAccessSettingsOrganizationInboundDirectSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "Cross-tenantAccessSettingsOrganizationInboundDirectSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion19')]", @@ -3363,7 +3363,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cross-tenantAccessSettingsOrganizationOutboundCollaborationSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "Cross-tenantAccessSettingsOrganizationOutboundCollaborationSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion20')]", @@ -3484,7 +3484,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cross-tenantAccessSettingsOrganizationOutboundDirectSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "Cross-tenantAccessSettingsOrganizationOutboundDirectSettingsChanged_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion21')]", @@ -3605,7 +3605,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DisabledAccountSigninsAcrossManyApplications_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "DisabledAccountSigninsAcrossManyApplications_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion22')]", @@ -3728,7 +3728,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DistribPassCrackAttempt_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "DistribPassCrackAttempt_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion23')]", @@ -3851,7 +3851,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExplicitMFADeny_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ExplicitMFADeny_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion24')]", @@ -3983,7 +3983,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExchangeFullAccessGrantedToApp_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ExchangeFullAccessGrantedToApp_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion25')]", @@ -4048,9 +4048,9 @@ } ], "customDetails": { - "OAuthAppId": "AppId", + "OAuthApplication": "OAuthAppName", "UserAgent": "GrantUserAgent", - "OAuthApplication": "OAuthAppName" + "OAuthAppId": "AppId" }, "alertDetailsOverride": { "alertDescriptionFormat": "This detection looks for the full_access_as_app permission being granted to an OAuth application with Admin Consent.\nThis permission provide access to all Exchange mailboxes via the EWS API can could be exploited to access sensitive data \nby being added to a compromised application. The application granted this permission should be reviewed to ensure that it \nis absolutely necessary for the applications function.\nIn this case {{GrantInitiatedBy}} granted full_access_as_app to {{OAuthAppName}} from {{GrantIpAddress}}\nRef: https://learn.microsoft.com/graph/auth-limit-mailbox-access\n", @@ -4109,7 +4109,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FailedLogonToAzurePortal_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "FailedLogonToAzurePortal_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion26')]", @@ -4232,7 +4232,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FirstAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "FirstAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion27')]", @@ -4358,7 +4358,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GuestAccountsAddedinAADGroupsOtherThanTheOnesSpecified_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "GuestAccountsAddedinAADGroupsOtherThanTheOnesSpecified_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion28')]", @@ -4488,7 +4488,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MailPermissionsAddedToApplication_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "MailPermissionsAddedToApplication_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion29')]", @@ -4605,7 +4605,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MaliciousOAuthApp_O365AttackToolkit_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "MaliciousOAuthApp_O365AttackToolkit_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion30')]", @@ -4733,7 +4733,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MaliciousOAuthApp_PwnAuth_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "MaliciousOAuthApp_PwnAuth_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion31')]", @@ -4852,7 +4852,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MFARejectedbyUser_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "MFARejectedbyUser_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion32')]", @@ -4985,7 +4985,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MultipleAdmin_membership_removals_from_NewAdmin_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "MultipleAdmin_membership_removals_from_NewAdmin_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion33')]", @@ -5093,7 +5093,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NewAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "NewAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion34')]", @@ -5210,7 +5210,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_ADFSDomainTrustMods_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "NRT_ADFSDomainTrustMods_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion35')]", @@ -5320,7 +5320,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_AuthenticationMethodsChangedforVIPUsers_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "NRT_AuthenticationMethodsChangedforVIPUsers_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion36')]", @@ -5337,7 +5337,7 @@ "description": "Identifies authentication methods being changed for a list of VIP users watchlist. This could be an indication of an attacker adding an auth method to the account so they can have continued access.", "displayName": "NRT Authentication Methods Changed for VIP Users", "enabled": false, - "query": "let security_info_actions = dynamic([\"User registered security info\", \"User changed default security info\", \"User deleted security info\", \"Admin updated security info\", \"User reviewed security info\", \"Admin deleted security info\", \"Admin registered security info\"]);\nlet VIPUsers = (_GetWatchlist('VIPUsers') | distinct [\"User Principal Name\"]);\nAuditLogs\n| where Category =~ \"UserManagement\"\n| where ActivityDisplayName in (security_info_actions)\n| extend Initiator = tostring(InitiatedBy.user.userPrincipalName)\n| extend IP = tostring(InitiatedBy.user.ipAddress)\n| mv-apply TargetResource = TargetResources on \n (\n where TargetResource.type =~ \"User\"\n | extend Target = trim(@'\"',tolower(tostring(TargetResource.userPrincipalName)))\n )\n| where Target in~ (VIPUsers)\n| summarize Start=min(TimeGenerated), End=max(TimeGenerated), Actions = make_set(ResultReason) by Initiator, IP, Result, Target\n| extend Name = tostring(split(Target,'@',0)[0]), UPNSuffix = tostring(split(Target,'@',1)[0])\n", + "query": "let security_info_actions = dynamic([\"User registered security info\", \"User changed default security info\", \"User deleted security info\", \"Admin updated security info\", \"User reviewed security info\", \"Admin deleted security info\", \"Admin registered security info\"]);\nlet VIPUsers = (_GetWatchlist('VIPUsers') | distinct \"User Principal Name\");\nAuditLogs\n| where Category =~ \"UserManagement\"\n| where ActivityDisplayName in (security_info_actions)\n| extend Initiator = tostring(InitiatedBy.user.userPrincipalName)\n| extend IP = tostring(InitiatedBy.user.ipAddress)\n| mv-apply TargetResource = TargetResources on \n (\n where TargetResource.type =~ \"User\"\n | extend Target = trim(@'\"',tolower(tostring(TargetResource.userPrincipalName)))\n )\n| where Target in~ (VIPUsers)\n| summarize Start=min(TimeGenerated), End=max(TimeGenerated), Actions = make_set(ResultReason) by Initiator, IP, Result, Target\n| extend Name = tostring(split(Target,'@',0)[0]), UPNSuffix = tostring(split(Target,'@',1)[0])\n", "severity": "Medium", "suppressionDuration": "PT1H", "suppressionEnabled": false, @@ -5433,7 +5433,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "nrt_FirstAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "nrt_FirstAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion37')]", @@ -5546,7 +5546,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_NewAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "NRT_NewAppOrServicePrincipalCredential_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion38')]", @@ -5563,7 +5563,7 @@ "description": "This will alert when an admin or app owner account adds a new credential to an Application or Service Principal where a verify KeyCredential was already present for the app.\nIf a threat actor obtains access to an account with sufficient privileges and adds the alternate authentication material triggering this event, the threat actor can now authenticate as the Application or Service Principal using this credential.\nAdditional information on OAuth Credential Grants can be found in RFC 6749 Section 4.4 or https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow\nFor further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.", "displayName": "NRT New access credential added to Application or Service Principal", "enabled": false, - "query": "AuditLogs\n| where OperationName has_any (\"Add service principal\", \"Certificates and secrets management\") // captures \"Add service principal\", \"Add service principal credentials\", and \"Update application - Certificates and secrets management\" events\n| where Result =~ \"success\"\n| where tostring(InitiatedBy.user.userPrincipalName) has \"@\" or tostring(InitiatedBy.app.displayName) has \"@\"\n| mv-apply TargetResource = TargetResources on \n (\n where TargetResource.type =~ \"Application\"\n | extend targetDisplayName = tostring(TargetResource.displayName),\n targetId = tostring(TargetResource.id),\n targetType = tostring(TargetResource.type),\n keyEvents = TargetResource.modifiedProperties\n )\n| mv-apply Property = keyEvents on \n (\n where Property.displayName =~ \"KeyDescription\"\n | extend new_value_set = parse_json(tostring(Property.newValue)),\n old_value_set = parse_json(tostring(Property.oldValue))\n )\n| where old_value_set != \"[]\"\n| extend diff = set_difference(new_value_set, old_value_set)\n| where isnotempty(diff)\n| parse diff with * \"KeyIdentifier=\" keyIdentifier:string \",KeyType=\" keyType:string \",KeyUsage=\" keyUsage:string \",DisplayName=\" keyDisplayName:string \"]\" *\n| where keyUsage =~ \"Verify\"\n| mv-apply AdditionalDetail = AdditionalDetails on \n (\n where AdditionalDetail.key =~ \"User-Agent\"\n | extend UserAgent = tostring(AdditionalDetail.value)\n )\n| extend InitiatingUserOrApp = iff(isnotempty(InitiatedBy.user.userPrincipalName),tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))\n| extend InitiatingIpAddress = iff(isnotempty(InitiatedBy.user.ipAddress), tostring(InitiatedBy.user.ipAddress), tostring(InitiatedBy.app.ipAddress))\n// The below line is currently commented out but Microsoft Sentinel users can modify this query to show only Application or only Service Principal events in their environment\n//| where targetType =~ \"Application\" // or targetType =~ \"ServicePrincipal\"\n| project-away diff, new_value_set, old_value_set\n| project-reorder TimeGenerated, OperationName, InitiatingUserOrApp, InitiatingIpAddress, UserAgent, targetDisplayName, targetId, targetType, keyDisplayName, keyType, keyUsage, keyIdentifier, CorrelationId, TenantId\n| extend timestamp = TimeGenerated, Name = tostring(split(InitiatingUserOrApp,'@',0)[0]), UPNSuffix = tostring(split(InitiatingUserOrApp,'@',1)[0])\n", + "query": "AuditLogs\n| where OperationName has_any (\"Add service principal\", \"Certificates and secrets management\") // captures \"Add service principal\", \"Add service principal credentials\", and \"Update application - Certificates and secrets management\" events\n| where Result =~ \"success\"\n| where tostring(InitiatedBy.user.userPrincipalName) has \"@\" or tostring(InitiatedBy.app.displayName) has \"@\"\n| mv-apply TargetResource = TargetResources on \n (\n where TargetResource.type =~ \"Application\"\n | extend targetDisplayName = tostring(TargetResource.displayName),\n targetId = tostring(TargetResource.id),\n targetType = tostring(TargetResource.type),\n keyEvents = TargetResource.modifiedProperties\n )\n| mv-apply Property = keyEvents on \n (\n where Property.displayName =~ \"KeyDescription\"\n | extend new_value_set = parse_json(tostring(Property.newValue)),\n old_value_set = parse_json(tostring(Property.oldValue))\n )\n| where old_value_set != \"[]\"\n| extend diff = set_difference(new_value_set, old_value_set)\n| where diff != \"[]\"\n| parse diff with * \"KeyIdentifier=\" keyIdentifier:string \",KeyType=\" keyType:string \",KeyUsage=\" keyUsage:string \",DisplayName=\" keyDisplayName:string \"]\" *\n| where keyUsage =~ \"Verify\"\n| mv-apply AdditionalDetail = AdditionalDetails on \n (\n where AdditionalDetail.key =~ \"User-Agent\"\n | extend UserAgent = tostring(AdditionalDetail.value)\n )\n| extend InitiatingUserOrApp = iff(isnotempty(InitiatedBy.user.userPrincipalName),tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))\n| extend InitiatingIpAddress = iff(isnotempty(InitiatedBy.user.ipAddress), tostring(InitiatedBy.user.ipAddress), tostring(InitiatedBy.app.ipAddress))\n// The below line is currently commented out but Microsoft Sentinel users can modify this query to show only Application or only Service Principal events in their environment\n//| where targetType =~ \"Application\" // or targetType =~ \"ServicePrincipal\"\n| project-away diff, new_value_set, old_value_set\n| project-reorder TimeGenerated, OperationName, InitiatingUserOrApp, InitiatingIpAddress, UserAgent, targetDisplayName, targetId, targetType, keyDisplayName, keyType, keyUsage, keyIdentifier, CorrelationId, TenantId\n| extend timestamp = TimeGenerated, Name = tostring(split(InitiatingUserOrApp,'@',0)[0]), UPNSuffix = tostring(split(InitiatingUserOrApp,'@',1)[0])\n", "severity": "Medium", "suppressionDuration": "PT1H", "suppressionEnabled": false, @@ -5659,7 +5659,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_PIMElevationRequestRejected_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "NRT_PIMElevationRequestRejected_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion39')]", @@ -5785,7 +5785,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_PrivlegedRoleAssignedOutsidePIM_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "NRT_PrivlegedRoleAssignedOutsidePIM_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion40')]", @@ -5898,7 +5898,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_UseraddedtoPrivilgedGroups_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "NRT_UseraddedtoPrivilgedGroups_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion41')]", @@ -6017,7 +6017,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PIMElevationRequestRejected_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "PIMElevationRequestRejected_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion42')]", @@ -6034,7 +6034,7 @@ "description": "Identifies when a user is rejected for a privileged role elevation via PIM. Monitor rejections for indicators of attacker compromise of the requesting account.\nRef : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-identity-management", "displayName": "PIM Elevation Request Rejected", "enabled": false, - "query": "AuditLogs\n| where ActivityDisplayName =~'Add member to role completed (PIM activation)'\n| where Result =~ \"failure\"\n| mv-apply ResourceItem = TargetResources on \n (\n where ResourceItem.type =~ \"Role\"\n | extend Role = trim(@'\"',tostring(ResourceItem.displayName))\n )\n| mv-apply ResourceItem = TargetResources on \n (\n where ResourceItem.type =~ \"User\"\n | extend User = trim(@'\"',tostring(ResourceItem.userPrincipalName))\n )\n| project-reorder TimeGenerated, User, Role, OperationName, Result, ResultDescription\n| where isnotempty(InitiatedBy.user)\n| extend InitiatingUser = tostring(InitiatedBy.user.userPrincipalName), InitiatingIpAddress = tostring(InitiatedBy.user.ipAddress)\n| extend InitiatingName = tostring(split(InitiatingUser,'@',0)[0]), InitiatingUPNSuffix = tostring(split(InitiatingUser,'@',1)[0])\n| extend UserName = tostring(split(User,'@',0)[0]), UserUPNSuffix = tostring(split(User,'@',1)[0])\n", + "query": "AuditLogs\n| where (ActivityDisplayName =~'Add member to role completed (PIM activation)' and Result =~ \"failure\") or ActivityDisplayName =~'Add member to role request denied (PIM activation)'\n| mv-apply ResourceItem = TargetResources on \n (\n where ResourceItem.type =~ \"Role\"\n | extend Role = trim(@'\"',tostring(ResourceItem.displayName))\n )\n| mv-apply ResourceItem = TargetResources on \n (\n where ResourceItem.type =~ \"User\"\n | extend User = trim(@'\"',tostring(ResourceItem.userPrincipalName))\n )\n| project-reorder TimeGenerated, User, Role, OperationName, Result, ResultDescription\n| where isnotempty(InitiatedBy.user)\n| extend InitiatingUser = tostring(InitiatedBy.user.userPrincipalName), InitiatingIpAddress = tostring(InitiatedBy.user.ipAddress)\n| extend InitiatingName = tostring(split(InitiatingUser,'@',0)[0]), InitiatingUPNSuffix = tostring(split(InitiatingUser,'@',1)[0])\n| extend UserName = tostring(split(User,'@',0)[0]), UserUPNSuffix = tostring(split(User,'@',1)[0])\n", "queryFrequency": "PT2H", "queryPeriod": "PT2H", "severity": "High", @@ -6147,7 +6147,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PrivilegedAccountsSigninFailureSpikes_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "PrivilegedAccountsSigninFailureSpikes_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion43')]", @@ -6270,7 +6270,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PrivlegedRoleAssignedOutsidePIM_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "PrivlegedRoleAssignedOutsidePIM_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion44')]", @@ -6387,7 +6387,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "RareApplicationConsent_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "RareApplicationConsent_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion45')]", @@ -6515,7 +6515,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SeamlessSSOPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "SeamlessSSOPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion46')]", @@ -6632,7 +6632,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Sign-in Burst from Multiple Locations_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "Sign-in Burst from Multiple Locations_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion47')]", @@ -6746,7 +6746,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SigninAttemptsByIPviaDisabledAccounts_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "SigninAttemptsByIPviaDisabledAccounts_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion48')]", @@ -6763,7 +6763,7 @@ "description": "Identifies IPs with failed attempts to sign in to one or more disabled accounts using the IP through which successful signins from other accounts have happened.\nThis could indicate an attacker who obtained credentials for a list of accounts and is attempting to login with those accounts, some of which may have already been disabled.\nReferences: https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes\n50057 - User account is disabled. The account has been disabled by an administrator.\nThis query has also been updated to include UEBA logs IdentityInfo and BehaviorAnalytics for contextual information around the results.", "displayName": "Sign-ins from IPs that attempt sign-ins to disabled accounts", "enabled": false, - "query": "let aadFunc = (tableName: string) {\ntable(tableName)\n| where ResultType == \"50057\"\n| where ResultDescription == \"User account is disabled. The account has been disabled by an administrator.\"\n| summarize\n StartTime = min(TimeGenerated),\n EndTime = max(TimeGenerated),\n disabledAccountLoginAttempts = count(),\n disabledAccountsTargeted = dcount(UserPrincipalName),\n applicationsTargeted = dcount(AppDisplayName),\n disabledAccountSet = make_set(UserPrincipalName),\n applicationSet = make_set(AppDisplayName)\nby IPAddress, Type\n| order by disabledAccountLoginAttempts desc\n| join kind= leftouter ( \n // Consider these IPs suspicious - and alert any related successful sign-ins\n table(tableName)\n | where ResultType == 0\n | summarize\n successfulAccountSigninCount = dcount(UserPrincipalName),\n successfulAccountSigninSet = make_set(UserPrincipalName, 15)\n by IPAddress, Type\n // Assume IPs associated with sign-ins from 100+ distinct user accounts are safe\n | where successfulAccountSigninCount < 100\n) on IPAddress \n// IPs from which attempts to authenticate as disabled user accounts originated, and had a non-zero success rate for some other account\n| where isnotempty(successfulAccountSigninCount)\n| project StartTime, EndTime, IPAddress, disabledAccountLoginAttempts, disabledAccountsTargeted, disabledAccountSet, applicationSet, successfulAccountSigninCount, successfulAccountSigninSet, Type\n| order by disabledAccountLoginAttempts\n| extend timestamp = StartTime, IPCustomEntity = IPAddress\n};\nlet aadSignin = aadFunc(\"SigninLogs\");\nlet aadNonInt = aadFunc(\"AADNonInteractiveUserSignInLogs\");\nunion isfuzzy=true aadSignin, aadNonInt\n| join kind=leftouter (\n BehaviorAnalytics\n | where ActivityType in (\"FailedLogOn\", \"LogOn\")\n | where EventSource =~ \"Azure AD\"\n | project UsersInsights, DevicesInsights, ActivityInsights, InvestigationPriority, SourceIPAddress, UserPrincipalName\n | project-rename IPAddress = SourceIPAddress\n | summarize\n Users = make_set(UserPrincipalName, 1000),\n UsersInsights = make_set(UsersInsights, 1000),\n DevicesInsights = make_set(DevicesInsights, 1000),\n IPInvestigationPriority = sum(InvestigationPriority)\n by IPAddress\n) on IPAddress\n| sort by IPInvestigationPriority desc\n", + "query": "let aadFunc = (tableName: string) {\nlet failed_signins = table(tableName)\n| where ResultType == \"50057\"\n| where ResultDescription == \"User account is disabled. The account has been disabled by an administrator.\";\nlet disabled_users = failed_signins | summarize by UserPrincipalName;\ntable(tableName)\n | where ResultType == 0\n | where isnotempty(UserPrincipalName)\n | where UserPrincipalName !in (disabled_users)\n| summarize\n successfulAccountsTargettedCount = dcount(UserPrincipalName),\n successfulAccountSigninSet = make_set(UserPrincipalName, 100),\n successfulApplicationSet = make_set(AppDisplayName, 100)\n by IPAddress, Type\n // Assume IPs associated with sign-ins from 100+ distinct user accounts are safe\n | where successfulAccountsTargettedCount < 50\n | where isnotempty(successfulAccountsTargettedCount)\n | join kind=inner (failed_signins\n| summarize\n StartTime = min(TimeGenerated),\n EndTime = max(TimeGenerated),\n totalDisabledAccountLoginAttempts = count(),\n disabledAccountsTargettedCount = dcount(UserPrincipalName),\n applicationsTargeted = dcount(AppDisplayName),\n disabledAccountSet = make_set(UserPrincipalName, 100),\n disabledApplicationSet = make_set(AppDisplayName, 100)\nby IPAddress, Type\n| order by totalDisabledAccountLoginAttempts desc) on IPAddress\n| project StartTime, EndTime, IPAddress, totalDisabledAccountLoginAttempts, disabledAccountsTargettedCount, disabledAccountSet, disabledApplicationSet, successfulApplicationSet, successfulAccountsTargettedCount, successfulAccountSigninSet, Type\n| order by totalDisabledAccountLoginAttempts};\nlet aadSignin = aadFunc(\"SigninLogs\");\nlet aadNonInt = aadFunc(\"AADNonInteractiveUserSignInLogs\");\nunion isfuzzy=true aadSignin, aadNonInt\n| join kind=leftouter (\n BehaviorAnalytics\n | where ActivityType in (\"FailedLogOn\", \"LogOn\")\n | where EventSource =~ \"Azure AD\"\n | project UsersInsights, DevicesInsights, ActivityInsights, InvestigationPriority, SourceIPAddress, UserPrincipalName\n | project-rename IPAddress = SourceIPAddress\n | summarize\n Users = make_set(UserPrincipalName, 100),\n UsersInsights = make_set(UsersInsights, 100),\n DevicesInsights = make_set(DevicesInsights, 100),\n IPInvestigationPriority = sum(InvestigationPriority)\n by IPAddress\n) on IPAddress\n| extend SFRatio = toreal(toreal(disabledAccountsTargettedCount)/toreal(successfulAccountsTargettedCount))\n| where SFRatio >= 0.5\n| sort by IPInvestigationPriority desc\n", "queryFrequency": "P1D", "queryPeriod": "P1D", "severity": "Medium", @@ -6864,7 +6864,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SigninBruteForce-AzurePortal_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "SigninBruteForce-AzurePortal_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion49')]", @@ -6987,7 +6987,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SigninPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "SigninPasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion50')]", @@ -7097,7 +7097,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuccessThenFail_DiffIP_SameUserandApp_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "SuccessThenFail_DiffIP_SameUserandApp_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion51')]", @@ -7111,10 +7111,10 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Identifies when a user account successfully logs onto an Azure App from one IP and within 10 mins failed to logon to the same App via a different IP.\nThis may indicate a malicious attempt at password guessing based on knowledge of the users account. This query has also been updated to include UEBA \nlogs IdentityInfo and BehaviorAnalytics for contextual information around the results.", + "description": "Identifies when a user account successfully logs onto an Azure App from one IP and within 10 mins failed to logon to the same App via a different IP (may indicate a malicious attempt at password guessing with known account). UEBA added for context.", "displayName": "Successful logon from IP and failure from a different IP", "enabled": false, - "query": "let riskScoreCutoff = 20; //Adjust this based on volume of results\nlet logonDiff = 10m; let aadFunc = (tableName:string){ table(tableName)\n| where ResultType == \"0\"\n| where AppDisplayName !in (\"Office 365 Exchange Online\", \"Skype for Business Online\") // To remove false-positives, add more Apps to this array\n| project SuccessLogonTime = TimeGenerated, UserPrincipalName, SuccessIPAddress = IPAddress, AppDisplayName, SuccessIPBlock = iff(IPAddress contains \":\", strcat(split(IPAddress, \":\")[0], \":\", split(IPAddress, \":\")[1]), strcat(split(IPAddress, \".\")[0], \".\", split(IPAddress, \".\")[1])), Type\n| join kind= inner (\n table(tableName)\n | where ResultType !in (\"0\", \"50140\")\n | where ResultDescription !~ \"Other\"\n | where AppDisplayName !in (\"Office 365 Exchange Online\", \"Skype for Business Online\")\n | project FailedLogonTime = TimeGenerated, UserPrincipalName, FailedIPAddress = IPAddress, AppDisplayName, ResultType, ResultDescription, Type \n) on UserPrincipalName, AppDisplayName\n| where SuccessLogonTime < FailedLogonTime and FailedLogonTime - SuccessLogonTime <= logonDiff and FailedIPAddress !startswith SuccessIPBlock\n| summarize FailedLogonTime = max(FailedLogonTime), SuccessLogonTime = max(SuccessLogonTime) by UserPrincipalName, SuccessIPAddress, AppDisplayName, FailedIPAddress, ResultType, ResultDescription, Type\n| extend timestamp = SuccessLogonTime\n| extend UserPrincipalName = tolower(UserPrincipalName)};\nlet aadSignin = aadFunc(\"SigninLogs\");\nlet aadNonInt = aadFunc(\"AADNonInteractiveUserSignInLogs\");\nunion isfuzzy=true aadSignin, aadNonInt\n| join kind=leftouter (\n IdentityInfo\n | summarize LatestReportTime = arg_max(TimeGenerated, *) by AccountUPN\n | extend BlastRadiusInt = iif(BlastRadius == \"High\", 1, 0)\n | project AccountUPN, Tags, JobTitle, GroupMembership, AssignedRoles, UserType, IsAccountEnabled, BlastRadiusInt\n | summarize\n Tags = make_set(Tags, 1000),\n GroupMembership = make_set(GroupMembership, 1000),\n AssignedRoles = make_set(AssignedRoles, 1000),\n BlastRadiusInt = sum(BlastRadiusInt),\n UserType = make_set(UserType, 1000),\n UserAccountControl = make_set(UserType, 1000)\n by AccountUPN\n | extend UserPrincipalName=tolower(AccountUPN)\n) on UserPrincipalName\n| join kind=leftouter (\n BehaviorAnalytics\n | where ActivityType in (\"FailedLogOn\", \"LogOn\")\n | where isnotempty(SourceIPAddress)\n | project UsersInsights, DevicesInsights, ActivityInsights, InvestigationPriority, SourceIPAddress\n | project-rename FailedIPAddress = SourceIPAddress\n | summarize\n UsersInsights = make_set(UsersInsights, 1000),\n DevicesInsights = make_set(DevicesInsights, 1000),\n IPInvestigationPriority = sum(InvestigationPriority)\n by FailedIPAddress)\non FailedIPAddress\n| extend UEBARiskScore = BlastRadiusInt + IPInvestigationPriority\n| where UEBARiskScore > riskScoreCutoff\n| sort by UEBARiskScore desc \n", + "query": "let riskScoreCutoff = 20; //Adjust this based on volume of results\nlet logonDiff = 10m; let aadFunc = (tableName:string){ table(tableName)\n| where ResultType == \"0\"\n| where AppDisplayName !in (\"Office 365 Exchange Online\", \"Skype for Business Online\") // To remove false-positives, add more Apps to this array\n// ---------- Fix for SuccessBlock to also consider IPv6\n| extend SuccessIPv6Block = strcat(split(IPAddress, \":\")[0], \":\", split(IPAddress, \":\")[1], \":\", split(IPAddress, \":\")[2], \":\", split(IPAddress, \":\")[3])\n| extend SuccessIPv4Block = strcat(split(IPAddress, \".\")[0], \".\", split(IPAddress, \".\")[1])\n// ------------------\n| project SuccessLogonTime = TimeGenerated, UserPrincipalName, SuccessIPAddress = IPAddress, SuccessLocation = Location, AppDisplayName, SuccessIPBlock = iff(IPAddress contains \":\", strcat(split(IPAddress, \":\")[0], \":\", split(IPAddress, \":\")[1]), strcat(split(IPAddress, \".\")[0], \".\", split(IPAddress, \".\")[1])), Type\n| join kind= inner (\n table(tableName)\n | where ResultType !in (\"0\", \"50140\")\n | where ResultDescription !~ \"Other\"\n | where AppDisplayName !in (\"Office 365 Exchange Online\", \"Skype for Business Online\")\n | project FailedLogonTime = TimeGenerated, UserPrincipalName, FailedIPAddress = IPAddress, FailedLocation = Location, AppDisplayName, ResultType, ResultDescription, Type \n) on UserPrincipalName, AppDisplayName\n| where SuccessLogonTime < FailedLogonTime and FailedLogonTime - SuccessLogonTime <= logonDiff and FailedIPAddress !startswith SuccessIPBlock\n| summarize FailedLogonTime = max(FailedLogonTime), SuccessLogonTime = max(SuccessLogonTime) by UserPrincipalName, SuccessIPAddress, SuccessLocation, AppDisplayName, FailedIPAddress, FailedLocation, ResultType, ResultDescription, Type\n| extend timestamp = SuccessLogonTime\n| extend UserPrincipalName = tolower(UserPrincipalName)};\nlet aadSignin = aadFunc(\"SigninLogs\");\nlet aadNonInt = aadFunc(\"AADNonInteractiveUserSignInLogs\");\nunion isfuzzy=true aadSignin, aadNonInt\n| extend Name = tostring(split(UserPrincipalName,'@',0)[0]), UPNSuffix = tostring(split(UserPrincipalName,'@',1)[0])\n// UEBA context below - make sure you have these 2 datatypes, otherwise the query will not work. If so, comment all that is below.\n| join kind=leftouter (\n IdentityInfo\n | summarize LatestReportTime = arg_max(TimeGenerated, *) by AccountUPN\n | extend BlastRadiusInt = iif(BlastRadius == \"High\", 1, 0)\n | project AccountUPN, Tags, JobTitle, GroupMembership, AssignedRoles, UserType, IsAccountEnabled, BlastRadiusInt\n | summarize\n Tags = make_set(Tags, 1000),\n GroupMembership = make_set(GroupMembership, 1000),\n AssignedRoles = make_set(AssignedRoles, 1000),\n BlastRadiusInt = sum(BlastRadiusInt),\n UserType = make_set(UserType, 1000),\n UserAccountControl = make_set(UserType, 1000)\n by AccountUPN\n | extend UserPrincipalName=tolower(AccountUPN)\n) on UserPrincipalName\n| join kind=leftouter (\n BehaviorAnalytics\n | where ActivityType in (\"FailedLogOn\", \"LogOn\")\n | where isnotempty(SourceIPAddress)\n | project UsersInsights, DevicesInsights, ActivityInsights, InvestigationPriority, SourceIPAddress\n | project-rename FailedIPAddress = SourceIPAddress\n | summarize\n UsersInsights = make_set(UsersInsights, 1000),\n DevicesInsights = make_set(DevicesInsights, 1000),\n IPInvestigationPriority = sum(InvestigationPriority)\n by FailedIPAddress)\non FailedIPAddress\n| extend UEBARiskScore = BlastRadiusInt + IPInvestigationPriority\n| where UEBARiskScore > riskScoreCutoff\n| sort by UEBARiskScore desc \n", "queryFrequency": "P1D", "queryPeriod": "P1D", "severity": "Medium", @@ -7243,7 +7243,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousAADJoinedDeviceUpdate_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "SuspiciousAADJoinedDeviceUpdate_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion52')]", @@ -7378,7 +7378,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousOAuthApp_OfflineAccess_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "SuspiciousOAuthApp_OfflineAccess_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion53')]", @@ -7495,7 +7495,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousServicePrincipalcreationactivity_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "SuspiciousServicePrincipalcreationactivity_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion54')]", @@ -7630,7 +7630,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "UnusualGuestActivity_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "UnusualGuestActivity_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion55')]", @@ -7770,7 +7770,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "UserAccounts-CABlockedSigninSpikes_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "UserAccounts-CABlockedSigninSpikes_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion56')]", @@ -7905,7 +7905,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "UseraddedtoPrivilgedGroups_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "UseraddedtoPrivilgedGroups_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion57')]", @@ -8028,7 +8028,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "UserAssignedPrivilegedRole_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "UserAssignedPrivilegedRole_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion58')]", @@ -8045,7 +8045,7 @@ "description": "Identifies when a new privileged role is assigned to a user. Any account eligible for a role is now being given privileged access. If the assignment is unexpected or into a role that isn't the responsibility of the account holder, investigate.\nRef : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1", "displayName": "User Assigned Privileged Role", "enabled": false, - "query": "AuditLogs\n| where Category =~ \"RoleManagement\"\n| where AADOperationType in (\"Assign\", \"AssignEligibleRole\")\n| where ActivityDisplayName has_any (\"Add eligible member to role\", \"Add member to role\")\n| mv-apply TargetResource = TargetResources on \n (\n where TargetResource.type =~ \"User\"\n | extend Target = tostring(TargetResource.userPrincipalName)\n | extend Target = iff(TargetResources.type == \"ServicePrincipal\", tostring(TargetResources.displayName), Target),\n props = TargetResource.modifiedProperties\n )\n| mv-apply Property = props on \n (\n where Property.displayName =~ \"Role.DisplayName\"\n | extend RoleName = trim('\"',tostring(Property.newValue))\n )\n| where RoleName contains \"Admin\"\n| extend InitiatingApp = tostring(InitiatedBy.app.displayName)\n| extend Initiator = iif(isnotempty(InitiatingApp), InitiatingApp, tostring(InitiatedBy.user.userPrincipalName))\n// Uncomment below to not alert for PIM activations\n//| where Initiator != \"MS-PIM\"\n| summarize by bin(TimeGenerated, 1h), OperationName, RoleName, Target, Initiator, Result\n| extend TargetName = tostring(split(Target,'@',0)[0]), TargetUPNSuffix = tostring(split(Target,'@',1)[0]), InitiatorName = tostring(split(Initiator,'@',0)[0]), InitiatorUPNSuffix = tostring(split(Initiator,'@',1)[0])\n", + "query": "AuditLogs\n| where Category =~ \"RoleManagement\"\n| where AADOperationType in (\"Assign\", \"AssignEligibleRole\")\n| where ActivityDisplayName has_any (\"Add eligible member to role\", \"Add member to role\")\n| mv-apply TargetResource = TargetResources on \n (\n where TargetResource.type in~ (\"User\", \"ServicePrincipal\")\n | extend Target = iff(TargetResource.type =~ \"ServicePrincipal\", tostring(TargetResource.displayName), tostring(TargetResource.userPrincipalName)),\n props = TargetResource.modifiedProperties\n )\n| mv-apply Property = props on \n (\n where Property.displayName =~ \"Role.DisplayName\"\n | extend RoleName = trim('\"',tostring(Property.newValue))\n )\n| where RoleName contains \"Admin\"\n| extend InitiatingApp = tostring(InitiatedBy.app.displayName)\n| extend Initiator = iif(isnotempty(InitiatingApp), InitiatingApp, tostring(InitiatedBy.user.userPrincipalName))\n// Uncomment below to not alert for PIM activations\n//| where Initiator != \"MS-PIM\"\n| summarize by bin(TimeGenerated, 1h), OperationName, RoleName, Target, Initiator, Result\n| extend TargetName = tostring(split(Target,'@',0)[0]), TargetUPNSuffix = tostring(split(Target,'@',1)[0]), InitiatorName = tostring(split(Initiator,'@',0)[0]), InitiatorUPNSuffix = tostring(split(Initiator,'@',1)[0])\n", "queryFrequency": "PT2H", "queryPeriod": "PT2H", "severity": "High", @@ -8149,7 +8149,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NewOnmicrosoftDomainAdded_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "NewOnmicrosoftDomainAdded_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion59')]", @@ -8286,7 +8286,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Block-AADUser-Alert Playbook with template version 3.0.2", + "description": "Block-AADUser-Alert Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -8729,7 +8729,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Block-AADUser-Incident Playbook with template version 3.0.2", + "description": "Block-AADUser-Incident Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -9155,7 +9155,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Prompt-User-Alert Playbook with template version 3.0.2", + "description": "Prompt-User-Alert Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -9591,7 +9591,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Prompt-User-Incident Playbook with template version 3.0.2", + "description": "Prompt-User-Incident Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -10010,7 +10010,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Reset-AADPassword-AlertTrigger Playbook with template version 3.0.2", + "description": "Reset-AADPassword-AlertTrigger Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion5')]", @@ -10410,7 +10410,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Reset-AADPassword-IncidentTrigger Playbook with template version 3.0.2", + "description": "Reset-AADPassword-IncidentTrigger Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion6')]", @@ -10793,7 +10793,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Block-AADUser-EntityTrigger Playbook with template version 3.0.2", + "description": "Block-AADUser-EntityTrigger Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion7')]", @@ -11254,7 +11254,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Reset-AADUserPassword-EntityTrigger Playbook with template version 3.0.2", + "description": "Reset-AADUserPassword-EntityTrigger Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion8')]", @@ -11659,7 +11659,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Revoke-AADSignInSessions-alert Playbook with template version 3.0.2", + "description": "Revoke-AADSignInSessions-alert Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion9')]", @@ -11987,7 +11987,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Revoke-AADSignInSessions-incident Playbook with template version 3.0.2", + "description": "Revoke-AADSignInSessions-incident Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion10')]", @@ -12311,7 +12311,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Revoke-AADSignIn-Session-entityTrigger Playbook with template version 3.0.2", + "description": "Revoke-AADSignIn-Session-entityTrigger Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion11')]", @@ -12522,7 +12522,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.2", + "version": "3.0.3", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Azure Active Directory", diff --git a/Solutions/Azure Active Directory/ReleaseNotes.md b/Solutions/Azure Active Directory/ReleaseNotes.md index c61cc87ac47..cf294f260bc 100644 --- a/Solutions/Azure Active Directory/ReleaseNotes.md +++ b/Solutions/Azure Active Directory/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|----------------------------------------------------------------------------------------------------------------------------------------| +| 3.0.3 | 22-09-2023 | 2 **Analytic Rules** updated in the solution (PIM Elevation Request Rejected),(NRT Authentication Methods Changed for VIP Users) | | 3.0.2 | 08-08-2023 | 1 **Analytic Rules** updated in the solution (Credential added after admin consented to Application) | | 3.0.1 | 01-08-2023 | Added new **Analytic Rule** (New onmicrosoft domain added to tenant) | | 3.0.0 | 19-07-2023 | 2 **Analytic Rules** updated in the solution (User Assigned Privileged Role,Successful logon from IP and failure from a different IP) | diff --git a/Solutions/Box/Data Connectors/BoxConn.zip b/Solutions/Box/Data Connectors/BoxConn.zip index e48dad8b711..165ba1c5555 100644 Binary files a/Solutions/Box/Data Connectors/BoxConn.zip and b/Solutions/Box/Data Connectors/BoxConn.zip differ diff --git a/Solutions/Box/Data Connectors/requirements.txt b/Solutions/Box/Data Connectors/requirements.txt index 56587a2a52e..f8008ef8d6f 100644 --- a/Solutions/Box/Data Connectors/requirements.txt +++ b/Solutions/Box/Data Connectors/requirements.txt @@ -5,7 +5,7 @@ azure-functions pyjwt==2.4.0 -cryptography==41.0.3 +cryptography==41.0.4 boxsdk==3.3.0 azure-storage-file-share==12.7.0 python-dateutil==2.8.2 \ No newline at end of file diff --git a/Solutions/Commvault Security IQ/Package/3.0.0.zip b/Solutions/Commvault Security IQ/Package/3.0.0.zip index 268889bddf4..372d9bdef3d 100644 Binary files a/Solutions/Commvault Security IQ/Package/3.0.0.zip and b/Solutions/Commvault Security IQ/Package/3.0.0.zip differ diff --git a/Solutions/Commvault Security IQ/Package/mainTemplate.json b/Solutions/Commvault Security IQ/Package/mainTemplate.json index e58160ff630..bab08b8d288 100644 --- a/Solutions/Commvault Security IQ/Package/mainTemplate.json +++ b/Solutions/Commvault Security IQ/Package/mainTemplate.json @@ -764,10 +764,10 @@ "1. Administrative access to your Commvault/Metallic environment.", "2. Administrative access to your Azure Resource Group and Subscription.", "3. A Microsoft Sentinel instance in the aforementioned Azure Resource Group.", - "4. A Keyvault and an Automation Account configured as mentioned in the documentation here :- (https://github.com/Cv-securityIQ/Azure-Integration/blob/Commvault/Solutions/Commvault%20Security%20IQ/README.md)" + "4. A Keyvault and an Automation Account configured as mentioned in the documentation here :- (https://github.com/Cv-securityIQ/Azure-Integration/blob/master/Solutions/Commvault%20Security%20IQ/README.md)" ], "postDeployment": [ - "1. Steps to follow the instructions are mentioned here :- (https://github.com/Cv-securityIQ/Azure-Integration/blob/Commvault/Solutions/Commvault%20Security%20IQ/README.md)", + "1. Steps to follow the instructions are mentioned here :- (https://github.com/Cv-securityIQ/Azure-Integration/blob/master/Solutions/Commvault%20Security%20IQ/README.md)", "2. Give the required permissions to the logic app to get the secrets from the keyvault.", "3. Setup the Managed Identity" ], diff --git a/Solutions/Commvault Security IQ/Playbooks/CommvaultLogicApp/azuredeploy.json b/Solutions/Commvault Security IQ/Playbooks/CommvaultLogicApp/azuredeploy.json index bd44edeeae4..6c4f5b1b39b 100644 --- a/Solutions/Commvault Security IQ/Playbooks/CommvaultLogicApp/azuredeploy.json +++ b/Solutions/Commvault Security IQ/Playbooks/CommvaultLogicApp/azuredeploy.json @@ -7,8 +7,8 @@ "prerequisites": ["1. Administrative access to your Commvault/Metallic environment.", "2. Administrative access to your Azure Resource Group and Subscription.", "3. A Microsoft Sentinel instance in the aforementioned Azure Resource Group.", - "4. A Keyvault and an Automation Account configured as mentioned in the documentation here :- (https://github.com/Cv-securityIQ/Azure-Integration/blob/Commvault/Solutions/Commvault%20Security%20IQ/README.md)"], - "postDeployment": ["1. Steps to follow the instructions are mentioned here :- (https://github.com/Cv-securityIQ/Azure-Integration/blob/Commvault/Solutions/Commvault%20Security%20IQ/README.md)", + "4. A Keyvault and an Automation Account configured as mentioned in the documentation here :- (https://github.com/Cv-securityIQ/Azure-Integration/blob/master/Solutions/Commvault%20Security%20IQ/README.md)"], + "postDeployment": ["1. Steps to follow the instructions are mentioned here :- (https://github.com/Cv-securityIQ/Azure-Integration/blob/master/Solutions/Commvault%20Security%20IQ/README.md)", "2. Give the required permissions to the logic app to get the secrets from the keyvault.", "3. Setup the Managed Identity" ], diff --git a/Solutions/Commvault Security IQ/Playbooks/CommvaultLogicApp/readme.md b/Solutions/Commvault Security IQ/Playbooks/CommvaultLogicApp/readme.md index b7b33008afe..59e67d18bef 100644 --- a/Solutions/Commvault Security IQ/Playbooks/CommvaultLogicApp/readme.md +++ b/Solutions/Commvault Security IQ/Playbooks/CommvaultLogicApp/readme.md @@ -6,7 +6,7 @@ This Logic App executes when called upon by an Automation Rule. Accessing the Ke - Administrative access to your Commvault/Metallic environment. - Administrative access to your Azure Resource Group and Subscription. - A Microsoft Sentinel instance in the aforementioned Azure Resource Group. -- A Keyvault and an Automation Account configured as mentioned in the documentation here :- (https://github.com/Cv-securityIQ/Azure-Integration/blob/Commvault/Solutions/Commvault%20Security%20IQ/README.md) +- A Keyvault and an Automation Account configured as mentioned in the documentation here :- (https://github.com/Cv-securityIQ/Azure-Integration/blob/master/Solutions/Commvault%20Security%20IQ/README.md) ## Deployment Instructions Deploy the playbook by clicking on "Deploy to Azure" button. This will take you to deploying an ARM Template wizard. @@ -21,6 +21,6 @@ Alternatively:- 4. Enter in the required parameters ## Post-deployment Instructions -Steps to follow the instructions are mentioned here :- (https://github.com/Cv-securityIQ/Azure-Integration/blob/Commvault/Solutions/Commvault%20Security%20IQ/README.md) +Steps to follow the instructions are mentioned here :- (https://github.com/Cv-securityIQ/Azure-Integration/blob/master/Solutions/Commvault%20Security%20IQ/README.md) 1. Give the required permissions to the logic app to get the secrets from the keyvault. 2. Setup the Managed Identity diff --git a/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data Connectors/CyberArk Data Connector.json b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data Connectors/CyberArk Data Connector.json index cd979f541d4..1abb2407a51 100644 --- a/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data Connectors/CyberArk Data Connector.json +++ b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data Connectors/CyberArk Data Connector.json @@ -1,6 +1,6 @@ { "id": "CyberArk", - "title": "CyberArk Enterprise Password Vault (EPV) Events", + "title": "[Deprecated] CyberArk Enterprise Password Vault (EPV) Events via Legacy Agent ", "publisher": "Cyber-Ark", "descriptionMarkdown": "CyberArk Enterprise Password Vault generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Microsoft Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog staging server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Microsoft Log Analytics. Refer to the [CyberArk documentation](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/DV-Integrating-with-SIEM-Applications.htm) for more guidance on SIEM integrations.", "graphQueries": [{ diff --git a/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data Connectors/template_CyberArkAMA.json b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data Connectors/template_CyberArkAMA.json new file mode 100644 index 00000000000..6121fea3ad4 --- /dev/null +++ b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data Connectors/template_CyberArkAMA.json @@ -0,0 +1,124 @@ +{ + "id": "CyberArkAma", + "title": "[Recommended] CyberArk Enterprise Password Vault (EPV) Events via AMA ", + "publisher": "Cyber-Ark", + "descriptionMarkdown": "CyberArk Enterprise Password Vault generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Microsoft Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog staging server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Microsoft Log Analytics. Refer to the [CyberArk documentation](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/DV-Integrating-with-SIEM-Applications.htm) for more guidance on SIEM integrations.", + "graphQueries": [{ + "metricName": "Total data received", + "legend": "CyberArk", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Cyber-Ark'\n |where DeviceProduct =~ 'Vault'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + }], + "sampleQueries": [{ + "description": "CyberArk Alerts", + "query": "CommonSecurityLog\n| where DeviceVendor == \"Cyber-Ark\"\n| where DeviceProduct == \"Vault\"\n| where LogSeverity == \"7\" or LogSeverity == \"10\"\n| sort by TimeGenerated desc" + }], + "dataTypes": [{ + "name": "CommonSecurityLog (CyberArk)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Cyber-Ark'\n |where DeviceProduct =~ 'Vault'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }], + "connectivityCriterias": [{ + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Cyber-Ark'\n |where DeviceProduct =~ 'Vault'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + }], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "title": "", + "description":"", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine", + "instructions": [ + ] + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "On the EPV configure the dbparm.ini to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machines IP address.", + "instructions": [ + ] + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + + }, + + { + "title": "2. Secure your machine ", + "description": "Make sure to configure the machines security according to your organizations security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)" + } + ], + "metadata": { + "id": "1c45e738-21dd-4fcd-9449-e2c9478e9552", + "version": "1.0.0", + "kind": "dataConnector", + "source": { + "kind": "community" + }, + "author": { + "name": "Cyberark" + }, + "support": { + "name": "Cyberark", + "link": "https://www.cyberark.com/customer-support/", + "tier": "developer" + } + } +} diff --git a/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data/Solution_CyberArkEPVEvents.json b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data/Solution_CyberArkEPVEvents.json index 495f30829c4..7f8a4b9ec6c 100644 --- a/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data/Solution_CyberArkEPVEvents.json +++ b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data/Solution_CyberArkEPVEvents.json @@ -2,16 +2,18 @@ "Name": "CyberArk Enterprise Password Vault (EPV) Events", "Author": "Cyberark", "Logo": "", - "Description": "[CyberArk Enterprise Password Vault](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/CP%20for%20zOS/Installing-the-Enterprise-Password-Vault.htm?TocPath=Installation%7Cz%2FOS%20Credential%20Provider%7C_____2#:~:text=%20Enterprise%20Password%20Vault%20%201%20Install%20the,applications%20and%20create%2C%20request%2C%20access%20and...%20More%20) Solution for Microsoft Sentinel enables ingestion of Common Event Format (CEF) logs into Microsoft Sentinel. The EPV generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Azure Log Analytics. Refer to the [CyberArk documentation](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/DV-Integrating-with-SIEM-Applications.htm) for more guidance on SIEM integrations.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n1. [Agent-based log collection (CEF over Syslog)](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)", + "Description": "[CyberArk Enterprise Password Vault](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/CP%20for%20zOS/Installing-the-Enterprise-Password-Vault.htm?TocPath=Installation%7Cz%2FOS%20Credential%20Provider%7C_____2#:~:text=%20Enterprise%20Password%20Vault%20%201%20Install%20the,applications%20and%20create%2C%20request%2C%20access%20and...%20More%20) Solution for Microsoft Sentinel enables ingestion of Common Event Format (CEF) logs into Microsoft Sentinel. The EPV generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Azure Log Analytics. Refer to the [CyberArk documentation](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/DV-Integrating-with-SIEM-Applications.htm) for more guidance on SIEM integrations.\n\r\n1. **CyberArk Enterprise Password Vault via AMA** - This data connector helps in ingesting CyberArk Enterprise Password Vault logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **CyberArk Enterprise Password Vault via Legacy Agent** - This data connector helps in ingesting CyberArk Enterprise Password Vault logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of CyberArk Enterprise Password Vault via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", "Data Connectors": [ - "Data Connectors/CyberArk Data Connector.json" + "Data Connectors/CyberArk Data Connector.json", + "Data Connectors/template_CyberArkAMA.json" ], "Workbooks": [ "Workbooks/CyberArkEPV.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CyberArk Enterprise Password Vault (EPV) Events", - "Version": "2.0.2", + "Version": "3.0.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false + } \ No newline at end of file diff --git a/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data/system_generated_metadata.json b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data/system_generated_metadata.json new file mode 100644 index 00000000000..d66173db840 --- /dev/null +++ b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Data/system_generated_metadata.json @@ -0,0 +1,30 @@ +{ + "Name": "CyberArk Enterprise Password Vault (EPV) Events", + "Author": "Cyberark", + "Logo": "", + "Description": "[CyberArk Enterprise Password Vault](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/CP%20for%20zOS/Installing-the-Enterprise-Password-Vault.htm?TocPath=Installation%7Cz%2FOS%20Credential%20Provider%7C_____2#:~:text=%20Enterprise%20Password%20Vault%20%201%20Install%20the,applications%20and%20create%2C%20request%2C%20access%20and...%20More%20) Solution for Microsoft Sentinel enables ingestion of Common Event Format (CEF) logs into Microsoft Sentinel. The EPV generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Azure Log Analytics. Refer to the [CyberArk documentation](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/DV-Integrating-with-SIEM-Applications.htm) for more guidance on SIEM integrations.\n\r\n1. **CyberArk Enterprise Password Vault via AMA** - This data connector helps in ingesting CyberArk Enterprise Password Vault logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **CyberArk Enterprise Password Vault via Legacy Agent** - This data connector helps in ingesting CyberArk Enterprise Password Vault logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of CyberArk Enterprise Password Vault via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CyberArk Enterprise Password Vault (EPV) Events", + "Version": "3.0.0", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1Pconnector": false, + "publisherId": "cyberark", + "offerId": "cyberark_epv_events_mss", + "providers": [ + "Cyberark" + ], + "categories": { + "domains": [ + "Identity" + ], + "verticals": [] + }, + "firstPublishDate": "2022-05-02", + "support": { + "name": "Cyberark", + "tier": "Partner", + "link": "https://www.cyberark.com/services-support/technical-support/" + }, + "Data Connectors": "[\n \"Data Connectors/CyberArk Data Connector.json\",\n \"Data Connectors/template_CyberArkAMA.json\"\n]", + "Workbooks": "[\n \"Workbooks/CyberArkEPV.json\"\n]" +} diff --git a/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Package/3.0.0.zip b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Package/3.0.0.zip new file mode 100644 index 00000000000..8d44b6ef97b Binary files /dev/null and b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Package/3.0.0.zip differ diff --git a/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Package/createUiDefinition.json b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Package/createUiDefinition.json index d09fe73c567..476d71eba35 100644 --- a/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Package/createUiDefinition.json +++ b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\n[CyberArk Enterprise Password Vault](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/CP%20for%20zOS/Installing-the-Enterprise-Password-Vault.htm?TocPath=Installation%7Cz%2FOS%20Credential%20Provider%7C_____2#:~:text=%20Enterprise%20Password%20Vault%20%201%20Install%20the,applications%20and%20create%2C%20request%2C%20access%20and...%20More%20) Solution for Microsoft Sentinel enables ingestion of Common Event Format (CEF) logs into Microsoft Sentinel. The EPV generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Azure Log Analytics. Refer to the [CyberArk documentation](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/DV-Integrating-with-SIEM-Applications.htm) for more guidance on SIEM integrations.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n1. [Agent-based log collection (CEF over Syslog)](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)\n\n**Data Connectors:** 1, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CyberArk%20Enterprise%20Password%20Vault%20%20Events/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[CyberArk Enterprise Password Vault](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/CP%20for%20zOS/Installing-the-Enterprise-Password-Vault.htm?TocPath=Installation%7Cz%2FOS%20Credential%20Provider%7C_____2#:~:text=%20Enterprise%20Password%20Vault%20%201%20Install%20the,applications%20and%20create%2C%20request%2C%20access%20and...%20More%20) Solution for Microsoft Sentinel enables ingestion of Common Event Format (CEF) logs into Microsoft Sentinel. The EPV generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Azure Log Analytics. Refer to the [CyberArk documentation](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/DV-Integrating-with-SIEM-Applications.htm) for more guidance on SIEM integrations.\n\r\n1. **CyberArk Enterprise Password Vault via AMA** - This data connector helps in ingesting CyberArk Enterprise Password Vault logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **CyberArk Enterprise Password Vault via Legacy Agent** - This data connector helps in ingesting CyberArk Enterprise Password Vault logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of CyberArk Enterprise Password Vault via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -63,6 +63,7 @@ "text": "This solution installs the data connector for ingesting CyberArk Enterprise Password Vault (EPV) Events in the CEF format into Microsoft Sentinel. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, + { "name": "dataconnectors-link2", "type": "Microsoft.Common.TextBlock", diff --git a/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Package/mainTemplate.json b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Package/mainTemplate.json index 4f522189409..20723c1bfe6 100644 --- a/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Package/mainTemplate.json +++ b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/Package/mainTemplate.json @@ -38,52 +38,48 @@ } }, "variables": { + "_solutionName": "CyberArk Enterprise Password Vault (EPV) Events", + "_solutionVersion": "3.0.0", "solutionId": "cyberark.cyberark_epv_events_mss", "_solutionId": "[variables('solutionId')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "uiConfigId1": "CyberArk", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "CyberArk", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "uiConfigId2": "CyberArkAma", + "_uiConfigId2": "[variables('uiConfigId2')]", + "dataConnectorContentId2": "CyberArkAma", + "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", + "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "_dataConnectorId2": "[variables('dataConnectorId2')]", + "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", + "dataConnectorVersion2": "1.0.0", + "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "workbookVersion1": "1.1.0", "workbookContentId1": "CyberArkWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", - "_workbookContentId1": "[variables('workbookContentId1')]" + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", + "_workbookContentId1": "[variables('workbookContentId1')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "CyberArk Enterprise Password Vault (EPV) Events data connector with template", - "displayName": "CyberArk Enterprise Password Vault (EPV) Events template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CyberArk Enterprise Password Vault (EPV) Events data connector with template version 2.0.2", + "description": "CyberArk Enterprise Password Vault (EPV) Events data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -99,7 +95,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId1')]", - "title": "CyberArk Enterprise Password Vault (EPV) Events", + "title": "[Deprecated] CyberArk Enterprise Password Vault (EPV) Events via Legacy Agent ", "publisher": "Cyber-Ark", "descriptionMarkdown": "CyberArk Enterprise Password Vault generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Microsoft Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog staging server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Microsoft Log Analytics. Refer to the [CyberArk documentation](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/DV-Integrating-with-SIEM-Applications.htm) for more guidance on SIEM integrations.", "graphQueries": [ @@ -231,7 +227,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -254,12 +250,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "[Deprecated] CyberArk Enterprise Password Vault (EPV) Events via Legacy Agent ", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -293,7 +300,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "CyberArk Enterprise Password Vault (EPV) Events", + "title": "[Deprecated] CyberArk Enterprise Password Vault (EPV) Events via Legacy Agent ", "publisher": "Cyber-Ark", "descriptionMarkdown": "CyberArk Enterprise Password Vault generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Microsoft Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog staging server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Microsoft Log Analytics. Refer to the [CyberArk documentation](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/DV-Integrating-with-SIEM-Applications.htm) for more guidance on SIEM integrations.", "graphQueries": [ @@ -409,33 +416,352 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", - "name": "[variables('workbookTemplateSpecName1')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "description": "CyberArk Enterprise Password Vault (EPV) Events Workbook with template", - "displayName": "CyberArk EPV Events workbook template" + "description": "CyberArk Enterprise Password Vault (EPV) Events data connector with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion2')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId2')]", + "title": "[Recommended] CyberArk Enterprise Password Vault (EPV) Events via AMA", + "publisher": "Cyber-Ark", + "descriptionMarkdown": "CyberArk Enterprise Password Vault generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Microsoft Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog staging server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Microsoft Log Analytics. Refer to the [CyberArk documentation](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/DV-Integrating-with-SIEM-Applications.htm) for more guidance on SIEM integrations.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "CyberArk", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Cyber-Ark'\n |where DeviceProduct =~ 'Vault'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description": "CyberArk Alerts", + "query": "CommonSecurityLog\n| where DeviceVendor == \"Cyber-Ark\"\n| where DeviceProduct == \"Vault\"\n| where LogSeverity == \"7\" or LogSeverity == \"10\"\n| sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (CyberArk)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Cyber-Ark'\n |where DeviceProduct =~ 'Vault'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Cyber-Ark'\n |where DeviceProduct =~ 'Vault'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "On the EPV configure the dbparm.ini to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machines IP address." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machines security according to your organizations security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ], + "metadata": { + "id": "1c45e738-21dd-4fcd-9449-e2c9478e9552", + "version": "1.0.0", + "kind": "dataConnector", + "source": { + "kind": "community" + }, + "author": { + "name": "Cyberark" + }, + "support": { + "name": "Cyberark", + "link": "https://www.cyberark.com/customer-support/", + "tier": "developer" + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "CyberArk Enterprise Password Vault (EPV) Events", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Cyberark" + }, + "support": { + "name": "Cyberark", + "tier": "Partner", + "link": "https://www.cyberark.com/services-support/technical-support/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId2')]", + "contentKind": "DataConnector", + "displayName": "[Recommended] CyberArk Enterprise Password Vault (EPV) Events via AMA", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", + "version": "[variables('dataConnectorVersion2')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId2')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "CyberArk Enterprise Password Vault (EPV) Events", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Cyberark" + }, + "support": { + "name": "Cyberark", + "tier": "Partner", + "link": "https://www.cyberark.com/services-support/technical-support/" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "[Recommended] CyberArk Enterprise Password Vault (EPV) Events via AMA", + "publisher": "Cyber-Ark", + "descriptionMarkdown": "CyberArk Enterprise Password Vault generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Microsoft Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog staging server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Microsoft Log Analytics. Refer to the [CyberArk documentation](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/DV-Integrating-with-SIEM-Applications.htm) for more guidance on SIEM integrations.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "CyberArk", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Cyber-Ark'\n |where DeviceProduct =~ 'Vault'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (CyberArk)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Cyber-Ark'\n |where DeviceProduct =~ 'Vault'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Cyber-Ark'\n |where DeviceProduct =~ 'Vault'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "CyberArk Alerts", + "query": "CommonSecurityLog\n| where DeviceVendor == \"Cyber-Ark\"\n| where DeviceProduct == \"Vault\"\n| where LogSeverity == \"7\" or LogSeverity == \"10\"\n| sort by TimeGenerated desc" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "On the EPV configure the dbparm.ini to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machines IP address." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machines security according to your organizations security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ], + "id": "[variables('_uiConfigId2')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CyberArkEPVWorkbook with template version 2.0.2", + "description": "CyberArkEPVWorkbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -498,17 +824,35 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.2", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "CyberArk Enterprise Password Vault (EPV) Events", + "publisherDisplayName": "Cyberark", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

CyberArk Enterprise Password Vault Solution for Microsoft Sentinel enables ingestion of Common Event Format (CEF) logs into Microsoft Sentinel. The EPV generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Azure Log Analytics. Refer to the CyberArk documentation for more guidance on SIEM integrations.

\n
    \n

  1. CyberArk Enterprise Password Vault via AMA - This data connector helps in ingesting CyberArk Enterprise Password Vault logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. CyberArk Enterprise Password Vault via Legacy Agent - This data connector helps in ingesting CyberArk Enterprise Password Vault logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends installation of CyberArk Enterprise Password Vault via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 2, Workbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { @@ -532,6 +876,11 @@ "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId2')]", + "version": "[variables('dataConnectorVersion2')]" + }, { "kind": "Workbook", "contentId": "[variables('_workbookContentId1')]", diff --git a/Solutions/CyberArk Enterprise Password Vault (EPV) Events/ReleaseNotes.md b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/ReleaseNotes.md new file mode 100644 index 00000000000..8307f60b7cf --- /dev/null +++ b/Solutions/CyberArk Enterprise Password Vault (EPV) Events/ReleaseNotes.md @@ -0,0 +1,5 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------------------------------| +| 3.0.0 | 21-09-2023 | Addition of new CyberArk Enterprise Password Vault (EPV) Events AMA **Data Connector** | | | + + diff --git a/Solutions/Cyberpion/Data/Solution_Cyberpion.json b/Solutions/Cyberpion/Data/Solution_Cyberpion.json deleted file mode 100644 index d90f0affaa5..00000000000 --- a/Solutions/Cyberpion/Data/Solution_Cyberpion.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "Name": "Cyberpion", - "Author": "Cyberpion", - "Logo": "", - "Description": "The [Cyberpion](https://www.cyberpion.com/) solution for Microsoft Sentinel enables you to ingest vulnerability logs from the Cyberpion platform into Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution is dependent on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Codeless Connector Platform/Native Sentinel Polling](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal)", - "Data Connectors": [ - "Data Connectors/CyberpionSecurityLogs.json" - ], - "Analytic Rules": [ - "Analytic Rules/HighUrgencyActionItems.yaml" - ], - "Workbooks": [ - "Workbooks/CyberpionOverviewWorkbook.json" - ], - "BasePath": "C:\\GitHub\\azure\\Solutions\\Cyberpion", - "Version": "2.0.1", - "Metadata": "SolutionMetadata.json", - "TemplateSpec": true, - "Is1Pconnector": false -} \ No newline at end of file diff --git a/Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseAlerts.zip b/Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseAlerts.zip index 18dec5fc2b0..f55bc489462 100644 Binary files a/Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseAlerts.zip and b/Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseAlerts.zip differ diff --git a/Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/requirements.txt b/Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/requirements.txt index 7c002d78ffe..f94d901f066 100644 --- a/Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/requirements.txt +++ b/Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/requirements.txt @@ -8,7 +8,7 @@ requests #Libraries for Log Analytics to Threat Intelligence Function. azure-monitor-query azure-identity -cryptography==41.0.3 +cryptography==41.0.4 asyncio aiohttp azure-storage-file-share==12.10.1 diff --git a/Solutions/Delinea Secret Server/Data Connectors/DelineaSecretServer_CEF.json b/Solutions/Delinea Secret Server/Data Connectors/DelineaSecretServer_CEF.json index d4d37cfe7e7..4f276598551 100644 --- a/Solutions/Delinea Secret Server/Data Connectors/DelineaSecretServer_CEF.json +++ b/Solutions/Delinea Secret Server/Data Connectors/DelineaSecretServer_CEF.json @@ -1,6 +1,6 @@ { "id": "DelineaSecretServer_CEF", - "title": "Delinea Secret Server", + "title": "[Deprecated] Delinea Secret Server via Legacy Agent", "publisher": "Delinea, Inc", "descriptionMarkdown": "Common Event Format (CEF) from Delinea Secret Server ", "graphQueries": [ diff --git a/Solutions/Delinea Secret Server/Data Connectors/template_DelineaSecretServerAMA.json b/Solutions/Delinea Secret Server/Data Connectors/template_DelineaSecretServerAMA.json new file mode 100644 index 00000000000..67ceb5502cf --- /dev/null +++ b/Solutions/Delinea Secret Server/Data Connectors/template_DelineaSecretServerAMA.json @@ -0,0 +1,119 @@ +{ + "id": "DelineaSecretServerAma", + "title": "[Recommended] Delinea Secret Server via AMA", + "publisher": "Delinea, Inc", + "descriptionMarkdown": "Common Event Format (CEF) from Delinea Secret Server ", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "CommonSecurityLog(DelineaSecretServer)", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Delinea Software' or DeviceVendor =~ 'Thycotic Software' \n |where DeviceProduct =~ 'Secret Server'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description" : "Get records create new secret", + "query": "CommonSecurityLog\n| where DeviceVendor == \"Delinea Software\" or DeviceVendor == \"Thycotic Software\"\n| where DeviceProduct == \"Secret Server\"\n| where Activity has \"SECRET - CREATE\"" + }, + { + "description" : "Get records where view secret", + "query" :"CommonSecurityLog\n| where DeviceVendor == \"Delinea Software\" or DeviceVendor == \"Thycotic Software\"\n| where DeviceProduct == \"Secret Server\"\n| where Activity has \"SECRET - VIEW\"" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog(DelineaSecretServer)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Delinea Software' or DeviceVendor =~ 'Thycotic Software' \n |where DeviceProduct =~ 'Secret Server'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Delinea Software' or DeviceVendor =~ 'Thycotic Software' \n |where DeviceProduct =~ 'Secret Server'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "title": "", + "description": "", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine", + "instructions": [ + ] + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address.", + "instructions": [ + ] + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + + { + "title": "2. Secure your machine ", + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)" + } + ] +} diff --git a/Solutions/Delinea Secret Server/Data/Solution_DelineaSecretServer.json b/Solutions/Delinea Secret Server/Data/Solution_DelineaSecretServer.json index ee9bab81e48..8e484b289ec 100644 --- a/Solutions/Delinea Secret Server/Data/Solution_DelineaSecretServer.json +++ b/Solutions/Delinea Secret Server/Data/Solution_DelineaSecretServer.json @@ -2,15 +2,16 @@ "Name": "Delinea Secret Server", "Author": "Delinea", "Logo": "", - "Description": "The [Delinea](https://delinea.com/) Secret Server Microsoft Sentinel Data Solution enables delivery of Delinea Secret Server log messages to your Microsoft Sentinel Workspace.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Common Event Format (CEF) formatted logs in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)", + "Description": "The [Delinea](https://delinea.com/) Secret Server Microsoft Sentinel Data Solution enables delivery of Delinea Secret Server log messages to your Microsoft Sentinel Workspace.\n\r\n1. **Delinea Secret Server via AMA** - This data connector helps in ingesting Delinea Secret Server logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Delinea Secret Server via Legacy Agent** - This data connector helps in ingesting Delinea Secret Server logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Delinea Secret Server via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", "Data Connectors": [ - "Solutions/Delinea Secret Server/Data Connectors/DelineaSecretServer_CEF.json" + "Solutions/Delinea Secret Server/Data Connectors/DelineaSecretServer_CEF.json", + "Solutions/Delinea Secret Server/Data Connectors/template_DelineaSecretServerAMA.json" ], "Workbooks": [ "Solutions/Delinea Secret Server/Workbooks/DelineaWorkbook.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel", - "Version": "2.0.1", + "Version": "3.0.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Delinea Secret Server/Data/system_generated_metadata.json b/Solutions/Delinea Secret Server/Data/system_generated_metadata.json new file mode 100644 index 00000000000..3b1608a3281 --- /dev/null +++ b/Solutions/Delinea Secret Server/Data/system_generated_metadata.json @@ -0,0 +1,29 @@ +{ + "Name": "Delinea Secret Server", + "Author": "Delinea", + "Logo": "", + "Description": "The [Delinea](https://delinea.com/) Secret Server Microsoft Sentinel Data Solution enables delivery of Delinea Secret Server log messages to your Microsoft Sentinel Workspace.\n\r\n1. **Delinea Secret Server via AMA** - This data connector helps in ingesting Delinea Secret Server logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Delinea Secret Server via Legacy Agent** - This data connector helps in ingesting Delinea Secret Server logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Delinea Secret Server via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "BasePath": "C:\\GitHub\\Azure-Sentinel", + "Version": "3.0.0", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false, + "publisherId": "delineainc1653506022260", + "offerId": "delinea_secret_server_mss", + "providers": [ + "Delinea" + ], + "categories": { + "domains": [ + "Security - Threat Protection" + ] + }, + "firstPublishDate": "2022-05-06", + "support": { + "name": "Delinea", + "tier": "Partner", + "link": "https://delinea.com/support/" + }, + "Data Connectors": "[\n \"DelineaSecretServer_CEF.json\",\n \"template_DelineaSecretServerAMA.json\"\n]", + "Workbooks": "[\n \"DelineaWorkbook.json\"\n]" +} diff --git a/Solutions/Delinea Secret Server/Package/3.0.0.zip b/Solutions/Delinea Secret Server/Package/3.0.0.zip new file mode 100644 index 00000000000..fea559457e5 Binary files /dev/null and b/Solutions/Delinea Secret Server/Package/3.0.0.zip differ diff --git a/Solutions/Delinea Secret Server/Package/createUiDefinition.json b/Solutions/Delinea Secret Server/Package/createUiDefinition.json index b20a55f2bb9..a15d00c800e 100644 --- a/Solutions/Delinea Secret Server/Package/createUiDefinition.json +++ b/Solutions/Delinea Secret Server/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Delinea](https://delinea.com/) Secret Server Microsoft Sentinel Data Solution enables delivery of Delinea Secret Server log messages to your Microsoft Sentinel Workspace.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Common Event Format (CEF) formatted logs in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)\n\n**Data Connectors:** 1, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Delinea%20Secret%20Server/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Delinea](https://delinea.com/) Secret Server Microsoft Sentinel Data Solution enables delivery of Delinea Secret Server log messages to your Microsoft Sentinel Workspace.\n\r\n1. **Delinea Secret Server via AMA** - This data connector helps in ingesting Delinea Secret Server logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Delinea Secret Server via Legacy Agent** - This data connector helps in ingesting Delinea Secret Server logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Delinea Secret Server via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -100,6 +100,20 @@ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data" } } + }, + { + "name": "workbook1", + "type": "Microsoft.Common.Section", + "label": "Delinea Secret Server Workbook", + "elements": [ + { + "name": "workbook1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "The Delinea Secret Server Syslog connector" + } + } + ] } ] } diff --git a/Solutions/Delinea Secret Server/Package/mainTemplate.json b/Solutions/Delinea Secret Server/Package/mainTemplate.json index 9bae0969a9c..e9b2955e719 100644 --- a/Solutions/Delinea Secret Server/Package/mainTemplate.json +++ b/Solutions/Delinea Secret Server/Package/mainTemplate.json @@ -40,50 +40,46 @@ "variables": { "solutionId": "delineainc1653506022260.delinea_secret_server_mss", "_solutionId": "[variables('solutionId')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_solutionName": "Delinea Secret Server", + "_solutionVersion": "3.0.0", "uiConfigId1": "DelineaSecretServer_CEF", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "DelineaSecretServer_CEF", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "uiConfigId2": "DelineaSecretServerAma", + "_uiConfigId2": "[variables('uiConfigId2')]", + "dataConnectorContentId2": "DelineaSecretServerAma", + "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", + "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "_dataConnectorId2": "[variables('dataConnectorId2')]", + "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", + "dataConnectorVersion2": "1.0.0", + "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "workbookVersion1": "1.0.0", "workbookContentId1": "DelineaWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", - "_workbookContentId1": "[variables('workbookContentId1')]" + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", + "_workbookContentId1": "[variables('workbookContentId1')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "Delinea Secret Server data connector with template", - "displayName": "Delinea Secret Server template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Delinea Secret Server data connector with template version 2.0.1", + "description": "Delinea Secret Server data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -99,7 +95,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId1')]", - "title": "Delinea Secret Server", + "title": "[Deprecated] Delinea Secret Server via Legacy Agent", "publisher": "Delinea, Inc", "descriptionMarkdown": "Common Event Format (CEF) from Delinea Secret Server ", "graphQueries": [ @@ -225,7 +221,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -248,12 +244,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "[Deprecated] Delinea Secret Server via Legacy Agent", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -287,7 +294,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Delinea Secret Server", + "title": "[Deprecated] Delinea Secret Server via Legacy Agent", "publisher": "Delinea, Inc", "descriptionMarkdown": "Common Event Format (CEF) from Delinea Secret Server ", "graphQueries": [ @@ -413,33 +420,344 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('workbookTemplateSpecName1')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName2')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Delinea Secret Server data connector with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion2')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId2')]", + "title": "[Recommended] Delinea Secret Server via AMA", + "publisher": "Delinea, Inc", + "descriptionMarkdown": "Common Event Format (CEF) from Delinea Secret Server ", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "CommonSecurityLog(DelineaSecretServer)", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Delinea Software' or DeviceVendor =~ 'Thycotic Software' \n |where DeviceProduct =~ 'Secret Server'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description": "Get records create new secret", + "query": "CommonSecurityLog\n| where DeviceVendor == \"Delinea Software\" or DeviceVendor == \"Thycotic Software\"\n| where DeviceProduct == \"Secret Server\"\n| where Activity has \"SECRET - CREATE\"" + }, + { + "description": "Get records where view secret", + "query": "CommonSecurityLog\n| where DeviceVendor == \"Delinea Software\" or DeviceVendor == \"Thycotic Software\"\n| where DeviceProduct == \"Secret Server\"\n| where Activity has \"SECRET - VIEW\"" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog(DelineaSecretServer)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Delinea Software' or DeviceVendor =~ 'Thycotic Software' \n |where DeviceProduct =~ 'Secret Server'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Delinea Software' or DeviceVendor =~ 'Thycotic Software' \n |where DeviceProduct =~ 'Secret Server'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "Delinea Secret Server", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Delinea" + }, + "support": { + "name": "Delinea", + "tier": "Partner", + "link": "https://delinea.com/support/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId2')]", + "contentKind": "DataConnector", + "displayName": "[Recommended] Delinea Secret Server via AMA", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", + "version": "[variables('dataConnectorVersion2')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId2')]" + ], "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "properties": { - "description": "Delinea Secret Server Workbook with template", - "displayName": "Delinea Secret Server workbook template" + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "Delinea Secret Server", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Delinea" + }, + "support": { + "name": "Delinea", + "tier": "Partner", + "link": "https://delinea.com/support/" + } } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "[Recommended] Delinea Secret Server via AMA", + "publisher": "Delinea, Inc", + "descriptionMarkdown": "Common Event Format (CEF) from Delinea Secret Server ", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "CommonSecurityLog(DelineaSecretServer)", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Delinea Software' or DeviceVendor =~ 'Thycotic Software' \n |where DeviceProduct =~ 'Secret Server'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog(DelineaSecretServer)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Delinea Software' or DeviceVendor =~ 'Thycotic Software' \n |where DeviceProduct =~ 'Secret Server'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Delinea Software' or DeviceVendor =~ 'Thycotic Software' \n |where DeviceProduct =~ 'Secret Server'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Get records create new secret", + "query": "CommonSecurityLog\n| where DeviceVendor == \"Delinea Software\" or DeviceVendor == \"Thycotic Software\"\n| where DeviceProduct == \"Secret Server\"\n| where Activity has \"SECRET - CREATE\"" + }, + { + "description": "Get records where view secret", + "query": "CommonSecurityLog\n| where DeviceVendor == \"Delinea Software\" or DeviceVendor == \"Thycotic Software\"\n| where DeviceProduct == \"Secret Server\"\n| where Activity has \"SECRET - VIEW\"" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ], + "id": "[variables('_uiConfigId2')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaWorkbookWorkbook Workbook with template version 2.0.1", + "description": "DelineaWorkbookWorkbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -457,7 +775,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Delinea Workbook\\n\"},\"name\":\"text - 2\",\"styleSettings\":{\"margin\":\"1\",\"padding\":\"1\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"d273a798-8340-441a-9289-d1a79c87ed0c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timespan\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":43200000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":1,\"content\":{\"json\":\"Most usage operations for SecretServer\"},\"name\":\"text - 9\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"cellValue\":\"page\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"FileType != \\\"test event\\\"\",\"style\":\"primary\"},{\"cellValue\":\"page\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Secret\",\"subTarget\":\"FileType == \\\"Secret\\\"\",\"style\":\"primary\"},{\"cellValue\":\"page\",\"linkTarget\":\"parameter\",\"linkLabel\":\"User\",\"subTarget\":\"FileType == \\\"User\\\"\",\"style\":\"primary\"},{\"cellValue\":\"page\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Folder\",\"subTarget\":\"FileType == \\\"Folder\\\"\",\"style\":\"secondary\"}]},\"name\":\"links - 3\",\"styleSettings\":{\"margin\":\"0px\",\"padding\":\"0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where DeviceVendor == \\\"Delinea Software\\\" | where DeviceProduct == \\\"Secret Server\\\" | where LogSeverity == 2 \\n| where {page:query}\\n| where TimeGenerated {Timespan:query}\\n| summarize countRecord = count(), lastDate = arg_max(TimeGenerated, *) by FileName\\n| order by countRecord\\n| take 10\\n| project FileType, Activity, SecretName=FileName, countRecord, lastDate \",\"size\":2,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"FileType\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"countRecord\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"FileType\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"countRecord\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"nodeIdField\":\"countRecord\",\"sourceIdField\":\"Activity\",\"targetIdField\":\"FileType\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"hivesMargin\":5}},\"name\":\"query - 3\"},{\"type\":1,\"content\":{\"json\":\"## Expiring Secrets\"},\"name\":\"text - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Delinea Software\\\" \\r\\n| where DeviceProduct == \\\"Secret Server\\\" \\r\\n| where LogSeverity == 2 \\r\\n| where TimeGenerated > ago(1d)\\r\\n| summarize count() by Activity\\r\\n| where extract(\\\"EXPIRE[S|D](\\\\\\\\d+)DAY\\\\\\\\w?\\\", 1, Activity) != \\\"\\\"\\r\\n| project extract(\\\"EXPIRE[S|D](\\\\\\\\d+)DAY\\\\\\\\w?\\\", 1, Activity), count_\\r\\n| order by count_ asc \",\"size\":0,\"noDataMessage\":\"Secrets that will soon expire are not found\",\"noDataMessageStyle\":3,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"03\",\"label\":\"Expiring in 3 days\",\"comment\":\"Expire to 3 days\"},{\"seriesName\":\"07\",\"label\":\"Expiring in 7 days\",\"comment\":\"Expire to 7 days\"},{\"seriesName\":\"15\",\"label\":\"Expiring in 15 days\",\"comment\":\"Expire to 15 days\"},{\"seriesName\":\"30\",\"label\":\"Expiring in 30 days\"},{\"seriesName\":\"01\",\"label\":\"Expiring in 1 day\"}],\"ySettings\":{\"numberFormatSettings\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"name\":\"query - 4\"},{\"type\":1,\"content\":{\"json\":\"### Expiring Today\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Delinea Software\\\"\\n| where DeviceProduct == \\\"Secret Server\\\"\\n| where LogSeverity == 2 \\r\\n| where TimeGenerated > ago(1d)\\r\\n| summarize count() by Activity\\r\\n| where Activity == \\\"SECRET - EXPIREDTODAY\\\"\\r\\n| project count_\\r\\n| order by count_ asc \",\"size\":0,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"FileName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Delinea Software\\\"\\n| where DeviceProduct == \\\"Secret Server\\\"\\n| where LogSeverity == 2 \\r\\n| where TimeGenerated > ago(1d)\\r\\n| summarize count() by Activity, FileName\\r\\n| where Activity == \\\"SECRET - EXPIREDTODAY\\\"\\r\\n| project FileName\",\"size\":0,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileName\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"150px\"}}],\"labelSettings\":[{\"columnId\":\"FileName\",\"label\":\"Secret Name\"}]}},\"name\":\"query - 8\"}],\"fallbackResourceIds\":[\"\"],\"fromTemplateId\":\"sentinel-Delinea\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Delinea Workbook\\n\"},\"name\":\"text - 2\",\"styleSettings\":{\"margin\":\"1\",\"padding\":\"1\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"d273a798-8340-441a-9289-d1a79c87ed0c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timespan\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":43200000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":1,\"content\":{\"json\":\"Most usage operations for SecretServer\"},\"name\":\"text - 9\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"cellValue\":\"page\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"FileType != \\\"test event\\\"\",\"style\":\"primary\"},{\"cellValue\":\"page\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Secret\",\"subTarget\":\"FileType == \\\"Secret\\\"\",\"style\":\"primary\"},{\"cellValue\":\"page\",\"linkTarget\":\"parameter\",\"linkLabel\":\"User\",\"subTarget\":\"FileType == \\\"User\\\"\",\"style\":\"primary\"},{\"cellValue\":\"page\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Folder\",\"subTarget\":\"FileType == \\\"Folder\\\"\",\"style\":\"secondary\"}]},\"name\":\"links - 3\",\"styleSettings\":{\"margin\":\"0px\",\"padding\":\"0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where DeviceVendor == \\\"Delinea Software\\\" or DeviceVendor == \\\"Thycotic Software\\\" | where DeviceProduct == \\\"Secret Server\\\" | where LogSeverity == 2 \\n| where {page:query}\\n| where TimeGenerated {Timespan:query}\\n| summarize countRecord = count(), lastDate = arg_max(TimeGenerated, *) by FileName\\n| order by countRecord\\n| take 10\\n| project FileType, Activity, SecretName=FileName, countRecord, lastDate \",\"size\":2,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"FileType\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"countRecord\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"FileType\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"countRecord\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"nodeIdField\":\"countRecord\",\"sourceIdField\":\"Activity\",\"targetIdField\":\"FileType\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"nodeSize\":\"\",\"staticNodeSize\":100,\"colorSettings\":\"\",\"hivesMargin\":5}},\"name\":\"query - 3\"},{\"type\":1,\"content\":{\"json\":\"## Expiring Secrets\"},\"name\":\"text - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Delinea Software\\\" or DeviceVendor == \\\"Thycotic Software\\\" \\r\\n| where DeviceProduct == \\\"Secret Server\\\" \\r\\n| where LogSeverity == 2 \\r\\n| where TimeGenerated > ago(1d)\\r\\n| summarize count() by Activity\\r\\n| where extract(\\\"EXPIRE[S|D](\\\\\\\\d+)DAY\\\\\\\\w?\\\", 1, Activity) != \\\"\\\"\\r\\n| project extract(\\\"EXPIRE[S|D](\\\\\\\\d+)DAY\\\\\\\\w?\\\", 1, Activity), count_\\r\\n| order by count_ asc \",\"size\":0,\"noDataMessage\":\"Secrets that will soon expire are not found\",\"noDataMessageStyle\":3,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"03\",\"label\":\"Expiring in 3 days\",\"comment\":\"Expire to 3 days\"},{\"seriesName\":\"07\",\"label\":\"Expiring in 7 days\",\"comment\":\"Expire to 7 days\"},{\"seriesName\":\"15\",\"label\":\"Expiring in 15 days\",\"comment\":\"Expire to 15 days\"},{\"seriesName\":\"30\",\"label\":\"Expiring in 30 days\"},{\"seriesName\":\"01\",\"label\":\"Expiring in 1 day\"}],\"ySettings\":{\"numberFormatSettings\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"name\":\"query - 4\"},{\"type\":1,\"content\":{\"json\":\"### Expiring Today\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Delinea Software\\\" or DeviceVendor == \\\"Thycotic Software\\\"\\n| where DeviceProduct == \\\"Secret Server\\\"\\n| where LogSeverity == 2 \\r\\n| where TimeGenerated > ago(1d)\\r\\n| summarize count() by Activity\\r\\n| where Activity == \\\"SECRET - EXPIREDTODAY\\\"\\r\\n| project count_\\r\\n| order by count_ asc \",\"size\":0,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"FileName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Delinea Software\\\" or DeviceVendor == \\\"Thycotic Software\\\"\\n| where DeviceProduct == \\\"Secret Server\\\"\\n| where LogSeverity == 2 \\r\\n| where TimeGenerated > ago(1d)\\r\\n| summarize count() by Activity, FileName\\r\\n| where Activity == \\\"SECRET - EXPIREDTODAY\\\"\\r\\n| project FileName\",\"size\":0,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileName\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"150px\"}}],\"labelSettings\":[{\"columnId\":\"FileName\",\"label\":\"Secret Name\"}]}},\"name\":\"query - 8\"}],\"fallbackResourceIds\":[\"\"],\"fromTemplateId\":\"sentinel-Delinea\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -485,21 +803,56 @@ "name": "Delinea", "tier": "Partner", "link": "https://delinea.com/support/" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "CommonSecurityLog", + "kind": "DataType" + }, + { + "contentId": "DelineaSecretServer_CEF", + "kind": "DataConnector" + }, + { + "contentId": "DelineaSecretServerAma", + "kind": "DataConnector" + } + ] } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.1", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "Delinea Secret Server", + "publisherDisplayName": "Delinea", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Delinea Secret Server Microsoft Sentinel Data Solution enables delivery of Delinea Secret Server log messages to your Microsoft Sentinel Workspace.

\n
    \n

  1. Delinea Secret Server via AMA - This data connector helps in ingesting Delinea Secret Server logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. Delinea Secret Server via Legacy Agent - This data connector helps in ingesting Delinea Secret Server logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends installation of Delinea Secret Server via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 2, Workbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { @@ -523,6 +876,11 @@ "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId2')]", + "version": "[variables('dataConnectorVersion2')]" + }, { "kind": "Workbook", "contentId": "[variables('_workbookContentId1')]", diff --git a/Solutions/Delinea Secret Server/ReleaseNotes.md b/Solutions/Delinea Secret Server/ReleaseNotes.md new file mode 100644 index 00000000000..f22e302d377 --- /dev/null +++ b/Solutions/Delinea Secret Server/ReleaseNotes.md @@ -0,0 +1,5 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------| +| 3.0.0 | 20-09-2023 | Addition of new Delinea Secret Server AMA **Data Connector** | | + + diff --git a/Solutions/GitHub/Package/3.0.1.zip b/Solutions/GitHub/Package/3.0.1.zip new file mode 100644 index 00000000000..2230c296c19 Binary files /dev/null and b/Solutions/GitHub/Package/3.0.1.zip differ diff --git a/Solutions/GitHub/Package/createUiDefinition.json b/Solutions/GitHub/Package/createUiDefinition.json index 087466ebdc1..0926637032f 100644 --- a/Solutions/GitHub/Package/createUiDefinition.json +++ b/Solutions/GitHub/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution.\n\nThe [GitHub](https://github.com/) Solution for Microsoft Sentinel enables you to easily ingest events and logs from GitHub to Microsoft Sentinel using GitHub audit log API and webhooks. This enables you to view and analyze this data in your workbooks, query it to create custom alerts, and incorporate it to improve your investigation process, giving you more insight into your platform security.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n \r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n 1. [Codeless Connector Platform (CCP) (used in GitHub Enterprise Audit Log data connector)](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal) \r\n \r\n 2. [Azure Functions ](https://azure.microsoft.com/services/functions/#overview)\n\n**Data Connectors:** 2, **Parsers:** 4, **Workbooks:** 2, **Analytic Rules:** 14, **Hunting Queries:** 8\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [GitHub](https://github.com/) Solution for Microsoft Sentinel enables you to easily ingest events and logs from GitHub to Microsoft Sentinel using GitHub audit log API and webhooks. This enables you to view and analyze this data in your workbooks, query it to create custom alerts, and incorporate it to improve your investigation process, giving you more insight into your platform security.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n \r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n 1. [Codeless Connector Platform (CCP) (used in GitHub Enterprise Audit Log data connector)](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal) \r\n \r\n 2. [Azure Functions ](https://azure.microsoft.com/services/functions/#overview)\n\n**Data Connectors:** 2, **Parsers:** 4, **Workbooks:** 2, **Analytic Rules:** 14, **Hunting Queries:** 8\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/GitHub/Package/mainTemplate.json b/Solutions/GitHub/Package/mainTemplate.json index 8ed3db5a20a..ce71a7c5572 100644 --- a/Solutions/GitHub/Package/mainTemplate.json +++ b/Solutions/GitHub/Package/mainTemplate.json @@ -49,20 +49,20 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "GitHub", - "_solutionVersion": "3.0.0", + "_solutionVersion": "3.0.1", "solutionId": "microsoftcorporation1622712991604.sentinel4github", "_solutionId": "[variables('solutionId')]", "workbookVersion1": "1.0.0", "workbookContentId1": "UserWorkbook-alexdemichieli-github-update-1", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))),variables('workbookVersion1')))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", "workbookVersion2": "1.0.0", "workbookContentId2": "GitHubSecurityWorkbook", "workbookId2": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId2'))]", - "workbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId2'))),variables('workbookVersion2')))]", + "workbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId2'))))]", "_workbookContentId2": "[variables('workbookContentId2')]", "_workbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId2'),'-', variables('workbookVersion2'))))]", "analyticRuleVersion1": "1.0.0", @@ -70,139 +70,139 @@ "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", "TemplateEmptyArray": "[json('[]')]", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))),variables('analyticRuleVersion1')))]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))))]", "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId1'),'-', variables('analyticRuleVersion1'))))]", "analyticRuleVersion2": "1.0.0", "analyticRulecontentId2": "f041e01d-840d-43da-95c8-4188f6cef546", "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", - "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2'))),variables('analyticRuleVersion2')))]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2'))))]", "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId2'),'-', variables('analyticRuleVersion2'))))]", "analyticRuleVersion3": "1.0.0", "analyticRulecontentId3": "0b85a077-8ba5-4cb5-90f7-1e882afe10c5", "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", - "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3'))),variables('analyticRuleVersion3')))]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3'))))]", "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId3'),'-', variables('analyticRuleVersion3'))))]", "analyticRuleVersion4": "1.0.0", "analyticRulecontentId4": "0b85a077-8ba5-4cb5-90f7-1e882afe10c2", "_analyticRulecontentId4": "[variables('analyticRulecontentId4')]", "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId4'))]", - "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId4'))),variables('analyticRuleVersion4')))]", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId4'))))]", "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId4'),'-', variables('analyticRuleVersion4'))))]", "analyticRuleVersion5": "1.0.0", "analyticRulecontentId5": "0b85a077-8ba5-4cb5-90f7-1e882afe10c3", "_analyticRulecontentId5": "[variables('analyticRulecontentId5')]", "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId5'))]", - "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId5'))),variables('analyticRuleVersion5')))]", + "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId5'))))]", "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId5'),'-', variables('analyticRuleVersion5'))))]", "analyticRuleVersion6": "1.0.1", "analyticRulecontentId6": "3ff0fffb-d963-40c0-b235-3404f915add7", "_analyticRulecontentId6": "[variables('analyticRulecontentId6')]", "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId6'))]", - "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId6'))),variables('analyticRuleVersion6')))]", + "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId6'))))]", "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId6'),'-', variables('analyticRuleVersion6'))))]", "analyticRuleVersion7": "1.0.0", "analyticRulecontentId7": "0b85a077-8ba5-4cb5-90f7-1e882afe20c9", "_analyticRulecontentId7": "[variables('analyticRulecontentId7')]", "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId7'))]", - "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId7'))),variables('analyticRuleVersion7')))]", + "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId7'))))]", "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId7'),'-', variables('analyticRuleVersion7'))))]", "analyticRuleVersion8": "1.0.0", "analyticRulecontentId8": "0b85a077-8ba5-4cb5-90f7-1e882afe10c4", "_analyticRulecontentId8": "[variables('analyticRulecontentId8')]", "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId8'))]", - "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId8'))),variables('analyticRuleVersion8')))]", + "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId8'))))]", "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId8'),'-', variables('analyticRuleVersion8'))))]", "analyticRuleVersion9": "1.0.0", "analyticRulecontentId9": "0b85a077-8ba5-4cb5-90f7-1e882afe10c8", "_analyticRulecontentId9": "[variables('analyticRulecontentId9')]", "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId9'))]", - "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId9'))),variables('analyticRuleVersion9')))]", + "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId9'))))]", "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId9'),'-', variables('analyticRuleVersion9'))))]", "analyticRuleVersion10": "1.0.0", "analyticRulecontentId10": "0b85a077-8ba5-4cb5-90f7-1e882afe40c9", "_analyticRulecontentId10": "[variables('analyticRulecontentId10')]", "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId10'))]", - "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId10'))),variables('analyticRuleVersion10')))]", + "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId10'))))]", "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId10'),'-', variables('analyticRuleVersion10'))))]", "analyticRuleVersion11": "1.0.0", "analyticRulecontentId11": "0b85a077-8ba5-4cb5-90f7-1e882afe10c7", "_analyticRulecontentId11": "[variables('analyticRulecontentId11')]", "analyticRuleId11": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId11'))]", - "analyticRuleTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId11'))),variables('analyticRuleVersion11')))]", + "analyticRuleTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId11'))))]", "_analyticRulecontentProductId11": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId11'),'-', variables('analyticRuleVersion11'))))]", "analyticRuleVersion12": "1.0.0", "analyticRulecontentId12": "0b85a077-8ba5-4cb5-90f7-1e882afe10c6", "_analyticRulecontentId12": "[variables('analyticRulecontentId12')]", "analyticRuleId12": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId12'))]", - "analyticRuleTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId12'))),variables('analyticRuleVersion12')))]", + "analyticRuleTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId12'))))]", "_analyticRulecontentProductId12": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId12'),'-', variables('analyticRuleVersion12'))))]", "analyticRuleVersion13": "1.0.1", "analyticRulecontentId13": "594c653d-719a-4c23-b028-36e3413e632e", "_analyticRulecontentId13": "[variables('analyticRulecontentId13')]", "analyticRuleId13": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId13'))]", - "analyticRuleTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId13'))),variables('analyticRuleVersion13')))]", + "analyticRuleTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId13'))))]", "_analyticRulecontentProductId13": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId13'),'-', variables('analyticRuleVersion13'))))]", "analyticRuleVersion14": "1.0.1", "analyticRulecontentId14": "5436f471-b03d-41cb-b333-65891f887c43", "_analyticRulecontentId14": "[variables('analyticRulecontentId14')]", "analyticRuleId14": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId14'))]", - "analyticRuleTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId14'))),variables('analyticRuleVersion14')))]", + "analyticRuleTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId14'))))]", "_analyticRulecontentProductId14": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId14'),'-', variables('analyticRuleVersion14'))))]", "huntingQueryVersion1": "1.0.0", "huntingQuerycontentId1": "f0d30d3c-e6ad-480a-90e8-1bd7cc84881b", "_huntingQuerycontentId1": "[variables('huntingQuerycontentId1')]", "huntingQueryId1": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId1'))]", - "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId1'))),variables('huntingQueryVersion1')))]", + "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId1'))))]", "_huntingQuerycontentProductId1": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId1'),'-', variables('huntingQueryVersion1'))))]", "huntingQueryVersion2": "1.0.0", "huntingQuerycontentId2": "b8508e24-47a6-4f8e-9066-3cc937197e7f", "_huntingQuerycontentId2": "[variables('huntingQuerycontentId2')]", "huntingQueryId2": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId2'))]", - "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId2'))),variables('huntingQueryVersion2')))]", + "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId2'))))]", "_huntingQuerycontentProductId2": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId2'),'-', variables('huntingQueryVersion2'))))]", "huntingQueryVersion3": "1.0.0", "huntingQuerycontentId3": "67da5c4e-49f2-476d-96ff-2dbe4b855a48", "_huntingQuerycontentId3": "[variables('huntingQuerycontentId3')]", "huntingQueryId3": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId3'))]", - "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId3'))),variables('huntingQueryVersion3')))]", + "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId3'))))]", "_huntingQuerycontentProductId3": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId3'),'-', variables('huntingQueryVersion3'))))]", "huntingQueryVersion4": "1.0.0", "huntingQuerycontentId4": "667e6a70-adc9-49b7-9cf3-f21927c71959", "_huntingQuerycontentId4": "[variables('huntingQuerycontentId4')]", "huntingQueryId4": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId4'))]", - "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId4'))),variables('huntingQueryVersion4')))]", + "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId4'))))]", "_huntingQuerycontentProductId4": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId4'),'-', variables('huntingQueryVersion4'))))]", "huntingQueryVersion5": "1.0.0", "huntingQuerycontentId5": "ec986fb7-34ed-4528-a5f3-a496e61d8860", "_huntingQuerycontentId5": "[variables('huntingQuerycontentId5')]", "huntingQueryId5": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId5'))]", - "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId5'))),variables('huntingQueryVersion5')))]", + "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId5'))))]", "_huntingQuerycontentProductId5": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId5'),'-', variables('huntingQueryVersion5'))))]", "huntingQueryVersion6": "1.0.0", "huntingQuerycontentId6": "a6e2afd3-559c-4e88-a693-39c1f6789ef1", "_huntingQuerycontentId6": "[variables('huntingQuerycontentId6')]", "huntingQueryId6": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId6'))]", - "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId6'))),variables('huntingQueryVersion6')))]", + "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId6'))))]", "_huntingQuerycontentProductId6": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId6'),'-', variables('huntingQueryVersion6'))))]", "huntingQueryVersion7": "1.0.0", "huntingQuerycontentId7": "c3237d88-fdc4-4dee-8b90-118ded2c507c", "_huntingQuerycontentId7": "[variables('huntingQuerycontentId7')]", "huntingQueryId7": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId7'))]", - "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId7'))),variables('huntingQueryVersion7')))]", + "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId7'))))]", "_huntingQuerycontentProductId7": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId7'),'-', variables('huntingQueryVersion7'))))]", "huntingQueryVersion8": "1.0.0", "huntingQuerycontentId8": "f18c4dfb-4fa6-4a9d-9bd3-f7569d1d685a", "_huntingQuerycontentId8": "[variables('huntingQuerycontentId8')]", "huntingQueryId8": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId8'))]", - "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId8'))),variables('huntingQueryVersion8')))]", + "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId8'))))]", "_huntingQuerycontentProductId8": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId8'),'-', variables('huntingQueryVersion8'))))]", "parserName1": "GitHubAuditData", "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))),variables('parserVersion1')))]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", "parserVersion1": "1.0.0", "parserContentId1": "GitHubAuditData-Parser", "_parserContentId1": "[variables('parserContentId1')]", @@ -211,7 +211,7 @@ "_parserName2": "[concat(parameters('workspace'),'/',variables('parserName2'))]", "parserId2": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName2'))]", "_parserId2": "[variables('parserId2')]", - "parserTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId2'))),variables('parserVersion2')))]", + "parserTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId2'))))]", "parserVersion2": "1.0.0", "parserContentId2": "GitHubCodeScanningData-Parser", "_parserContentId2": "[variables('parserContentId2')]", @@ -220,7 +220,7 @@ "_parserName3": "[concat(parameters('workspace'),'/',variables('parserName3'))]", "parserId3": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName3'))]", "_parserId3": "[variables('parserId3')]", - "parserTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId3'))),variables('parserVersion3')))]", + "parserTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId3'))))]", "parserVersion3": "1.0.0", "parserContentId3": "GitHubDependabotData-Parser", "_parserContentId3": "[variables('parserContentId3')]", @@ -229,7 +229,7 @@ "_parserName4": "[concat(parameters('workspace'),'/',variables('parserName4'))]", "parserId4": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName4'))]", "_parserId4": "[variables('parserId4')]", - "parserTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId4'))),variables('parserVersion4')))]", + "parserTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId4'))))]", "parserVersion4": "1.0.0", "parserContentId4": "GithubSecretScanningData-Parser", "_parserContentId4": "[variables('parserContentId4')]", @@ -240,7 +240,7 @@ "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))),variables('dataConnectorVersion1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", "uiConfigId2": "GitHubWebhook", @@ -249,7 +249,7 @@ "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", "_dataConnectorId2": "[variables('dataConnectorId2')]", - "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))),variables('dataConnectorVersion2')))]", + "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", "dataConnectorVersion2": "1.0.0", "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" @@ -264,7 +264,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHubAdvancedSecurityWorkbook Workbook with template version 3.0.0", + "description": "GitHubAdvancedSecurityWorkbook Workbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -352,7 +352,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHubWorkbookWorkbook Workbook with template version 3.0.0", + "description": "GitHubWorkbookWorkbook Workbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -370,7 +370,7 @@ }, "properties": { "displayName": "[parameters('workbook2-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## GitHub Audit Log\\n\"},\"customWidth\":\"10\",\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9c6caa2f-88f7-4472-b6cf-789023c368de\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":900000},{\"durationMs\":3600000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":7776000000}},{\"id\":\"ee9cafd5-814c-4ad7-9958-2542da484a29\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Repositories\",\"type\":5,\"description\":\"Filter for events that include specific repository values\",\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"GitHubAuditLogPolling_CL\\n| extend repository = repo_s\\n| distinct tostring(repository)\\n| where isnotempty(repository)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"357ea458-5943-4bbf-a429-13bccf9a7a62\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Actors\",\"type\":5,\"description\":\"Filter for events that include a specific Actor\",\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"GitHubAuditLogPolling_CL\\n| extend actor = actor_s\\n| distinct tostring(actor)\\n| where isnotempty(actor)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"90\",\"name\":\"parameters - 7\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"c6cb9ad8-00ac-45db-acc7-d8416ef91c1b\",\"cellValue\":\"SelectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Recent Events\",\"subTarget\":\"Recent Events\",\"style\":\"link\"},{\"id\":\"16b6c7a2-8607-4715-959e-c054c366e22c\",\"cellValue\":\"SelectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Top 10 Offenders\",\"subTarget\":\"Top 10 Offenders\",\"style\":\"link\"}]},\"name\":\"links - 6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Compliance\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditData \\r\\n| where Action == \\\"repo.access\\\" and Visibility == \\\"public\\\"\\r\\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\\r\\n| sort by TimeGenerated desc\\r\\n| project Time=TimeGenerated, Repository, Actor\",\"size\":0,\"title\":\"Private Repos made Public\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"33\",\"name\":\"privatereposmadepublic\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditData \\n| where Action == \\\"protected_branch.policy_override\\\"\\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\\n| sort by TimeGenerated desc\\n| project Time=TimeGenerated, Repository, Actor\",\"size\":0,\"title\":\"Branch Protection - Bypass\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"34\",\"name\":\"query - 6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditData\\n| where Action == \\\"secret_scanning_push_protection.bypass\\\"\\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\\n| sort by TimeGenerated desc\\n| project Time=TimeGenerated, Repository, Actor\",\"size\":0,\"title\":\"Push Protection - Bypass\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"33\",\"name\":\"query - 7\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"SelectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Recent Events\"},\"name\":\"group - 10\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Access\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditData \\n| where Action == \\\"org.add_member\\\" or Action == \\\"org.remove_member\\\"\\n| where Actor in ({Actors}) // parameter filter\\n| extend Action = iif(Action==\\\"org.add_member\\\", \\\"Added\\\", \\\"Removed\\\")\\n| sort by TimeGenerated desc\\n| project Time=TimeGenerated, Actor, Action, User=ImpactedUser, Organization\",\"size\":1,\"title\":\"Members Added or Removed\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"membersaddedorremoved\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditData \\r\\n| where Action == \\\"team.add_repository\\\" or Action == \\\"team.remove_repository\\\"\\r\\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\\r\\n| extend Action = iif(Action==\\\"team.add_repository\\\", \\\"Added\\\", \\\"Removed\\\")\\r\\n| sort by TimeGenerated desc\\r\\n| project Time=TimeGenerated, Actor, Action, Permission=InvitedUserPermission, Team=TeamName, Repository\",\"size\":0,\"title\":\"Teams Added/Removed Repository\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"teamsaddedremovedtorepository\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"SelectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Recent Events\"},\"name\":\"group - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Repositories\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditData \\r\\n| where Action == \\\"repo.create\\\"\\r\\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\\r\\n| sort by TimeGenerated desc\\r\\n| project Time=TimeGenerated, Repository, Actor, Visibility\",\"size\":0,\"title\":\"Created\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"repositoriescreated\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditData \\n| where Action == \\\"repo.transfer_outgoing\\\"\\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\\n| sort by TimeGenerated desc\\n| project Time=TimeGenerated, Repository, Actor, Visibility\",\"size\":0,\"title\":\"Ownership Transferred\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditData \\n| where Action == \\\"repo.archived\\\"\\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\\n| sort by TimeGenerated desc\\n| project Time=TimeGenerated, Repository, Actor, Visibility\",\"size\":0,\"title\":\"Archived\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 9\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditData \\n| where Action == \\\"repo.destroy\\\"\\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\\n| sort by TimeGenerated desc\\n| project Time=TimeGenerated, Repository, Actor, Visibility\",\"size\":0,\"title\":\"Deleted\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"SelectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Recent Events\"},\"name\":\"group - 7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top 10 Offenders\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditData\\n| where Action == \\\"repo.access\\\" and Visibility == \\\"public\\\"\\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\\n| summarize [\\\"Number of Bypasses\\\"] = count() by Actor\\n| top 10 by ['Number of Bypasses'] desc\\n| project-reorder ['Number of Bypasses'], Actor\",\"size\":0,\"title\":\"Private Repos made Public by Actor\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"33\",\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditData\\n| where Action == \\\"protected_branch.policy_override\\\"\\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\\n| summarize [\\\"Number of Bypasses\\\"] = count() by Actor\\n| top 10 by ['Number of Bypasses'] desc\\n| project-reorder ['Number of Bypasses'], Actor\",\"size\":0,\"title\":\"Branch Protection - Bypass by Actor\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"34\",\"name\":\"query - 2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditData\\n| where Action == \\\"secret_scanning_push_protection.bypass\\\"\\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\\n| summarize [\\\"Number of Bypasses\\\"] = count() by Actor\\n| top 10 by ['Number of Bypasses'] desc\\n| project-reorder ['Number of Bypasses'], Actor\",\"size\":1,\"title\":\"Push Protection - Bypass by Actor\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"33\",\"name\":\"query - 5\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"SelectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Top 10 Offenders\"},\"name\":\"group - 7\",\"styleSettings\":{\"showBorder\":true}}],\"fromTemplateId\":\"sentinel-GitHubSecurity\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"Topics and repository filters are mutually exlusive. To filter for topics, deselect all repositories and vice versa\",\"style\":\"warning\"},\"name\":\"text - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"f80bd5e4-0e9d-4dc7-b999-110328e5b08e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"isGlobal\":true,\"value\":{\"durationMs\":2592000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"87b3e22f-fc5b-4c56-a449-372be28ec152\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Orgs\",\"type\":5,\"description\":\"Org selector\",\"isRequired\":true,\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"githubscanaudit_CL \\n| extend organization = todynamic(organization_s).login\\n| distinct tostring(organization)\\n| where isnotempty(organization)\\n\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"dsp-testing\"]},{\"id\":\"1673856e-da45-4e3b-8c00-9790024bea39\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Repositories\",\"type\":5,\"description\":\"Repository selector\",\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"githubscanaudit_CL \\n| extend repository = todynamic(repository_s).full_name\\n| extend organization = todynamic(organization_s).login\\n| where isnotempty(repository) and tostring(organization) in ({Orgs})\\n| distinct tostring(repository)\\n\\n\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"\",\"showDefault\":false},\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"10bfa980-1673-4a8c-9d59-fe12a24e297c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Topics\",\"type\":5,\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let selection = dynamic([{Repositories}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend topics = repository.topics\\n| extend org = todynamic(organization_s)\\n| extend orgName = org.login\\n| extend reposAreNotSelected = array_length((selection)) == 0\\n| where topics <> \\\"[]\\\" and orgName in ({Orgs}) //and reposAreNotSelected\\n| mv-expand topics\\n| distinct tostring(topics)\\n| project topics\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 5\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"b7b61394-d7c7-4a2a-9e90-5d17ce94f8d8\",\"cellValue\":\"SelectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Advanced Security Overview\",\"subTarget\":\"Advanced Security Overview\",\"style\":\"link\"},{\"id\":\"7b984311-578d-4162-8e03-1c82cfa37519\",\"cellValue\":\"SelectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Code Scanning Alerts\",\"subTarget\":\"Code Scanning Alerts\",\"style\":\"link\"},{\"id\":\"03316284-9c39-4d15-853b-568d16d264f5\",\"cellValue\":\"SelectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Secret Scanning Alerts\",\"subTarget\":\"Secret Scanning Alerts\",\"style\":\"link\"},{\"id\":\"8853be7b-58d0-45cc-89c3-1a9897f01b19\",\"cellValue\":\"SelectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Dependabot Alerts\",\"subTarget\":\"Dependabot Alerts\",\"style\":\"link\"}]},\"customWidth\":\"50\",\"name\":\"links - 5\",\"styleSettings\":{\"margin\":\"0px\",\"padding\":\"0px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"

Advanced Security Overview

\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\nlet RepositoryVulnerabilityAlerts = githubscanaudit_CL \\n| extend EventType='Dependabot Alert'\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s) \\n| extend alertexternalidentifier= alert.external_identifier\\n| extend Severity = tostring(alert.severity)\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('create') and isnotempty(alertexternalidentifier)\\n| project EventType, Severity, orgFullName;\\n\\nlet CodeScanningAlerts = githubscanaudit_CL \\n| extend EventType='Code Scanning Alert'\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend Severity = tostring(alert.rule.security_severity_level)\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created') and isnotempty(commit_oid_s) and isnotempty(Severity) \\n| project EventType, Severity, orgFullName, repositoryfullname;\\n\\nlet SecretScanningAlerts = githubscanaudit_CL \\n| extend EventType='Secret Scanning Alert'\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend alertSecretType = alert.secret_type\\n| extend Severity = \\\"high\\\"\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created') and isnotempty(alertSecretType)\\n| project EventType, Severity, orgFullName, repositoryfullname;\\n union withsource=\\\"AllEvents\\\" RepositoryVulnerabilityAlerts, CodeScanningAlerts, SecretScanningAlerts\\n| summarize Count = count() by tostring(Severity)\",\"size\":0,\"title\":\"Open Alerts By Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"group\":\"Severity\",\"createOtherGroup\":\"\",\"seriesLabelSettings\":[{\"seriesName\":\"high\",\"label\":\"High\",\"color\":\"redBright\"},{\"seriesName\":\"moderate\",\"label\":\"Moderate\",\"color\":\"orange\"},{\"seriesName\":\"medium\",\"label\":\"Medium\",\"color\":\"brown\"},{\"seriesName\":\"critical\",\"label\":\"Critical\",\"color\":\"redDark\"},{\"seriesName\":\"low\",\"label\":\"Low\",\"color\":\"yellow\"}]}},\"customWidth\":\"25\",\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\nlet RepositoryVulnerabilityAlerts = githubscanaudit_CL \\n| extend EventType='Dependabot Alert'\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend alert = todynamic(alert_s) \\n| extend alertexternalidentifier= alert.external_identifier\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertexternalidentifier) and action_s in ('create');\\n\\nlet CodeScanningAlerts = githubscanaudit_CL \\n| extend EventType='Code Scanning Alert'\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s) \\n| extend Severity = alert.rule.security_severity_level\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created') and isnotempty(commit_oid_s);\\n\\nlet SecretScanningAlerts = githubscanaudit_CL \\n| extend EventType='Secret Scanning Alert'\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s) \\n| extend alertSecretType = alert.secret_type\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertSecretType) and action_s in ('created');\\nunion withsource=\\\"AllEvents\\\" RepositoryVulnerabilityAlerts, CodeScanningAlerts, SecretScanningAlerts\\n|summarize Count = count() by tostring(repositoryfullname)\",\"size\":0,\"title\":\"Open Alerts by Repository\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"repositoryfullname\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"repositoryfullname\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"25\",\"name\":\"query - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\n\\nlet RepositoryVulnerabilityAlerts = githubscanaudit_CL \\n| extend EventType='Dependabot Alert'\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s) \\n| extend alertexternalidentifier= alert.external_identifier\\n| extend Severity = alert.severity\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertexternalidentifier) and action_s in ('create')\\n| project EventType, Severity;\\n\\nlet CodeScanningAlerts = githubscanaudit_CL \\n| extend EventType='Code Scanning Alert'\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend Severity = alert.rule.security_severity_level\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created') and isnotempty(commit_oid_s)\\n| project EventType, Severity;\\n\\nlet SecretScanningAlerts = githubscanaudit_CL \\n| extend EventType='Secret Scanning Alert'\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend alertSecretType = alert.secret_type\\n| extend Severity = \\\"High\\\"\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created') and isnotempty(alertSecretType)\\n| project EventType, Severity;\\nunion withsource=\\\"AllEvents\\\" RepositoryVulnerabilityAlerts, CodeScanningAlerts, SecretScanningAlerts\\n|summarize Count = count() by tostring(EventType)\",\"size\":0,\"title\":\"Open Alerts by Type\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"query - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\n\\nlet RepositoryVulnerabilityAlerts = githubscanaudit_CL \\n| extend EventType='Dependabot Alert'\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s) \\n| extend Repository = repository.full_name \\n| extend alertexternalidentifier= alert.external_identifier\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('dismiss', 'resolve') and isnotempty(alertexternalidentifier);\\n\\nlet CodeScanningAlerts = githubscanaudit_CL \\n| extend EventType='Code Scanning Alert'\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend Repository = repository.full_name \\n| extend Severity = alert.rule.security_severity_level\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('closed_by_user', 'fixed') and isnotempty(commit_oid_s);\\n\\nlet SecretScanningAlerts = githubscanaudit_CL\\n| extend EventType='Secret Scanning Alert'\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend Repository = repository.full_name \\n| extend alertSecretType = alert.secret_type\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('resolved') and isnotempty(alertSecretType);\\nunion withsource=\\\"AllEvents\\\" RepositoryVulnerabilityAlerts, CodeScanningAlerts, SecretScanningAlerts\\n| count\",\"size\":4,\"title\":\"Resolved Alert Count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"25\",\"name\":\"query - 8 - Copy - Copy\",\"styleSettings\":{\"padding\":\"50px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\nlet RepositoryVulnerabilityAlerts = \\ngithubscanaudit_CL \\n| extend EventType='Dependabot Alert'\\n| extend repository = todynamic(repository_s)\\n| extend Repository = repository.full_name \\n| extend alert = todynamic(alert_s) \\n| extend alertexternalidentifier = alert.external_identifier\\n| extend Severity = alert.severity\\n| extend id = alert.ghsa_id \\n| extend Status = action_s\\n| extend Reason = alert.affected_package_name\\n| extend Created_at = alert.created_at\\n| extend Number = alert.number\\n| extend Age = now() - todatetime(Created_at)\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (Repository in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('create', 'dismiss', 'resolve') and isnotempty(alertexternalidentifier)\\n| project Repository, Reason, id, EventType, tostring(Severity), Status, Created_at, Number, format_timespan(Age, 'dd:hh:mm:ss');\\n\\nlet CodeScanningAlerts =\\ngithubscanaudit_CL \\n| extend EventType='Code Scanning Alert'\\n| extend repository = todynamic(repository_s)\\n| extend Repository = repository.full_name \\n| extend alert = todynamic(alert_s)\\n| extend Severity = alert.rule.security_severity_level\\n| extend Reason = alert.rule.name\\n| extend id = alert.rule.id\\n| extend Severity = alert.rule.security_severity_level\\n| extend Status = action_s\\n| extend Created_at = alert.created_at\\n| extend Number = alert.number\\n| extend Age = now() - todatetime(Created_at)\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (Repository in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created', 'reopened_by_user', 'closed_by_user', 'fixed', 'appeared_in_branch', 'reopened') and isnotempty(commit_oid_s) and isnotempty(Severity) \\n| project Repository, Reason, id, EventType, tostring(Severity), Status, Created_at, Number, format_timespan(Age, 'dd:hh:mm:ss');\\n\\nlet SecretScanningAlerts = \\ngithubscanaudit_CL \\n| extend EventType='Secret Scanning Alert'\\n| extend repository = todynamic(repository_s)\\n| extend Repository = repository.full_name \\n| extend alert = todynamic(alert_s)\\n| extend Severity = \\\"high\\\"\\n| extend Reason = alert.secret_type \\n| extend id = alert.number\\n| extend alertSecretType = alert.secret_type\\n| extend Status = action_s\\n| extend Created_at = alert.created_at\\n| extend Number = alert.number\\n| extend Age = now() - todatetime(Created_at)\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (Repository in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created', 'resolved', 'reopened') and isnotempty(alertSecretType)\\n| project Repository, Reason, id, EventType, tostring(Severity), Status, Created_at, Number, format_timespan(Age, 'dd:hh:mm:ss');\\nunion withsource=\\\"AllEvents\\\" RepositoryVulnerabilityAlerts, CodeScanningAlerts, SecretScanningAlerts\",\"size\":0,\"title\":\"Alert Details\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AllEvents\",\"formatter\":5},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"high\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"critical\",\"representation\":\"redDark\"},{\"operator\":\"contains\",\"thresholdValue\":\"moderate\",\"representation\":\"red\"},{\"operator\":\"contains\",\"thresholdValue\":\"medium\",\"representation\":\"orange\"},{\"operator\":\"contains\",\"thresholdValue\":\"low\",\"representation\":\"yellow\"},{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":5000,\"filter\":true}},\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"SelectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Advanced Security Overview\"},\"name\":\"Advanced Security Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"

Code Scanning Alerts

\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend alert = todynamic(alert_s)\\n| extend url = alert.url\\n| extend repo = todynamic(repository_s)\\n| extend repository = repo.name\\n| extend created_at = alert.created_at\\n| extend resolved_at = alert.fixed_at\\n| extend day = todatetime(resolved_at) - todatetime(created_at)\\n| where action_s in ('closed_by_user', 'fixed') and isnotempty(commit_oid_s)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| summarize format_timespan(avg(day), 'dd:hh:mm:ss')\",\"size\":4,\"title\":\"Mean Time to Resolution (dd:hh:mm:ss)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"25\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created') and isnotempty(commit_oid_s)\\n| count\",\"size\":4,\"title\":\"Created\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":5},{\"columnMatch\":\"Count\",\"formatter\":1}],\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Status\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"size\":\"auto\"},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"Count\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"25\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('fixed') and isnotempty(commit_oid_s)\\n| count\",\"size\":4,\"title\":\"Fixed\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":5},{\"columnMatch\":\"Count\",\"formatter\":1}],\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Status\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"size\":\"auto\"},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"Count\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"25\",\"name\":\"query - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('reopened') and isnotempty(commit_oid_s)\\n| count\",\"size\":4,\"title\":\"Reopened\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":5},{\"columnMatch\":\"Count\",\"formatter\":1}],\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Status\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"size\":\"auto\"},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"Count\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"25\",\"name\":\"query - 2 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created', \\\"fixed\\\") and isnotempty(commit_oid_s)\\n| summarize event_count=count() by tostring(action_s), bin(TimeGenerated,1d)\",\"size\":0,\"title\":\"Alert Found/Fixed Ratio\",\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"action_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"event_count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"created\",\"label\":\"Created\"},{\"seriesName\":\"fixed\",\"label\":\"Fixed\"}]}},\"customWidth\":\"33\",\"name\":\"query - 7\",\"styleSettings\":{\"padding\":\"20px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\nlet GithubPushes = githubscanaudit_CL\\n| extend EventType='Push'\\n| extend status = todynamic(action_s)\\n| extend commit = todynamic(commits_s)[0]\\n| extend added = commit.added\\n| extend modified = commit.modified\\n| extend removed = commit.removed\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(modified[0]) or isnotempty(added[0]);\\nlet CodeScanningAlerts = \\ngithubscanaudit_CL\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created', 'reopened') and isnotempty(commit_oid_s)\\n| extend EventType='Code Scanning Alert';\\nunion withsource=\\\"AllEvents\\\" CodeScanningAlerts, GithubPushes\\n| summarize event_count=count() by EventType, bin(TimeGenerated,1d)\\n\",\"size\":0,\"title\":\"Commit/Alert Ratio\",\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Push\",\"label\":\"Commits\"},{\"seriesName\":\"Code Scanning Alert\",\"label\":\"Alerts\"}]}},\"customWidth\":\"33\",\"name\":\"query - 7 - Copy\",\"styleSettings\":{\"padding\":\"20px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend Tool = alert.tool.name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created', \\\"appeared_in_branch\\\") and isnotempty(commit_oid_s)\\n| project TimeGenerated, Tool\\n| summarize Count = count() by tostring(Tool), bin(TimeGenerated,1d)\",\"size\":0,\"title\":\"New Alerts by Tool\",\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"customWidth\":\"33\",\"name\":\"query - 7 - Copy\",\"styleSettings\":{\"padding\":\"20px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend topics = repository.topics\\n| extend alert = todynamic(alert_s)\\n| extend URL = alert.html_url\\n| extend tool = alert.tool.name\\n| extend created_at = alert.created_at\\n| extend resolved_at = alert.fixed_at\\n| extend Time_To_Resolution = format_timespan(todatetime(resolved_at) - todatetime(created_at), 'dd:hh:mm:ss')\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('closed_by_user', 'fixed') and isnotempty(commit_oid_s)\\n| project repository, URL, tool, created_at, resolved_at, Time_To_Resolution\",\"size\":0,\"title\":\"Fixed Alerts\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"URL\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\"}}]}},\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend severity = alert.rule.security_severity_level\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created', 'reopened_by_user', 'reopened') and isnotempty(commit_oid_s) and isnotempty(severity)\\n| summarize Total=count(severity), Critical=countif(severity=='critical'), High=countif(severity=='high'), Medium=countif(severity=='medium'), Low=countif(severity=='low') by tostring(repositoryfullname)\\n\",\"size\":0,\"title\":\"Alerts by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Critical\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"red\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"High\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Medium\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"orange\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Low\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"}]}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"Total\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Total\",\"sortOrder\":2}],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"severity\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"event_count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"severity\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"event_count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"event_count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"event_count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"event_count\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"50\",\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"20px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL\\n| extend repository = todynamic(repository_s)\\n| extend alert = todynamic(alert_s)\\n| extend repo = todynamic(repository_s)\\n| extend Tool = tostring(alert.tool.name)\\n| extend Repository = repo.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (Repository in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where action_s in ('created', 'reopened') and isnotempty(commit_oid_s)\\n| project Repository, Tool\\n| evaluate pivot(tostring(Tool))\\n| order by tostring(Repository) asc\",\"size\":0,\"title\":\"Alerts by Repo\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true,\"sortBy\":[{\"itemKey\":\"Grype\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Grype\",\"sortOrder\":2}]},\"customWidth\":\"45\",\"name\":\"query - 1\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"20px\"}}]},\"conditionalVisibility\":{\"parameterName\":\"SelectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Code Scanning Alerts\"},\"name\":\"Code Scanning Alerts\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"

Secret Scanning Alerts

\"},\"conditionalVisibility\":{\"parameterName\":\"SelectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Secret Scanning Alerts\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend alertSecretType = alert.secret_type\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend created_at = alert.created_at\\n| extend resolved_at = alert.resolved_at\\n| extend day = todatetime(resolved_at) - todatetime(created_at)\\n| extend day = todatetime(resolved_at) - todatetime(created_at)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertSecretType)\\n| summarize format_timespan(avg(day), 'dd:hh:mm:ss')\",\"size\":4,\"title\":\"Mean Time to Resolution (dd:hh:mm:ss)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"MTTR\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"MTTR\",\"sortOrder\":2}],\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"33\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"\\n\\nlet repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend alert = todynamic(alert_s)\\n| extend alertSecretType = alert.secret_type\\n| where isnotempty(alertSecretType) and action_s in ('created')\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| project repositoryfullname, topic, repoTopics, Out, areTopicsSelected\\n| count\\n\",\"size\":4,\"title\":\"Found Secrets\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":5},{\"columnMatch\":\"Count\",\"formatter\":1}],\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Status\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"size\":\"auto\"},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"Count\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"\\n\\nlet repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| extend alert = todynamic(alert_s)\\n| extend alertSecretType = alert.secret_type\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n| extend Out = topic in (repoTopics)\\n| summarize topic = make_list(topic), Out= make_list(Out)\\n| project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertSecretType) and action_s in ('resolved')\\n| count\",\"size\":4,\"title\":\"Fixed Secrets\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"33\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend alertSecretType = alert.secret_type\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertSecretType) and action_s in ('created')\\n| summarize Count = count() by tostring(alertSecretType)\",\"size\":0,\"title\":\"Secrets by Type\",\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"query - 7 - Copy\",\"styleSettings\":{\"padding\":\"20px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend alertSecretType = alert.secret_type\\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertSecretType) and action_s in ('created')\\n| summarize Count = count() by tostring(repositoryfullname)\",\"size\":0,\"title\":\"Secrets by Repository\",\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"action_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"event_count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"33\",\"name\":\"query - 7\",\"styleSettings\":{\"padding\":\"20px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend alertSecretType = alert.secret_type\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertSecretType) and action_s in ('created', 'resolved')\\n| summarize Count = count() by bin(TimeGenerated, 1d), action_s\",\"size\":0,\"title\":\"Secrets Found/Fixed Ratio\",\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"33\",\"name\":\"query - 7 - Copy\",\"styleSettings\":{\"padding\":\"20px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend Secret_Type = alert.secret_type\\n| extend Repository = todynamic(repository_s).full_name\\n| extend Organization = todynamic(organization_s).login\\n| extend Created_at = alert.created_at\\n| extend Resolved_at = alert.resolved_at\\n| extend Time_to_Resolution= format_timespan(todatetime(Resolved_at) - todatetime(Created_at), 'dd:hh:mm:ss' )\\n| extend Resolution = case(isnotnull(alert.resolution), alert.resolution, \\\"Null\\\") \\n| extend URL = todynamic(repository_s).url\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(Secret_Type) and action_s in ('resolved')\\n|project Secret_Type, Organization, Repository, Resolution, Time_to_Resolution\",\"size\":0,\"title\":\"Fixed Secrets\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true,\"sortBy\":[{\"itemKey\":\"Time_to_Resolution\",\"sortOrder\":2}],\"labelSettings\":[{\"columnId\":\"Secret_Type\",\"label\":\"Secret Type\"},{\"columnId\":\"Time_to_Resolution\",\"label\":\"Time to Resolution(dd:hh:mm:ss)\"}]},\"sortBy\":[{\"itemKey\":\"Time_to_Resolution\",\"sortOrder\":2}]},\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend Secret_Type = alert.secret_type\\n| extend Repository = todynamic(repository_s).full_name\\n| extend Organization = todynamic(organization_s).login\\n| extend Created_at = alert.created_at\\n| extend URL = alert.html_url\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(Secret_Type) and action_s in ('created')\\n| project tostring(Secret_Type), tostring(Organization), tostring(Repository), tostring(URL), tostring(Created_at)\",\"size\":0,\"title\":\"Found Secrets\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"URL\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\"}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"Created_at\",\"sortOrder\":2}],\"labelSettings\":[{\"columnId\":\"Secret_Type\",\"label\":\"Secret Type\"},{\"columnId\":\"Created_at\",\"label\":\"Created at\"}]},\"sortBy\":[{\"itemKey\":\"Created_at\",\"sortOrder\":2}]},\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"SelectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Secret Scanning Alerts\"},\"name\":\"Secret Scanning Alerts\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"

Dependabot Alerts

\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend alert = todynamic(alert_s)\\n| extend created_at = alert.created_at \\n| extend resolved_at = alert.fixed_at\\n| extend alertexternalidentifier= alert.external_identifier\\n| extend day = todatetime(resolved_at) - todatetime(created_at)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertexternalidentifier) and action_s in ('resolve')\\n| summarize format_timespan(avg(day), 'dd:hh:mm:ss')\\n\",\"size\":4,\"title\":\"Mean Time to Resolution (dd:hh:mm:ss)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"MTTR\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"MTTR\",\"sortOrder\":2}],\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"25\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend Status = action_s\\n| extend alertexternalidentifier= alert.external_identifier\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertexternalidentifier) and action_s in ('create')\\n| count\",\"size\":4,\"title\":\"Created\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":5},{\"columnMatch\":\"Count\",\"formatter\":1}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Status\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"size\":\"auto\"},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"Count\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"25\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend Status = action_s\\n| extend alertexternalidentifier= alert.external_identifier\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertexternalidentifier) and action_s in ('resolve')\\n| count\",\"size\":4,\"title\":\"Resolved\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":5},{\"columnMatch\":\"Count\",\"formatter\":1}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Status\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"size\":\"auto\"},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"Count\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"25\",\"name\":\"query - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend Status = action_s\\n| extend alertexternalidentifier= alert.external_identifier\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertexternalidentifier) and action_s in ('dismiss')\\n| count\",\"size\":4,\"title\":\"Dismissed\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":5},{\"columnMatch\":\"Count\",\"formatter\":1}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Status\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"size\":\"auto\"},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"Count\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"25\",\"name\":\"query - 2 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend alertexternalidentifier = alert.external_identifier\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertexternalidentifier) and action_s in ('create', 'dismiss', 'resolve')\\n| summarize Count = count() by tostring(action_s), bin(TimeGenerated,1d)\",\"size\":0,\"title\":\"Alert Found/Fixed Ratio\",\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"create\",\"label\":\"Found\"},{\"seriesName\":\"resolve\",\"label\":\"Fixed\"},{\"seriesName\":\"dismiss\",\"label\":\"Dismissed\"}]}},\"customWidth\":\"33\",\"name\":\"query - 7 - Copy\",\"styleSettings\":{\"padding\":\"20px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend Repository = todynamic(repository_s).full_name\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend alertexternalidentifier = alert.external_identifier \\n| extend Severity = alert.severity\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertexternalidentifier) and action_s in ('create')\\n| summarize Count=count() by tostring(Repository)\",\"size\":0,\"title\":\"Vulnerabilities by Repo\",\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"action_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"event_count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"33\",\"name\":\"query - 7\",\"styleSettings\":{\"padding\":\"20px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend alertexternalidentifier = alert.external_identifier \\n| extend Severity = alert.severity\\n| extend Repository = todynamic(repository_s).full_name\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertexternalidentifier) and action_s in ('create')\\n| summarize Count=count() by tostring(Severity), bin(TimeGenerated,1d)\",\"size\":0,\"title\":\"New Alerts by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"customWidth\":\"33\",\"name\":\"query - 7 - Copy\",\"styleSettings\":{\"padding\":\"20px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend Action = todynamic(action_s)\\n| extend alertexternalidentifier = alert.external_identifier \\n| extend Severity = alert.severity\\n| extend repo = todynamic(repository_s)\\n| extend Alert_URL = alert.external_reference\\n| extend Repository = repo.full_name\\n| extend created_at = alert.created_at\\n| extend resolved_at = case(isnotnull(alert.fixed_at), alert.fixed_at, alert.dismissed_at)\\n| extend Time_to_Resolution = format_timespan(todatetime(resolved_at) - todatetime(created_at), 'dd:hh:mm:ss')\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertexternalidentifier) and action_s in ('resolve', 'dismiss')\\n| project Action, Repository, Severity, Alert_URL, Time_to_Resolution\",\"size\":0,\"title\":\"Fixed Alerts\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Alert_URL\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\"}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"Repository\",\"sortOrder\":2}],\"labelSettings\":[{\"columnId\":\"Time_to_Resolution\",\"label\":\"Time to Resolution(dd:hh:mm:ss)\"}]},\"sortBy\":[{\"itemKey\":\"Repository\",\"sortOrder\":2}]},\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let repositoriesList = dynamic([{Repositories}]);\\nlet repoTopics = dynamic([{Topics}]);\\ngithubscanaudit_CL \\n| extend repository = todynamic(repository_s)\\n| extend repositoryfullname = repository.full_name\\n| extend alert = todynamic(alert_s)\\n| extend Action = todynamic(action_s)\\n| extend alertexternalidentifier = alert.external_identifier \\n| extend Severity = alert.severity\\n| extend repo = todynamic(repository_s)\\n| extend Alert_URL = alert.external_reference\\n| extend Repository = repo.full_name\\n| extend created_at = alert.created_at\\n| extend resolved_at = alert.fixed_at\\n| extend Time_to_Resolution = todatetime(resolved_at) - todatetime(created_at)\\n| extend org = todynamic(organization_s)\\n| extend orgFullName = org.login\\n| extend topic = repository.topics\\n| mv-apply repoTopics, topic on (\\n mv-expand topic\\n | extend Out = topic in (repoTopics)\\n | summarize topic = make_list(topic), Out= make_list(Out)\\n | project Out, topic\\n)\\n| extend areReposSelected = array_length((repositoriesList)) == 0\\n| extend areTopicsSelected = array_length((repoTopics)) > 0\\n| where\\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\\n| where isnotempty(alertexternalidentifier) and action_s in ('create')\\n| summarize Total=count(Severity), Critical=countif(Severity=='critical'), High=countif(Severity=='high'), Medium=countif(Severity=='moderate'), Low=countif(Severity=='low') by tostring(Repository)\",\"size\":0,\"title\":\"Alerts by Repo\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Critical\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"High\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Medium\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"orange\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Low\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"}]}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"Total\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Total\",\"sortOrder\":2}]},\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"SelectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Dependabot Alerts\"},\"name\":\"Dependabot Alerts\"}],\"fromTemplateId\":\"GitHubAdvancedSecurity - topics\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -440,7 +440,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "(Preview) GitHub - A payment method was removed_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "(Preview) GitHub - A payment method was removed_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion1')]", @@ -475,13 +475,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -537,7 +537,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "(Preview) GitHub - Activities from Infrequent Country_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "(Preview) GitHub - Activities from Infrequent Country_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion2')]", @@ -572,13 +572,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -634,7 +634,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "(Preview) GitHub - Oauth application - a client secret was removed_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "(Preview) GitHub - Oauth application - a client secret was removed_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion3')]", @@ -669,13 +669,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -731,7 +731,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "(Preview) GitHub - Repository was created_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "(Preview) GitHub - Repository was created_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion4')]", @@ -766,13 +766,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -828,7 +828,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "(Preview) GitHub - Repository was destroyed_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "(Preview) GitHub - Repository was destroyed_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion5')]", @@ -863,13 +863,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -925,7 +925,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "(Preview) GitHub - Two Factor Authentication Disabled in GitHub_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "(Preview) GitHub - Two Factor Authentication Disabled in GitHub_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion6')]", @@ -960,13 +960,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1022,7 +1022,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "(Preview) GitHub - User visibility Was changed_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "(Preview) GitHub - User visibility Was changed_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion7')]", @@ -1057,13 +1057,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1119,7 +1119,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "(Preview) GitHub - User was added to the organization_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "(Preview) GitHub - User was added to the organization_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion8')]", @@ -1154,13 +1154,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1216,7 +1216,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "(Preview) GitHub - User was blocked_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "(Preview) GitHub - User was blocked_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion9')]", @@ -1251,13 +1251,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1313,7 +1313,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "(Preview) GitHub - User was invited to the repository_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "(Preview) GitHub - User was invited to the repository_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion10')]", @@ -1348,13 +1348,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1410,7 +1410,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "(Preview) GitHub - pull request was created_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "(Preview) GitHub - pull request was created_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion11')]", @@ -1445,13 +1445,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1507,7 +1507,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "(Preview) GitHub - pull request was merged_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "(Preview) GitHub - pull request was merged_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion12')]", @@ -1542,13 +1542,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1604,7 +1604,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT Two Factor Authentication Disabled_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "NRT Two Factor Authentication Disabled_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion13')]", @@ -1635,22 +1635,22 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] } ] } @@ -1706,7 +1706,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Security Vulnerability in Repo_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "Security Vulnerability in Repo_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion14')]", @@ -1786,7 +1786,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "First Time User Invite and Add Member to Org_HuntingQueries Hunting Query with template version 3.0.0", + "description": "First Time User Invite and Add Member to Org_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion1')]", @@ -1871,7 +1871,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Inactive or New Account Usage_HuntingQueries Hunting Query with template version 3.0.0", + "description": "Inactive or New Account Usage_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion2')]", @@ -1956,7 +1956,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mass Deletion of Repositories _HuntingQueries Hunting Query with template version 3.0.0", + "description": "Mass Deletion of Repositories _HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion3')]", @@ -2041,7 +2041,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Oauth App Restrictions Disabled_HuntingQueries Hunting Query with template version 3.0.0", + "description": "Oauth App Restrictions Disabled_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion4')]", @@ -2126,7 +2126,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Org Repositories Default Permissions Change_HuntingQueries Hunting Query with template version 3.0.0", + "description": "Org Repositories Default Permissions Change_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion5')]", @@ -2211,7 +2211,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Repository Permission Switched to Public_HuntingQueries Hunting Query with template version 3.0.0", + "description": "Repository Permission Switched to Public_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion6')]", @@ -2296,7 +2296,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User First Time Repository Delete Activity_HuntingQueries Hunting Query with template version 3.0.0", + "description": "User First Time Repository Delete Activity_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion7')]", @@ -2381,7 +2381,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Grant Access and Grants Other Access_HuntingQueries Hunting Query with template version 3.0.0", + "description": "User Grant Access and Grants Other Access_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion8')]", @@ -2466,7 +2466,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHubAuditData Data Parser with template version 3.0.0", + "description": "GitHubAuditData Data Parser with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserVersion1')]", @@ -2598,7 +2598,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHubCodeScanningData Data Parser with template version 3.0.0", + "description": "GitHubCodeScanningData Data Parser with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserVersion2')]", @@ -2730,7 +2730,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHubDependabotData Data Parser with template version 3.0.0", + "description": "GitHubDependabotData Data Parser with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserVersion3')]", @@ -2862,7 +2862,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GithubSecretScanningData Data Parser with template version 3.0.0", + "description": "GithubSecretScanningData Data Parser with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserVersion4')]", @@ -2994,7 +2994,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub data connector with template version 3.0.0", + "description": "GitHub data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -3339,7 +3339,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub data connector with template version 3.0.0", + "description": "GitHub data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -3357,7 +3357,7 @@ "id": "[variables('_uiConfigId2')]", "title": "GitHub (using Webhooks) (using Azure Functions)", "publisher": "Microsoft", - "descriptionMarkdown": "The [GitHub](https://www.github.com) webhook data connector provides the capability to ingest GitHub subscribed events into Microsoft Sentinel using [GitHub webhook events](https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads). The connector provides ability to get eventsinto Microsoft Sentinel which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more. \n\n **Note:** If you are intended to ingest Github Audit logs, Please refer to GitHub Enterprise Audit Log Connector from \"**Data Connectors**\" gallery.", + "descriptionMarkdown": "The [GitHub](https://www.github.com) webhook data connector provides the capability to ingest GitHub subscribed events into Microsoft Sentinel using [GitHub webhook events](https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads). The connector provides ability to get events into Microsoft Sentinel which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more. \n\n **Note:** If you are intended to ingest Github Audit logs, Please refer to GitHub Enterprise Audit Log Connector from \"**Data Connectors**\" gallery.", "graphQueries": [ { "metricName": "Total data received", @@ -3574,7 +3574,7 @@ "connectorUiConfig": { "title": "GitHub (using Webhooks) (using Azure Functions)", "publisher": "Microsoft", - "descriptionMarkdown": "The [GitHub](https://www.github.com) webhook data connector provides the capability to ingest GitHub subscribed events into Microsoft Sentinel using [GitHub webhook events](https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads). The connector provides ability to get eventsinto Microsoft Sentinel which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more. \n\n **Note:** If you are intended to ingest Github Audit logs, Please refer to GitHub Enterprise Audit Log Connector from \"**Data Connectors**\" gallery.", + "descriptionMarkdown": "The [GitHub](https://www.github.com) webhook data connector provides the capability to ingest GitHub subscribed events into Microsoft Sentinel using [GitHub webhook events](https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads). The connector provides ability to get events into Microsoft Sentinel which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more. \n\n **Note:** If you are intended to ingest Github Audit logs, Please refer to GitHub Enterprise Audit Log Connector from \"**Data Connectors**\" gallery.", "graphQueries": [ { "metricName": "Total data received", @@ -3700,12 +3700,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.0.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "GitHub", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution: \r \n • Review the solution Release Notes\r \n • There may be known issues pertaining to this Solution.

\n

The GitHub Solution for Microsoft Sentinel enables you to easily ingest events and logs from GitHub to Microsoft Sentinel using GitHub audit log API and webhooks. This enables you to view and analyze this data in your workbooks, query it to create custom alerts, and incorporate it to improve your investigation process, giving you more insight into your platform security.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Codeless Connector Platform (CCP) (used in GitHub Enterprise Audit Log data connector)

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n
\n

Data Connectors: 2, Parsers: 4, Workbooks: 2, Analytic Rules: 14, Hunting Queries: 8

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The GitHub Solution for Microsoft Sentinel enables you to easily ingest events and logs from GitHub to Microsoft Sentinel using GitHub audit log API and webhooks. This enables you to view and analyze this data in your workbooks, query it to create custom alerts, and incorporate it to improve your investigation process, giving you more insight into your platform security.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Codeless Connector Platform (CCP) (used in GitHub Enterprise Audit Log data connector)

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n
\n

Data Connectors: 2, Parsers: 4, Workbooks: 2, Analytic Rules: 14, Hunting Queries: 8

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", diff --git a/Solutions/GitHub/Workbooks/GitHubWorkbook.json b/Solutions/GitHub/Workbooks/GitHubWorkbook.json index 7c7ebe46a5f..aa528e5324a 100644 --- a/Solutions/GitHub/Workbooks/GitHubWorkbook.json +++ b/Solutions/GitHub/Workbooks/GitHubWorkbook.json @@ -4,10 +4,10 @@ { "type": 1, "content": { - "json": "## GitHub Audit Log\n" + "json": "Topics and repository filters are mutually exlusive. To filter for topics, deselect all repositories and vice versa", + "style": "warning" }, - "customWidth": "10", - "name": "text - 2" + "name": "text - 6" }, { "type": 9, @@ -15,28 +15,53 @@ "version": "KqlParameterItem/1.0", "parameters": [ { - "id": "9c6caa2f-88f7-4472-b6cf-789023c368de", + "id": "f80bd5e4-0e9d-4dc7-b999-110328e5b08e", "version": "KqlParameterItem/1.0", "name": "TimeRange", - "label": "Time Range", "type": 4, + "isRequired": true, + "isGlobal": true, + "value": { + "durationMs": 2592000000 + }, "typeSettings": { "selectableValues": [ + { + "durationMs": 300000 + }, { "durationMs": 900000 }, + { + "durationMs": 1800000 + }, { "durationMs": 3600000 }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, { "durationMs": 86400000 }, + { + "durationMs": 172800000 + }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, { "durationMs": 2592000000 }, @@ -51,22 +76,20 @@ }, "timeContext": { "durationMs": 86400000 - }, - "value": { - "durationMs": 7776000000 } }, { - "id": "ee9cafd5-814c-4ad7-9958-2542da484a29", + "id": "87b3e22f-fc5b-4c56-a449-372be28ec152", "version": "KqlParameterItem/1.0", - "name": "Repositories", + "name": "Orgs", "type": 5, - "description": "Filter for events that include specific repository values", + "description": "Org selector", "isRequired": true, + "isGlobal": true, "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "GitHubAuditLogPolling_CL\n| extend repository = repo_s\n| distinct tostring(repository)\n| where isnotempty(repository)", + "query": "githubscanaudit_CL \n| extend organization = todynamic(organization_s).login\n| distinct tostring(organization)\n| where isnotempty(organization)\n\n", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -74,45 +97,76 @@ "showDefault": false }, "timeContext": { - "durationMs": 7776000000 + "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "value": [ + "dsp-testing" + ] }, { - "id": "357ea458-5943-4bbf-a429-13bccf9a7a62", + "id": "1673856e-da45-4e3b-8c00-9790024bea39", "version": "KqlParameterItem/1.0", - "name": "Actors", + "name": "Repositories", "type": 5, - "description": "Filter for events that include a specific Actor", - "isRequired": true, + "description": "Repository selector", + "isGlobal": true, "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "GitHubAuditLogPolling_CL\n| extend actor = actor_s\n| distinct tostring(actor)\n| where isnotempty(actor)", + "query": "githubscanaudit_CL \n| extend repository = todynamic(repository_s).full_name\n| extend organization = todynamic(organization_s).login\n| where isnotempty(repository) and tostring(organization) in ({Orgs})\n| distinct tostring(repository)\n\n\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], + "selectAllValue": "", "showDefault": false }, "timeContext": { - "durationMs": 7776000000 + "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "value": [] + }, + { + "id": "10bfa980-1673-4a8c-9d59-fe12a24e297c", + "version": "KqlParameterItem/1.0", + "name": "Topics", + "type": 5, + "isGlobal": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let selection = dynamic([{Repositories}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend topics = repository.topics\n| extend org = todynamic(organization_s)\n| extend orgName = org.login\n| extend reposAreNotSelected = array_length((selection)) == 0\n| where topics <> \"[]\" and orgName in ({Orgs}) //and reposAreNotSelected\n| mv-expand topics\n| distinct tostring(topics)\n| project topics", + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "", + "showDefault": false + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": [ + "value::all" + ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, - "customWidth": "90", - "name": "parameters - 7" + "name": "parameters - 5" }, { "type": 11, @@ -121,134 +175,845 @@ "style": "tabs", "links": [ { - "id": "c6cb9ad8-00ac-45db-acc7-d8416ef91c1b", + "id": "b7b61394-d7c7-4a2a-9e90-5d17ce94f8d8", "cellValue": "SelectedTab", "linkTarget": "parameter", - "linkLabel": "Recent Events", - "subTarget": "Recent Events", + "linkLabel": "Advanced Security Overview", + "subTarget": "Advanced Security Overview", "style": "link" }, { - "id": "16b6c7a2-8607-4715-959e-c054c366e22c", + "id": "7b984311-578d-4162-8e03-1c82cfa37519", "cellValue": "SelectedTab", "linkTarget": "parameter", - "linkLabel": "Top 10 Offenders", - "subTarget": "Top 10 Offenders", + "linkLabel": "Code Scanning Alerts", + "subTarget": "Code Scanning Alerts", + "style": "link" + }, + { + "id": "03316284-9c39-4d15-853b-568d16d264f5", + "cellValue": "SelectedTab", + "linkTarget": "parameter", + "linkLabel": "Secret Scanning Alerts", + "subTarget": "Secret Scanning Alerts", + "style": "link" + }, + { + "id": "8853be7b-58d0-45cc-89c3-1a9897f01b19", + "cellValue": "SelectedTab", + "linkTarget": "parameter", + "linkLabel": "Dependabot Alerts", + "subTarget": "Dependabot Alerts", "style": "link" } ] }, - "name": "links - 6" + "customWidth": "50", + "name": "links - 5", + "styleSettings": { + "margin": "0px", + "padding": "0px" + } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", - "title": "Compliance", "items": [ + { + "type": 1, + "content": { + "json": "

Advanced Security Overview

" + }, + "name": "text - 7" + }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "GitHubAuditData \r\n| where Action == \"repo.access\" and Visibility == \"public\"\r\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\r\n| sort by TimeGenerated desc\r\n| project Time=TimeGenerated, Repository, Actor", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\nlet RepositoryVulnerabilityAlerts = githubscanaudit_CL \n| extend EventType='Dependabot Alert'\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s) \n| extend alertexternalidentifier= alert.external_identifier\n| extend Severity = tostring(alert.severity)\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('create') and isnotempty(alertexternalidentifier)\n| project EventType, Severity, orgFullName;\n\nlet CodeScanningAlerts = githubscanaudit_CL \n| extend EventType='Code Scanning Alert'\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend Severity = tostring(alert.rule.security_severity_level)\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created') and isnotempty(commit_oid_s) and isnotempty(Severity) \n| project EventType, Severity, orgFullName, repositoryfullname;\n\nlet SecretScanningAlerts = githubscanaudit_CL \n| extend EventType='Secret Scanning Alert'\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend alertSecretType = alert.secret_type\n| extend Severity = \"high\"\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created') and isnotempty(alertSecretType)\n| project EventType, Severity, orgFullName, repositoryfullname;\n union withsource=\"AllEvents\" RepositoryVulnerabilityAlerts, CodeScanningAlerts, SecretScanningAlerts\n| summarize Count = count() by tostring(Severity)", "size": 0, - "title": "Private Repos made Public", + "title": "Open Alerts By Severity", "timeContextFromParameter": "TimeRange", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "sortBy": [], + "chartSettings": { + "group": "Severity", + "createOtherGroup": null, + "seriesLabelSettings": [ + { + "seriesName": "high", + "label": "High", + "color": "redBright" + }, + { + "seriesName": "moderate", + "label": "Moderate", + "color": "orange" + }, + { + "seriesName": "medium", + "label": "Medium", + "color": "brown" + }, + { + "seriesName": "critical", + "label": "Critical", + "color": "redDark" + }, + { + "seriesName": "low", + "label": "Low", + "color": "yellow" + } + ] + } }, - "customWidth": "33", - "name": "privatereposmadepublic", - "styleSettings": { - "showBorder": true - } + "customWidth": "25", + "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "GitHubAuditData \n| where Action == \"protected_branch.policy_override\"\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\n| sort by TimeGenerated desc\n| project Time=TimeGenerated, Repository, Actor", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\nlet RepositoryVulnerabilityAlerts = githubscanaudit_CL \n| extend EventType='Dependabot Alert'\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend alert = todynamic(alert_s) \n| extend alertexternalidentifier= alert.external_identifier\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertexternalidentifier) and action_s in ('create');\n\nlet CodeScanningAlerts = githubscanaudit_CL \n| extend EventType='Code Scanning Alert'\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s) \n| extend Severity = alert.rule.security_severity_level\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created') and isnotempty(commit_oid_s);\n\nlet SecretScanningAlerts = githubscanaudit_CL \n| extend EventType='Secret Scanning Alert'\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s) \n| extend alertSecretType = alert.secret_type\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertSecretType) and action_s in ('created');\nunion withsource=\"AllEvents\" RepositoryVulnerabilityAlerts, CodeScanningAlerts, SecretScanningAlerts\n|summarize Count = count() by tostring(repositoryfullname)", "size": 0, - "title": "Branch Protection - Bypass", + "title": "Open Alerts by Repository", "timeContextFromParameter": "TimeRange", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "repositoryfullname", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "repositoryfullname", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "Count", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } }, - "customWidth": "34", - "name": "query - 6", - "styleSettings": { - "showBorder": true - } + "customWidth": "25", + "name": "query - 8 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "GitHubAuditData\n| where Action == \"secret_scanning_push_protection.bypass\"\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\n| sort by TimeGenerated desc\n| project Time=TimeGenerated, Repository, Actor", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\n\nlet RepositoryVulnerabilityAlerts = githubscanaudit_CL \n| extend EventType='Dependabot Alert'\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s) \n| extend alertexternalidentifier= alert.external_identifier\n| extend Severity = alert.severity\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertexternalidentifier) and action_s in ('create')\n| project EventType, Severity;\n\nlet CodeScanningAlerts = githubscanaudit_CL \n| extend EventType='Code Scanning Alert'\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend Severity = alert.rule.security_severity_level\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created') and isnotempty(commit_oid_s)\n| project EventType, Severity;\n\nlet SecretScanningAlerts = githubscanaudit_CL \n| extend EventType='Secret Scanning Alert'\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend alertSecretType = alert.secret_type\n| extend Severity = \"High\"\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created') and isnotempty(alertSecretType)\n| project EventType, Severity;\nunion withsource=\"AllEvents\" RepositoryVulnerabilityAlerts, CodeScanningAlerts, SecretScanningAlerts\n|summarize Count = count() by tostring(EventType)", "size": 0, - "title": "Push Protection - Bypass", + "title": "Open Alerts by Type", "timeContextFromParameter": "TimeRange", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart" }, - "customWidth": "33", - "name": "query - 7", + "customWidth": "25", + "name": "query - 8 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\n\nlet RepositoryVulnerabilityAlerts = githubscanaudit_CL \n| extend EventType='Dependabot Alert'\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s) \n| extend Repository = repository.full_name \n| extend alertexternalidentifier= alert.external_identifier\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('dismiss', 'resolve') and isnotempty(alertexternalidentifier);\n\nlet CodeScanningAlerts = githubscanaudit_CL \n| extend EventType='Code Scanning Alert'\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend Repository = repository.full_name \n| extend Severity = alert.rule.security_severity_level\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('closed_by_user', 'fixed') and isnotempty(commit_oid_s);\n\nlet SecretScanningAlerts = githubscanaudit_CL\n| extend EventType='Secret Scanning Alert'\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend Repository = repository.full_name \n| extend alertSecretType = alert.secret_type\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('resolved') and isnotempty(alertSecretType);\nunion withsource=\"AllEvents\" RepositoryVulnerabilityAlerts, CodeScanningAlerts, SecretScanningAlerts\n| count", + "size": 4, + "title": "Resolved Alert Count", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "card", + "textSettings": { + "style": "bignumber" + } + }, + "customWidth": "25", + "name": "query - 8 - Copy - Copy", "styleSettings": { - "showBorder": true + "padding": "50px" } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\nlet RepositoryVulnerabilityAlerts = \ngithubscanaudit_CL \n| extend EventType='Dependabot Alert'\n| extend repository = todynamic(repository_s)\n| extend Repository = repository.full_name \n| extend alert = todynamic(alert_s) \n| extend alertexternalidentifier = alert.external_identifier\n| extend Severity = alert.severity\n| extend id = alert.ghsa_id \n| extend Status = action_s\n| extend Reason = alert.affected_package_name\n| extend Created_at = alert.created_at\n| extend Number = alert.number\n| extend Age = now() - todatetime(Created_at)\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (Repository in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('create', 'dismiss', 'resolve') and isnotempty(alertexternalidentifier)\n| project Repository, Reason, id, EventType, tostring(Severity), Status, Created_at, Number, format_timespan(Age, 'dd:hh:mm:ss');\n\nlet CodeScanningAlerts =\ngithubscanaudit_CL \n| extend EventType='Code Scanning Alert'\n| extend repository = todynamic(repository_s)\n| extend Repository = repository.full_name \n| extend alert = todynamic(alert_s)\n| extend Severity = alert.rule.security_severity_level\n| extend Reason = alert.rule.name\n| extend id = alert.rule.id\n| extend Severity = alert.rule.security_severity_level\n| extend Status = action_s\n| extend Created_at = alert.created_at\n| extend Number = alert.number\n| extend Age = now() - todatetime(Created_at)\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (Repository in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created', 'reopened_by_user', 'closed_by_user', 'fixed', 'appeared_in_branch', 'reopened') and isnotempty(commit_oid_s) and isnotempty(Severity) \n| project Repository, Reason, id, EventType, tostring(Severity), Status, Created_at, Number, format_timespan(Age, 'dd:hh:mm:ss');\n\nlet SecretScanningAlerts = \ngithubscanaudit_CL \n| extend EventType='Secret Scanning Alert'\n| extend repository = todynamic(repository_s)\n| extend Repository = repository.full_name \n| extend alert = todynamic(alert_s)\n| extend Severity = \"high\"\n| extend Reason = alert.secret_type \n| extend id = alert.number\n| extend alertSecretType = alert.secret_type\n| extend Status = action_s\n| extend Created_at = alert.created_at\n| extend Number = alert.number\n| extend Age = now() - todatetime(Created_at)\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (Repository in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created', 'resolved', 'reopened') and isnotempty(alertSecretType)\n| project Repository, Reason, id, EventType, tostring(Severity), Status, Created_at, Number, format_timespan(Age, 'dd:hh:mm:ss');\nunion withsource=\"AllEvents\" RepositoryVulnerabilityAlerts, CodeScanningAlerts, SecretScanningAlerts", + "size": 0, + "title": "Alert Details", + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "AllEvents", + "formatter": 5 + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "high", + "representation": "redBright", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "critical", + "representation": "redDark" + }, + { + "operator": "contains", + "thresholdValue": "moderate", + "representation": "red" + }, + { + "operator": "contains", + "thresholdValue": "medium", + "representation": "orange" + }, + { + "operator": "contains", + "thresholdValue": "low", + "representation": "yellow" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "gray", + "text": "{0}{1}" + } + ] + } + } + ], + "rowLimit": 5000, + "filter": true + } + }, + "name": "query - 5" } ] }, "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", - "value": "Recent Events" + "value": "Advanced Security Overview" }, - "name": "group - 10", - "styleSettings": { - "showBorder": true - } + "name": "Advanced Security Overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", - "title": "Access", "items": [ + { + "type": 1, + "content": { + "json": "

Code Scanning Alerts

" + }, + "name": "text - 0" + }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "GitHubAuditData \n| where Action == \"org.add_member\" or Action == \"org.remove_member\"\n| where Actor in ({Actors}) // parameter filter\n| extend Action = iif(Action==\"org.add_member\", \"Added\", \"Removed\")\n| sort by TimeGenerated desc\n| project Time=TimeGenerated, Actor, Action, User=ImpactedUser, Organization", - "size": 1, - "title": "Members Added or Removed", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend alert = todynamic(alert_s)\n| extend url = alert.url\n| extend repo = todynamic(repository_s)\n| extend repository = repo.name\n| extend created_at = alert.created_at\n| extend resolved_at = alert.fixed_at\n| extend day = todatetime(resolved_at) - todatetime(created_at)\n| where action_s in ('closed_by_user', 'fixed') and isnotempty(commit_oid_s)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| summarize format_timespan(avg(day), 'dd:hh:mm:ss')", + "size": 4, + "title": "Mean Time to Resolution (dd:hh:mm:ss)", "timeContextFromParameter": "TimeRange", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "card", + "sortBy": [], + "textSettings": { + "style": "bignumber" + } }, - "customWidth": "50", - "name": "membersaddedorremoved", + "customWidth": "25", + "name": "query - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created') and isnotempty(commit_oid_s)\n| count", + "size": 4, + "title": "Created", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "card", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Status", + "formatter": 5 + }, + { + "columnMatch": "Count", + "formatter": 1 + } + ], + "sortBy": [ + { + "itemKey": "Count", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "Count", + "sortOrder": 1 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Status", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false, + "size": "auto" + }, + "mapSettings": { + "locInfo": "LatLong", + "sizeSettings": "Count", + "sizeAggregation": "Sum", + "legendMetric": "Count", + "legendAggregation": "Sum", + "itemColorSettings": { + "type": "heatmap", + "colorAggregation": "Sum", + "nodeColorField": "Count", + "heatmapPalette": "greenRed" + } + }, + "textSettings": { + "style": "bignumber" + } + }, + "customWidth": "25", + "name": "query - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('fixed') and isnotempty(commit_oid_s)\n| count", + "size": 4, + "title": "Fixed", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "card", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Status", + "formatter": 5 + }, + { + "columnMatch": "Count", + "formatter": 1 + } + ], + "sortBy": [ + { + "itemKey": "Count", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "Count", + "sortOrder": 1 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Status", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false, + "size": "auto" + }, + "mapSettings": { + "locInfo": "LatLong", + "sizeSettings": "Count", + "sizeAggregation": "Sum", + "legendMetric": "Count", + "legendAggregation": "Sum", + "itemColorSettings": { + "type": "heatmap", + "colorAggregation": "Sum", + "nodeColorField": "Count", + "heatmapPalette": "greenRed" + } + }, + "textSettings": { + "style": "bignumber" + } + }, + "customWidth": "25", + "name": "query - 2 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('reopened') and isnotempty(commit_oid_s)\n| count", + "size": 4, + "title": "Reopened", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "card", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Status", + "formatter": 5 + }, + { + "columnMatch": "Count", + "formatter": 1 + } + ], + "sortBy": [ + { + "itemKey": "Count", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "Count", + "sortOrder": 1 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Status", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false, + "size": "auto" + }, + "mapSettings": { + "locInfo": "LatLong", + "sizeSettings": "Count", + "sizeAggregation": "Sum", + "legendMetric": "Count", + "legendAggregation": "Sum", + "itemColorSettings": { + "type": "heatmap", + "colorAggregation": "Sum", + "nodeColorField": "Count", + "heatmapPalette": "greenRed" + } + }, + "textSettings": { + "style": "bignumber" + } + }, + "customWidth": "25", + "name": "query - 2 - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created', \"fixed\") and isnotempty(commit_oid_s)\n| summarize event_count=count() by tostring(action_s), bin(TimeGenerated,1d)", + "size": 0, + "title": "Alert Found/Fixed Ratio", + "timeContextFromParameter": "TimeRange", + "timeBrushParameterName": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "action_s", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "event_count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "created", + "label": "Created" + }, + { + "seriesName": "fixed", + "label": "Fixed" + } + ] + } + }, + "customWidth": "33", + "name": "query - 7", + "styleSettings": { + "padding": "20px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\nlet GithubPushes = githubscanaudit_CL\n| extend EventType='Push'\n| extend status = todynamic(action_s)\n| extend commit = todynamic(commits_s)[0]\n| extend added = commit.added\n| extend modified = commit.modified\n| extend removed = commit.removed\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(modified[0]) or isnotempty(added[0]);\nlet CodeScanningAlerts = \ngithubscanaudit_CL\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created', 'reopened') and isnotempty(commit_oid_s)\n| extend EventType='Code Scanning Alert';\nunion withsource=\"AllEvents\" CodeScanningAlerts, GithubPushes\n| summarize event_count=count() by EventType, bin(TimeGenerated,1d)\n", + "size": 0, + "title": "Commit/Alert Ratio", + "timeContextFromParameter": "TimeRange", + "timeBrushParameterName": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "Push", + "label": "Commits" + }, + { + "seriesName": "Code Scanning Alert", + "label": "Alerts" + } + ] + } + }, + "customWidth": "33", + "name": "query - 7 - Copy", + "styleSettings": { + "padding": "20px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend Tool = alert.tool.name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created', \"appeared_in_branch\") and isnotempty(commit_oid_s)\n| project TimeGenerated, Tool\n| summarize Count = count() by tostring(Tool), bin(TimeGenerated,1d)", + "size": 0, + "title": "New Alerts by Tool", + "timeContextFromParameter": "TimeRange", + "timeBrushParameterName": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "unstackedbar" + }, + "customWidth": "33", + "name": "query - 7 - Copy", "styleSettings": { - "showBorder": true + "padding": "20px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "GitHubAuditData \r\n| where Action == \"team.add_repository\" or Action == \"team.remove_repository\"\r\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\r\n| extend Action = iif(Action==\"team.add_repository\", \"Added\", \"Removed\")\r\n| sort by TimeGenerated desc\r\n| project Time=TimeGenerated, Actor, Action, Permission=InvitedUserPermission, Team=TeamName, Repository", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend topics = repository.topics\n| extend alert = todynamic(alert_s)\n| extend URL = alert.html_url\n| extend tool = alert.tool.name\n| extend created_at = alert.created_at\n| extend resolved_at = alert.fixed_at\n| extend Time_To_Resolution = format_timespan(todatetime(resolved_at) - todatetime(created_at), 'dd:hh:mm:ss')\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('closed_by_user', 'fixed') and isnotempty(commit_oid_s)\n| project repository, URL, tool, created_at, resolved_at, Time_To_Resolution", "size": 0, - "title": "Teams Added/Removed Repository", + "title": "Fixed Alerts", "timeContextFromParameter": "TimeRange", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "URL", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url" + } + } + ] + }, + "sortBy": [] + }, + "name": "query - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend severity = alert.rule.security_severity_level\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created', 'reopened_by_user', 'reopened') and isnotempty(commit_oid_s) and isnotempty(severity)\n| summarize Total=count(severity), Critical=countif(severity=='critical'), High=countif(severity=='high'), Medium=countif(severity=='medium'), Low=countif(severity=='low') by tostring(repositoryfullname)\n", + "size": 0, + "title": "Alerts by Severity", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Critical", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "representation": "redDark", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "red", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "High", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "redBright", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Medium", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "orange", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Low", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "yellow", + "text": "{0}{1}" + } + ] + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "Total", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "Total", + "sortOrder": 2 + } + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "severity", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "event_count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "severity", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "event_count", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "mapSettings": { + "locInfo": "LatLong", + "sizeSettings": "event_count", + "sizeAggregation": "Sum", + "legendMetric": "event_count", + "legendAggregation": "Sum", + "itemColorSettings": { + "type": "heatmap", + "colorAggregation": "Sum", + "nodeColorField": "event_count", + "heatmapPalette": "greenRed" + } + } }, "customWidth": "50", - "name": "teamsaddedremovedtorepository", + "name": "query - 3", + "styleSettings": { + "margin": "10px", + "padding": "20px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL\n| extend repository = todynamic(repository_s)\n| extend alert = todynamic(alert_s)\n| extend repo = todynamic(repository_s)\n| extend Tool = tostring(alert.tool.name)\n| extend Repository = repo.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (Repository in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where action_s in ('created', 'reopened') and isnotempty(commit_oid_s)\n| project Repository, Tool\n| evaluate pivot(tostring(Tool))\n| order by tostring(Repository) asc", + "size": 0, + "title": "Alerts by Repo", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "filter": true, + "sortBy": [ + { + "itemKey": "Grype", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "Grype", + "sortOrder": 2 + } + ] + }, + "customWidth": "45", + "name": "query - 1", "styleSettings": { - "showBorder": true + "margin": "10px", + "padding": "20px" } } ] @@ -256,176 +1021,826 @@ "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", - "value": "Recent Events" + "value": "Code Scanning Alerts" }, - "name": "group - 8", - "styleSettings": { - "showBorder": true - } + "name": "Code Scanning Alerts" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", - "title": "Repositories", "items": [ + { + "type": 1, + "content": { + "json": "

Secret Scanning Alerts

" + }, + "conditionalVisibility": { + "parameterName": "SelectedTab", + "comparison": "isEqualTo", + "value": "Secret Scanning Alerts" + }, + "name": "text - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend alertSecretType = alert.secret_type\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend created_at = alert.created_at\n| extend resolved_at = alert.resolved_at\n| extend day = todatetime(resolved_at) - todatetime(created_at)\n| extend day = todatetime(resolved_at) - todatetime(created_at)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertSecretType)\n| summarize format_timespan(avg(day), 'dd:hh:mm:ss')", + "size": 4, + "title": "Mean Time to Resolution (dd:hh:mm:ss)", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "card", + "gridSettings": { + "sortBy": [ + { + "itemKey": "MTTR", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "MTTR", + "sortOrder": 2 + } + ], + "textSettings": { + "style": "bignumber" + } + }, + "customWidth": "33", + "name": "query - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "\n\nlet repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend alert = todynamic(alert_s)\n| extend alertSecretType = alert.secret_type\n| where isnotempty(alertSecretType) and action_s in ('created')\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| project repositoryfullname, topic, repoTopics, Out, areTopicsSelected\n| count\n", + "size": 4, + "title": "Found Secrets", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "card", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Status", + "formatter": 5 + }, + { + "columnMatch": "Count", + "formatter": 1 + } + ], + "sortBy": [ + { + "itemKey": "Count", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "Count", + "sortOrder": 1 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Status", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false, + "size": "auto" + }, + "mapSettings": { + "locInfo": "LatLong", + "sizeSettings": "Count", + "sizeAggregation": "Sum", + "legendMetric": "Count", + "legendAggregation": "Sum", + "itemColorSettings": { + "type": "heatmap", + "colorAggregation": "Sum", + "nodeColorField": "Count", + "heatmapPalette": "greenRed" + } + }, + "textSettings": { + "style": "bignumber" + } + }, + "customWidth": "33", + "name": "query - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "\n\nlet repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| extend alert = todynamic(alert_s)\n| extend alertSecretType = alert.secret_type\n| mv-apply repoTopics, topic on (\n mv-expand topic\n| extend Out = topic in (repoTopics)\n| summarize topic = make_list(topic), Out= make_list(Out)\n| project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertSecretType) and action_s in ('resolved')\n| count", + "size": 4, + "title": "Fixed Secrets", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "card", + "textSettings": { + "style": "bignumber" + } + }, + "customWidth": "33", + "name": "query - 9" + }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "GitHubAuditData \r\n| where Action == \"repo.create\"\r\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\r\n| sort by TimeGenerated desc\r\n| project Time=TimeGenerated, Repository, Actor, Visibility", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend alertSecretType = alert.secret_type\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertSecretType) and action_s in ('created')\n| summarize Count = count() by tostring(alertSecretType)", "size": 0, - "title": "Created", + "title": "Secrets by Type", "timeContextFromParameter": "TimeRange", + "timeBrushParameterName": "TimeRange", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart" }, - "customWidth": "50", - "name": "repositoriescreated", + "customWidth": "33", + "name": "query - 7 - Copy", "styleSettings": { - "showBorder": true + "padding": "20px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "GitHubAuditData \n| where Action == \"repo.transfer_outgoing\"\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\n| sort by TimeGenerated desc\n| project Time=TimeGenerated, Repository, Actor, Visibility", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend alertSecretType = alert.secret_type\n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertSecretType) and action_s in ('created')\n| summarize Count = count() by tostring(repositoryfullname)", "size": 0, - "title": "Ownership Transferred", - "timeContext": { - "durationMs": 86400000 - }, + "title": "Secrets by Repository", + "timeContextFromParameter": "TimeRange", + "timeBrushParameterName": "TimeRange", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "action_s", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "event_count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } }, - "customWidth": "50", - "name": "query - 5", + "customWidth": "33", + "name": "query - 7", "styleSettings": { - "showBorder": true + "padding": "20px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "GitHubAuditData \n| where Action == \"repo.archived\"\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\n| sort by TimeGenerated desc\n| project Time=TimeGenerated, Repository, Actor, Visibility", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend alertSecretType = alert.secret_type\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertSecretType) and action_s in ('created', 'resolved')\n| summarize Count = count() by bin(TimeGenerated, 1d), action_s", "size": 0, - "title": "Archived", + "title": "Secrets Found/Fixed Ratio", "timeContextFromParameter": "TimeRange", + "timeBrushParameterName": "TimeRange", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" }, - "customWidth": "50", - "name": "query - 9", + "customWidth": "33", + "name": "query - 7 - Copy", "styleSettings": { - "showBorder": true + "padding": "20px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "GitHubAuditData \n| where Action == \"repo.destroy\"\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\n| sort by TimeGenerated desc\n| project Time=TimeGenerated, Repository, Actor, Visibility", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend Secret_Type = alert.secret_type\n| extend Repository = todynamic(repository_s).full_name\n| extend Organization = todynamic(organization_s).login\n| extend Created_at = alert.created_at\n| extend Resolved_at = alert.resolved_at\n| extend Time_to_Resolution= format_timespan(todatetime(Resolved_at) - todatetime(Created_at), 'dd:hh:mm:ss' )\n| extend Resolution = case(isnotnull(alert.resolution), alert.resolution, \"Null\") \n| extend URL = todynamic(repository_s).url\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(Secret_Type) and action_s in ('resolved')\n|project Secret_Type, Organization, Repository, Resolution, Time_to_Resolution", "size": 0, - "title": "Deleted", + "title": "Fixed Secrets", "timeContextFromParameter": "TimeRange", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "filter": true, + "sortBy": [ + { + "itemKey": "Time_to_Resolution", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Secret_Type", + "label": "Secret Type" + }, + { + "columnId": "Time_to_Resolution", + "label": "Time to Resolution(dd:hh:mm:ss)" + } + ] + }, + "sortBy": [ + { + "itemKey": "Time_to_Resolution", + "sortOrder": 2 + } + ] }, - "customWidth": "50", - "name": "query - 8", - "styleSettings": { - "showBorder": true - } + "name": "query - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend Secret_Type = alert.secret_type\n| extend Repository = todynamic(repository_s).full_name\n| extend Organization = todynamic(organization_s).login\n| extend Created_at = alert.created_at\n| extend URL = alert.html_url\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(Secret_Type) and action_s in ('created')\n| project tostring(Secret_Type), tostring(Organization), tostring(Repository), tostring(URL), tostring(Created_at)", + "size": 0, + "title": "Found Secrets", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "URL", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url" + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "Created_at", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Secret_Type", + "label": "Secret Type" + }, + { + "columnId": "Created_at", + "label": "Created at" + } + ] + }, + "sortBy": [ + { + "itemKey": "Created_at", + "sortOrder": 2 + } + ] + }, + "name": "query - 1" } ] }, "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", - "value": "Recent Events" + "value": "Secret Scanning Alerts" }, - "name": "group - 7", - "styleSettings": { - "showBorder": true - } + "name": "Secret Scanning Alerts" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", - "title": "Top 10 Offenders", "items": [ + { + "type": 1, + "content": { + "json": "

Dependabot Alerts

" + }, + "name": "text - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend alert = todynamic(alert_s)\n| extend created_at = alert.created_at \n| extend resolved_at = alert.fixed_at\n| extend alertexternalidentifier= alert.external_identifier\n| extend day = todatetime(resolved_at) - todatetime(created_at)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertexternalidentifier) and action_s in ('resolve')\n| summarize format_timespan(avg(day), 'dd:hh:mm:ss')\n", + "size": 4, + "title": "Mean Time to Resolution (dd:hh:mm:ss)", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "card", + "gridSettings": { + "sortBy": [ + { + "itemKey": "MTTR", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "MTTR", + "sortOrder": 2 + } + ], + "textSettings": { + "style": "bignumber" + } + }, + "customWidth": "25", + "name": "query - 5" + }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "GitHubAuditData\n| where Action == \"repo.access\" and Visibility == \"public\"\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\n| summarize [\"Number of Bypasses\"] = count() by Actor\n| top 10 by ['Number of Bypasses'] desc\n| project-reorder ['Number of Bypasses'], Actor", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend Status = action_s\n| extend alertexternalidentifier= alert.external_identifier\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertexternalidentifier) and action_s in ('create')\n| count", + "size": 4, + "title": "Created", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "card", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Status", + "formatter": 5 + }, + { + "columnMatch": "Count", + "formatter": 1 + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Status", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false, + "size": "auto" + }, + "mapSettings": { + "locInfo": "LatLong", + "sizeSettings": "Count", + "sizeAggregation": "Sum", + "legendMetric": "Count", + "legendAggregation": "Sum", + "itemColorSettings": { + "type": "heatmap", + "colorAggregation": "Sum", + "nodeColorField": "Count", + "heatmapPalette": "greenRed" + } + }, + "textSettings": { + "style": "bignumber" + } + }, + "customWidth": "25", + "name": "query - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend Status = action_s\n| extend alertexternalidentifier= alert.external_identifier\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertexternalidentifier) and action_s in ('resolve')\n| count", + "size": 4, + "title": "Resolved", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "card", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Status", + "formatter": 5 + }, + { + "columnMatch": "Count", + "formatter": 1 + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Status", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false, + "size": "auto" + }, + "mapSettings": { + "locInfo": "LatLong", + "sizeSettings": "Count", + "sizeAggregation": "Sum", + "legendMetric": "Count", + "legendAggregation": "Sum", + "itemColorSettings": { + "type": "heatmap", + "colorAggregation": "Sum", + "nodeColorField": "Count", + "heatmapPalette": "greenRed" + } + }, + "textSettings": { + "style": "bignumber" + } + }, + "customWidth": "25", + "name": "query - 2 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend Status = action_s\n| extend alertexternalidentifier= alert.external_identifier\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertexternalidentifier) and action_s in ('dismiss')\n| count", + "size": 4, + "title": "Dismissed", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "card", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Status", + "formatter": 5 + }, + { + "columnMatch": "Count", + "formatter": 1 + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Status", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false, + "size": "auto" + }, + "mapSettings": { + "locInfo": "LatLong", + "sizeSettings": "Count", + "sizeAggregation": "Sum", + "legendMetric": "Count", + "legendAggregation": "Sum", + "itemColorSettings": { + "type": "heatmap", + "colorAggregation": "Sum", + "nodeColorField": "Count", + "heatmapPalette": "greenRed" + } + }, + "textSettings": { + "style": "bignumber" + } + }, + "customWidth": "25", + "name": "query - 2 - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend alertexternalidentifier = alert.external_identifier\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertexternalidentifier) and action_s in ('create', 'dismiss', 'resolve')\n| summarize Count = count() by tostring(action_s), bin(TimeGenerated,1d)", "size": 0, - "title": "Private Repos made Public by Actor", + "title": "Alert Found/Fixed Ratio", "timeContextFromParameter": "TimeRange", + "timeBrushParameterName": "TimeRange", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "create", + "label": "Found" + }, + { + "seriesName": "resolve", + "label": "Fixed" + }, + { + "seriesName": "dismiss", + "label": "Dismissed" + } + ] + } }, "customWidth": "33", - "name": "query - 1", + "name": "query - 7 - Copy", "styleSettings": { - "showBorder": true + "padding": "20px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "GitHubAuditData\n| where Action == \"protected_branch.policy_override\"\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\n| summarize [\"Number of Bypasses\"] = count() by Actor\n| top 10 by ['Number of Bypasses'] desc\n| project-reorder ['Number of Bypasses'], Actor", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend Repository = todynamic(repository_s).full_name\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend alertexternalidentifier = alert.external_identifier \n| extend Severity = alert.severity\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertexternalidentifier) and action_s in ('create')\n| summarize Count=count() by tostring(Repository)", "size": 0, - "title": "Branch Protection - Bypass by Actor", + "title": "Vulnerabilities by Repo", "timeContextFromParameter": "TimeRange", + "timeBrushParameterName": "TimeRange", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "gridSettings": { + "sortBy": [ + { + "itemKey": "Count", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "Count", + "sortOrder": 2 + } + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "action_s", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "event_count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } }, - "customWidth": "34", - "name": "query - 2", + "customWidth": "33", + "name": "query - 7", "styleSettings": { - "showBorder": true + "padding": "20px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "GitHubAuditData\n| where Action == \"secret_scanning_push_protection.bypass\"\n| where Actor in ({Actors}) and Repository in ({Repositories}) // parameter filter\n| summarize [\"Number of Bypasses\"] = count() by Actor\n| top 10 by ['Number of Bypasses'] desc\n| project-reorder ['Number of Bypasses'], Actor", - "size": 1, - "title": "Push Protection - Bypass by Actor", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend alertexternalidentifier = alert.external_identifier \n| extend Severity = alert.severity\n| extend Repository = todynamic(repository_s).full_name\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertexternalidentifier) and action_s in ('create')\n| summarize Count=count() by tostring(Severity), bin(TimeGenerated,1d)", + "size": 0, + "title": "New Alerts by Severity", "timeContextFromParameter": "TimeRange", + "timeBrushParameterName": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", - "textSettings": { - "style": "bignumber" - } + "visualization": "barchart" }, "customWidth": "33", - "name": "query - 5", + "name": "query - 7 - Copy", "styleSettings": { - "showBorder": true + "padding": "20px" } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend Action = todynamic(action_s)\n| extend alertexternalidentifier = alert.external_identifier \n| extend Severity = alert.severity\n| extend repo = todynamic(repository_s)\n| extend Alert_URL = alert.external_reference\n| extend Repository = repo.full_name\n| extend created_at = alert.created_at\n| extend resolved_at = case(isnotnull(alert.fixed_at), alert.fixed_at, alert.dismissed_at)\n| extend Time_to_Resolution = format_timespan(todatetime(resolved_at) - todatetime(created_at), 'dd:hh:mm:ss')\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertexternalidentifier) and action_s in ('resolve', 'dismiss')\n| project Action, Repository, Severity, Alert_URL, Time_to_Resolution", + "size": 0, + "title": "Fixed Alerts", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Alert_URL", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url" + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "Repository", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Time_to_Resolution", + "label": "Time to Resolution(dd:hh:mm:ss)" + } + ] + }, + "sortBy": [ + { + "itemKey": "Repository", + "sortOrder": 2 + } + ] + }, + "name": "query - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let repositoriesList = dynamic([{Repositories}]);\nlet repoTopics = dynamic([{Topics}]);\ngithubscanaudit_CL \n| extend repository = todynamic(repository_s)\n| extend repositoryfullname = repository.full_name\n| extend alert = todynamic(alert_s)\n| extend Action = todynamic(action_s)\n| extend alertexternalidentifier = alert.external_identifier \n| extend Severity = alert.severity\n| extend repo = todynamic(repository_s)\n| extend Alert_URL = alert.external_reference\n| extend Repository = repo.full_name\n| extend created_at = alert.created_at\n| extend resolved_at = alert.fixed_at\n| extend Time_to_Resolution = todatetime(resolved_at) - todatetime(created_at)\n| extend org = todynamic(organization_s)\n| extend orgFullName = org.login\n| extend topic = repository.topics\n| mv-apply repoTopics, topic on (\n mv-expand topic\n | extend Out = topic in (repoTopics)\n | summarize topic = make_list(topic), Out= make_list(Out)\n | project Out, topic\n)\n| extend areReposSelected = array_length((repositoriesList)) == 0\n| extend areTopicsSelected = array_length((repoTopics)) > 0\n| where\n (repositoryfullname in (repositoriesList) and orgFullName in ({Orgs})) or\n (set_has_element(Out, areTopicsSelected) and areTopicsSelected)\n| where isnotempty(alertexternalidentifier) and action_s in ('create')\n| summarize Total=count(Severity), Critical=countif(Severity=='critical'), High=countif(Severity=='high'), Medium=countif(Severity=='moderate'), Low=countif(Severity=='low') by tostring(Repository)", + "size": 0, + "title": "Alerts by Repo", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Critical", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "redDark", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "High", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "redBright", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Medium", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "orange", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Low", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "yellow", + "text": "{0}{1}" + } + ] + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "Total", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "Total", + "sortOrder": 2 + } + ] + }, + "name": "query - 1" } ] }, "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", - "value": "Top 10 Offenders" + "value": "Dependabot Alerts" }, - "name": "group - 7", - "styleSettings": { - "showBorder": true - } + "name": "Dependabot Alerts" } ], - "fromTemplateId": "sentinel-GitHubSecurity", + "fallbackResourceIds": [], + "fromTemplateId": "GitHubAdvancedSecurity - topics", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" -} \ No newline at end of file +} diff --git a/Solutions/Cyberpion/Analytic Rules/HighUrgencyActionItems.yaml b/Solutions/IONIX/Analytic Rules/HighUrgencyActionItems.yaml similarity index 88% rename from Solutions/Cyberpion/Analytic Rules/HighUrgencyActionItems.yaml rename to Solutions/IONIX/Analytic Rules/HighUrgencyActionItems.yaml index 3e80629ca5e..5de1074ce13 100644 --- a/Solutions/Cyberpion/Analytic Rules/HighUrgencyActionItems.yaml +++ b/Solutions/IONIX/Analytic Rules/HighUrgencyActionItems.yaml @@ -1,7 +1,7 @@ id: 8e0403b1-07f8-4865-b2e9-74d1e83200a4 -name: High Urgency Cyberpion Action Items +name: High Urgency IONIX Action Items description: | - 'This query creates an alert for active Cyberpion Action Items with high urgency (9-10). + 'This query creates an alert for active IONIX Action Items with high urgency (9-10). Urgency can be altered using the "min_urgency" variable in the query.' severity: High status: Available @@ -38,5 +38,5 @@ entityMappings: fieldMappings: - identifier: DomainName columnName: DNSCustomEntity -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Cyberpion/Data Connectors/CyberpionSecurityLogs.json b/Solutions/IONIX/Data Connectors/IONIXSecurityLogs.json similarity index 80% rename from Solutions/Cyberpion/Data Connectors/CyberpionSecurityLogs.json rename to Solutions/IONIX/Data Connectors/IONIXSecurityLogs.json index 61bd35a45bb..d870cbbf387 100644 --- a/Solutions/Cyberpion/Data Connectors/CyberpionSecurityLogs.json +++ b/Solutions/IONIX/Data Connectors/IONIXSecurityLogs.json @@ -1,8 +1,8 @@ { "id": "CyberpionSecurityLogs", - "title": "Cyberpion Security Logs", - "publisher": "Cyberpion", - "descriptionMarkdown": "The Cyberpion Security Logs data connector, ingests logs from the Cyberpion system directly into Sentinel. The connector allows users to visualize their data, create alerts and incidents and improve security investigations.", + "title": "IONIX Security Logs", + "publisher": "IONIX", + "descriptionMarkdown": "The IONIX Security Logs data connector, ingests logs from the IONIX system directly into Sentinel. The connector allows users to visualize their data, create alerts and incidents and improve security investigations.", "graphQueries": [ { "metricName": "Total data received", @@ -59,15 +59,15 @@ ], "customs": [ { - "name": "Cyberpion Subscription", - "description": "a subscription and account is required for cyberpion logs. [One can be acquired here.](https://azuremarketplace.microsoft.com/en/marketplace/apps/cyberpion1597832716616.cyberpion)" + "name": "IONIX Subscription", + "description": "a subscription and account is required for IONIX logs. [One can be acquired here.](https://azuremarketplace.microsoft.com/en/marketplace/apps/cyberpion1597832716616.cyberpion)" } ] }, "instructionSteps": [ { "title": "", - "description": "Follow the [instructions](https://www.cyberpion.com/resource-center/integrations/azure-sentinel/) to integrate Cyberpion Security Alerts into Sentinel.", + "description": "Follow the [instructions](https://www.ionix.io/integrations/azure-sentinel/) to integrate IONIX Security Alerts into Sentinel.", "instructions": [ { "parameters": { diff --git a/Solutions/IONIX/Data/Solution_IONIX.json b/Solutions/IONIX/Data/Solution_IONIX.json new file mode 100644 index 00000000000..027b95ca000 --- /dev/null +++ b/Solutions/IONIX/Data/Solution_IONIX.json @@ -0,0 +1,20 @@ +{ + "Name": "IONIX", + "Author": "IONIX", + "Logo": "", + "Description": "The [IONIX](https://ionix.io/) solution for Microsoft Sentinel enables you to ingest vulnerability logs from the IONIX platform into Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution is dependent on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Codeless Connector Platform/Native Sentinel Polling](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal)", + "Data Connectors": [ + "Data Connectors/IONIXSecurityLogs.json" + ], + "Analytic Rules": [ + "Analytic Rules/HighUrgencyActionItems.yaml" + ], + "Workbooks": [ + "Workbooks/IONIXOverviewWorkbook.json" + ], + "BasePath": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/IONIX", + "Version": "3.0.0", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1Pconnector": false +} \ No newline at end of file diff --git a/Solutions/Cyberpion/Package/2.0.0.zip b/Solutions/IONIX/Package/2.0.0.zip similarity index 100% rename from Solutions/Cyberpion/Package/2.0.0.zip rename to Solutions/IONIX/Package/2.0.0.zip diff --git a/Solutions/Cyberpion/Package/2.0.1.zip b/Solutions/IONIX/Package/2.0.1.zip similarity index 100% rename from Solutions/Cyberpion/Package/2.0.1.zip rename to Solutions/IONIX/Package/2.0.1.zip diff --git a/Solutions/IONIX/Package/3.0.0.zip b/Solutions/IONIX/Package/3.0.0.zip new file mode 100644 index 00000000000..4009f466a33 Binary files /dev/null and b/Solutions/IONIX/Package/3.0.0.zip differ diff --git a/Solutions/Cyberpion/Package/createUiDefinition.json b/Solutions/IONIX/Package/createUiDefinition.json old mode 100644 new mode 100755 similarity index 70% rename from Solutions/Cyberpion/Package/createUiDefinition.json rename to Solutions/IONIX/Package/createUiDefinition.json index 2cc2cda9068..3581e0c262e --- a/Solutions/Cyberpion/Package/createUiDefinition.json +++ b/Solutions/IONIX/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Cyberpion](https://www.cyberpion.com/) solution for Microsoft Sentinel enables you to ingest vulnerability logs from the Cyberpion platform into Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution is dependent on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Codeless Connector Platform/Native Sentinel Polling](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal)\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IONIX/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [IONIX](https://ionix.io/) solution for Microsoft Sentinel enables you to ingest vulnerability logs from the IONIX platform into Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution is dependent on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Codeless Connector Platform/Native Microsoft Sentinel Polling](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal)\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,7 +60,7 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This solution installs the data connector for ingesting Cyberpion logs into Microsoft Sentinel, using Codeless Connector Platform and Native Sentinel Polling. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This Solution installs the data connector for IONIX. You can get IONIX custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { @@ -100,6 +100,20 @@ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data" } } + }, + { + "name": "workbook1", + "type": "Microsoft.Common.Section", + "label": "IONIX Overview", + "elements": [ + { + "name": "workbook1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Gain insights into your IONIX Security Logs." + } + } + ] } ] }, @@ -132,13 +146,13 @@ { "name": "analytic1", "type": "Microsoft.Common.Section", - "label": "High Urgency Cyberpion Action Items", + "label": "High Urgency IONIX Action Items", "elements": [ { "name": "analytic1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This query creates an alert for active Cyberpion Action Items with high urgency (9-10).\n Urgency can be altered using the \"min_urgency\" variable in the query." + "text": "Creates an alert for active IONIX Action Items with high urgency (9-10)." } } ] diff --git a/Solutions/Cyberpion/Package/mainTemplate.json b/Solutions/IONIX/Package/mainTemplate.json old mode 100644 new mode 100755 similarity index 57% rename from Solutions/Cyberpion/Package/mainTemplate.json rename to Solutions/IONIX/Package/mainTemplate.json index 66bfc16b349..71b8cd1bad1 --- a/Solutions/Cyberpion/Package/mainTemplate.json +++ b/Solutions/IONIX/Package/mainTemplate.json @@ -2,8 +2,8 @@ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { - "author": "Cyberpion", - "comments": "Solution template for Cyberpion" + "author": "IONIX", + "comments": "Solution template for IONIX" }, "parameters": { "location": { @@ -30,7 +30,7 @@ }, "workbook1-name": { "type": "string", - "defaultValue": "Cyberpion Overview", + "defaultValue": "IONIX Overview", "minLength": 1, "metadata": { "description": "Name for the workbook" @@ -38,57 +38,49 @@ } }, "variables": { + "_solutionName": "IONIX", + "_solutionVersion": "3.0.0", "solutionId": "cyberpion1597832716616.cyberpion_mss", "_solutionId": "[variables('solutionId')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "uiConfigId1": "CyberpionSecurityLogs", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "CyberpionSecurityLogs", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", - "dataConnectorVersion1": "1.0.0", - "analyticRuleVersion1": "1.0.0", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", + "dataConnectorVersion1": "1.0.1", + "dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "_dataConnectorcontentProductId1": "[variables('dataConnectorcontentProductId1')]", + "analyticRuleVersion1": "1.0.1", "analyticRulecontentId1": "8e0403b1-07f8-4865-b2e9-74d1e83200a4", "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1')))]", - "workbookVersion1": "1.0.0", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))))]", + "analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId1'),'-', variables('analyticRuleVersion1'))))]", + "_analyticRulecontentProductId1": "[variables('analyticRulecontentProductId1')]", + "workbookVersion1": "1.0.1", "workbookContentId1": "CyberpionOverviewWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", - "_workbookContentId1": "[variables('workbookContentId1')]" + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", + "_workbookContentId1": "[variables('workbookContentId1')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "_workbookcontentProductId1": "[variables('workbookcontentProductId1')]", + "solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]", + "_solutioncontentProductId": "[variables('solutioncontentProductId')]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "Cyberpion data connector with template", - "displayName": "Cyberpion template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cyberpion data connector with template version 2.0.1", + "description": "IONIX data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -104,9 +96,9 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId1')]", - "title": "Cyberpion Security Logs", - "publisher": "Cyberpion", - "descriptionMarkdown": "The Cyberpion Security Logs data connector, ingests logs from the Cyberpion system directly into Sentinel. The connector allows users to visualize their data, create alerts and incidents and improve security investigations.", + "title": "IONIX Security Logs", + "publisher": "IONIX", + "descriptionMarkdown": "The IONIX Security Logs data connector, ingests logs from the IONIX system directly into Sentinel. The connector allows users to visualize their data, create alerts and incidents and improve security investigations.", "graphQueries": [ { "metricName": "Total data received", @@ -163,14 +155,14 @@ ], "customs": [ { - "name": "Cyberpion Subscription", - "description": "a subscription and account is required for cyberpion logs. [One can be acquired here.](https://azuremarketplace.microsoft.com/en/marketplace/apps/cyberpion1597832716616.cyberpion)" + "name": "IONIX Subscription", + "description": "a subscription and account is required for IONIX logs. [One can be acquired here.](https://azuremarketplace.microsoft.com/en/marketplace/apps/cyberpion1597832716616.cyberpion)" } ] }, "instructionSteps": [ { - "description": "Follow the [instructions](https://www.cyberpion.com/resource-center/integrations/azure-sentinel/) to integrate Cyberpion Security Alerts into Sentinel.", + "description": "Follow the [instructions](https://www.ionix.io/integrations/azure-sentinel/) to integrate IONIX Security Alerts into Sentinel.", "instructions": [ { "parameters": { @@ -198,7 +190,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -207,26 +199,38 @@ "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", - "name": "Cyberpion", + "name": "IONIX", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "Cyberpion" + "name": "IONIX" }, "support": { - "name": "Cyberpion", + "name": "IONIX", + "email": "support@ionix.io", "tier": "Partner", - "link": "https://www.cyberpion.com/contact/" + "link": "https://www.ionix.io/contact-us/" } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "IONIX Security Logs", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -239,16 +243,17 @@ "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", - "name": "Cyberpion", + "name": "IONIX", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "Cyberpion" + "name": "IONIX" }, "support": { - "name": "Cyberpion", + "name": "IONIX", + "email": "support@ionix.io", "tier": "Partner", - "link": "https://www.cyberpion.com/contact/" + "link": "https://www.ionix.io/contact-us/" } } }, @@ -260,9 +265,9 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Cyberpion Security Logs", - "publisher": "Cyberpion", - "descriptionMarkdown": "The Cyberpion Security Logs data connector, ingests logs from the Cyberpion system directly into Sentinel. The connector allows users to visualize their data, create alerts and incidents and improve security investigations.", + "title": "IONIX Security Logs", + "publisher": "IONIX", + "descriptionMarkdown": "The IONIX Security Logs data connector, ingests logs from the IONIX system directly into Sentinel. The connector allows users to visualize their data, create alerts and incidents and improve security investigations.", "graphQueries": [ { "metricName": "Total data received", @@ -319,14 +324,14 @@ ], "customs": [ { - "name": "Cyberpion Subscription", - "description": "a subscription and account is required for cyberpion logs. [One can be acquired here.](https://azuremarketplace.microsoft.com/en/marketplace/apps/cyberpion1597832716616.cyberpion)" + "name": "IONIX Subscription", + "description": "a subscription and account is required for IONIX logs. [One can be acquired here.](https://azuremarketplace.microsoft.com/en/marketplace/apps/cyberpion1597832716616.cyberpion)" } ] }, "instructionSteps": [ { - "description": "Follow the [instructions](https://www.cyberpion.com/resource-center/integrations/azure-sentinel/) to integrate Cyberpion Security Alerts into Sentinel.", + "description": "Follow the [instructions](https://www.ionix.io/integrations/azure-sentinel/) to integrate IONIX Security Alerts into Sentinel.", "instructions": [ { "parameters": { @@ -354,33 +359,15 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Cyberpion Analytics Rule 1 with template", - "displayName": "Cyberpion Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName1'),'/',variables('analyticRuleVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "HighUrgencyActionItems_AnalyticalRules Analytics Rule with template version 2.0.1", + "description": "HighUrgencyActionItems_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion1')]", @@ -389,13 +376,13 @@ "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId1')]", + "name": "[variables('analyticRulecontentId1')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "This query creates an alert for active Cyberpion Action Items with high urgency (9-10).\n Urgency can be altered using the \"min_urgency\" variable in the query.", - "displayName": "High Urgency Cyberpion Action Items", + "description": "This query creates an alert for active IONIX Action Items with high urgency (9-10).\n Urgency can be altered using the \"min_urgency\" variable in the query.", + "displayName": "High Urgency IONIX Action Items", "enabled": false, "query": "let timeframe = 14d;\nlet time_generated_bucket = 1h;\nlet min_urgency = 9;\nlet maxTimeGeneratedBucket = toscalar(\n CyberpionActionItems_CL\n | where TimeGenerated > ago(timeframe)\n | summarize max(bin(TimeGenerated, time_generated_bucket))\n );\nCyberpionActionItems_CL\n | where TimeGenerated > ago(timeframe) and is_open_b == true\n | where bin(TimeGenerated, time_generated_bucket) == maxTimeGeneratedBucket\n | where urgency_d >= min_urgency\n | extend timestamp = opening_datetime_t\n | extend DNSCustomEntity = host_s\n", "queryFrequency": "P1D", @@ -408,22 +395,26 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "CyberpionSecurityLogs", "dataTypes": [ "CyberpionActionItems_CL" - ], - "connectorId": "CyberpionSecurityLogs" + ] } ], "tactics": [ "InitialAccess" ], + "techniques": [ + "T1190", + "T1195" + ], "entityMappings": [ { "entityType": "DNS", "fieldMappings": [ { - "columnName": "DNSCustomEntity", - "identifier": "DomainName" + "identifier": "DomainName", + "columnName": "DNSCustomEntity" } ] } @@ -435,58 +426,52 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", "properties": { - "description": "Cyberpion Analytics Rule 1", + "description": "IONIX Analytics Rule 1", "parentId": "[variables('analyticRuleId1')]", "contentId": "[variables('_analyticRulecontentId1')]", "kind": "AnalyticsRule", "version": "[variables('analyticRuleVersion1')]", "source": { "kind": "Solution", - "name": "Cyberpion", + "name": "IONIX", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "Cyberpion" + "name": "IONIX" }, "support": { - "name": "Cyberpion", + "name": "IONIX", + "email": "support@ionix.io", "tier": "Partner", - "link": "https://www.cyberpion.com/contact/" + "link": "https://www.ionix.io/contact-us/" } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId1')]", + "contentKind": "AnalyticsRule", + "displayName": "High Urgency IONIX Action Items", + "contentProductId": "[variables('_analyticRulecontentProductId1')]", + "id": "[variables('_analyticRulecontentProductId1')]", + "version": "[variables('analyticRuleVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "properties": { - "description": "Cyberpion Workbook with template", - "displayName": "Cyberpion workbook template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CyberpionOverviewWorkbookWorkbook Workbook with template version 2.0.1", + "description": "IONIXOverviewWorkbookWorkbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -500,11 +485,11 @@ "kind": "shared", "apiVersion": "2021-08-01", "metadata": { - "description": "Use Cyberpion's Security Logs and this workbook, to get an overview of your online assets, gain insights into their current state, and find ways to better secure your ecosystem." + "description": "" }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Cyberpion Action Items\"},\"name\":\"text - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Current Open Action Items\",\"expandable\":true,\"expanded\":true,\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let lookbackTime = 14d;\\nlet bucketTimeSpan = 1h;\\nlet maxTimeGeneratedBucket = toscalar(CyberpionActionItems_CL | where TimeGenerated > ago(lookbackTime)| summarize max(bin(TimeGenerated, bucketTimeSpan)));\\nCyberpionActionItems_CL\\n | where TimeGenerated > ago(lookbackTime) and is_open_b == true\\n | extend TimeGeneratedBucket = bin(TimeGenerated, bucketTimeSpan)\\n | where TimeGeneratedBucket == maxTimeGeneratedBucket\\n | summarize count() by Category\\n | render barchart\\n\\n\",\"size\":0,\"title\":\"Action Items by Category\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"action-items-by-category\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let lookbackTime = 14d;\\nlet bucketTimeSpan = 1h;\\nlet maxTimeGeneratedBucket = toscalar(CyberpionActionItems_CL | where TimeGenerated > ago(lookbackTime)| summarize max(bin(TimeGenerated, bucketTimeSpan)));\\nCyberpionActionItems_CL\\n | where TimeGenerated > ago(lookbackTime) and is_open_b == true\\n | extend TimeGeneratedBucket = bin(TimeGenerated, bucketTimeSpan)\\n | where TimeGeneratedBucket == maxTimeGeneratedBucket\\n | summarize count() by solution_s\\n | render piechart\",\"size\":0,\"title\":\"Most Common Solutions\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"most-common-solution\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let lookbackTime = 14d;\\nlet bucketTimeSpan = 1h;\\nlet maxTimeGeneratedBucket = toscalar(CyberpionActionItems_CL | where TimeGenerated > ago(lookbackTime)| summarize max(bin(TimeGenerated, bucketTimeSpan)));\\nCyberpionActionItems_CL\\n | where TimeGenerated > ago(lookbackTime) and is_open_b == true\\n | extend TimeGeneratedBucket = bin(TimeGenerated, bucketTimeSpan)\\n | where TimeGeneratedBucket == maxTimeGeneratedBucket\\n | extend Urgency = bin(urgency_d, 1)\\n | summarize count() by Urgency\\n | join kind=rightouter (range Urgency from 1.0 to 10.0 step 1) on Urgency\\n | project Urgency = Urgency1, Count = iff(isnotempty(count_), count_, 0)\\n | sort by Urgency asc\\n | extend Urgency = tostring(Urgency)\\n | render barchart\\n\\n\",\"size\":0,\"title\":\"Action Items Count by Urgency\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"chartSettings\":{\"createOtherGroup\":0,\"xSettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}},\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"50\",\"name\":\"open-ai-urgency-bars\"}]},\"name\":\"current-ais\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Historical Info\",\"expandable\":true,\"expanded\":true,\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"e8bb48b6-6706-48bd-b8a1-94de288bcb4c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let lookbackTime = now(-{TimeRange:seconds}s);\\nlet bucketTimeSpan = 1h;\\nCyberpionActionItems_CL\\n | where TimeGenerated > lookbackTime and is_open_b == true\\n | project id_s, TimeGenerated\\n | make-series count() default=long(null) on TimeGenerated from bin(lookbackTime, bucketTimeSpan) to now() step bucketTimeSpan\\n | extend open_action_items=series_fill_forward(count_, long(null))\\n | project TimeGenerated, open_action_items\\n | mv-expand TimeGenerated to typeof(datetime), open_action_items to typeof(int)\\n | where isnotnull(open_action_items)\\n | render timechart\",\"size\":0,\"aggregation\":5,\"title\":\"Open Action Items over time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"action-items-over-time\"}]},\"name\":\"historical-data\"}],\"fromTemplateId\":\"sentinel-CyberpionOverviewWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## IONIX Action Items\"},\"name\":\"text - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Current Open Action Items\",\"expandable\":true,\"expanded\":true,\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let lookbackTime = 14d;\\nlet bucketTimeSpan = 1h;\\nlet maxTimeGeneratedBucket = toscalar(CyberpionActionItems_CL | where TimeGenerated > ago(lookbackTime)| summarize max(bin(TimeGenerated, bucketTimeSpan)));\\nCyberpionActionItems_CL\\n | where TimeGenerated > ago(lookbackTime) and is_open_b == true\\n | extend TimeGeneratedBucket = bin(TimeGenerated, bucketTimeSpan)\\n | where TimeGeneratedBucket == maxTimeGeneratedBucket\\n | summarize count() by Category\\n | render barchart\\n\\n\",\"size\":0,\"title\":\"Action Items by Category\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"action-items-by-category\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let lookbackTime = 14d;\\nlet bucketTimeSpan = 1h;\\nlet maxTimeGeneratedBucket = toscalar(CyberpionActionItems_CL | where TimeGenerated > ago(lookbackTime)| summarize max(bin(TimeGenerated, bucketTimeSpan)));\\nCyberpionActionItems_CL\\n | where TimeGenerated > ago(lookbackTime) and is_open_b == true\\n | extend TimeGeneratedBucket = bin(TimeGenerated, bucketTimeSpan)\\n | where TimeGeneratedBucket == maxTimeGeneratedBucket\\n | summarize count() by solution_s\\n | render piechart\",\"size\":0,\"title\":\"Most Common Solutions\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"most-common-solution\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let lookbackTime = 14d;\\nlet bucketTimeSpan = 1h;\\nlet maxTimeGeneratedBucket = toscalar(CyberpionActionItems_CL | where TimeGenerated > ago(lookbackTime)| summarize max(bin(TimeGenerated, bucketTimeSpan)));\\nCyberpionActionItems_CL\\n | where TimeGenerated > ago(lookbackTime) and is_open_b == true\\n | extend TimeGeneratedBucket = bin(TimeGenerated, bucketTimeSpan)\\n | where TimeGeneratedBucket == maxTimeGeneratedBucket\\n | extend Urgency = bin(urgency_d, 1)\\n | summarize count() by Urgency\\n | join kind=rightouter (range Urgency from 1.0 to 10.0 step 1) on Urgency\\n | project Urgency = Urgency1, Count = iff(isnotempty(count_), count_, 0)\\n | sort by Urgency asc\\n | extend Urgency = tostring(Urgency)\\n | render barchart\\n\\n\",\"size\":0,\"title\":\"Action Items Count by Urgency\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"chartSettings\":{\"group\":\"\",\"createOtherGroup\":0,\"xSettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}},\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"50\",\"name\":\"open-ai-urgency-bars\"}]},\"name\":\"current-ais\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Historical Info\",\"expandable\":true,\"expanded\":true,\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"e8bb48b6-6706-48bd-b8a1-94de288bcb4c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let lookbackTime = now(-{TimeRange:seconds}s);\\nlet bucketTimeSpan = 1h;\\nCyberpionActionItems_CL\\n | where TimeGenerated > lookbackTime and is_open_b == true\\n | project id_s, TimeGenerated\\n | make-series count() default=long(null) on TimeGenerated from bin(lookbackTime, bucketTimeSpan) to now() step bucketTimeSpan\\n | extend open_action_items=series_fill_forward(count_, long(null))\\n | project TimeGenerated, open_action_items\\n | mv-expand TimeGenerated to typeof(datetime), open_action_items to typeof(int)\\n | where isnotnull(open_action_items)\\n | render timechart\",\"size\":0,\"aggregation\":5,\"title\":\"Open Action Items over time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"action-items-over-time\"}]},\"name\":\"historical-data\"}],\"fromTemplateId\":\"sentinel-CyberpionOverviewWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -515,65 +500,72 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "description": "@{workbookKey=CyberpionOverviewWorkbook; logoFileName=cyberpion_logo.svg; description=Use Cyberpion's Security Logs and this workbook, to get an overview of your online assets, gain insights into their current state, and find ways to better secure your ecosystem.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Cyberpion Overview; templateRelativePath=CyberpionOverviewWorkbook.json; subtitle=; provider=Cyberpion}.description", + "description": ".description", "parentId": "[variables('workbookId1')]", "contentId": "[variables('_workbookContentId1')]", "kind": "Workbook", "version": "[variables('workbookVersion1')]", "source": { "kind": "Solution", - "name": "Cyberpion", + "name": "IONIX", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "Cyberpion" + "name": "IONIX" }, "support": { - "name": "Cyberpion", + "name": "IONIX", + "email": "support@ionix.io", "tier": "Partner", - "link": "https://www.cyberpion.com/contact/" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "contentId": "CyberpionActionItems_CL", - "kind": "DataType" - }, - { - "contentId": "CyberpionSecurityLogs", - "kind": "DataConnector" - } - ] + "link": "https://www.ionix.io/contact-us/" } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.1", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "IONIX", + "publisherDisplayName": "IONIX", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The IONIX solution for Microsoft Sentinel enables you to ingest vulnerability logs from the IONIX platform into Microsoft Sentinel.

\n

Underlying Microsoft Technologies used:

\n

This solution is dependent on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Codeless Connector Platform/Native Sentinel Polling
    2. \n
\n

Data Connectors: 1, Workbooks: 1, Analytic Rules: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { "kind": "Solution", - "name": "Cyberpion", + "name": "IONIX", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "Cyberpion" + "name": "IONIX" }, "support": { - "name": "Cyberpion", + "name": "IONIX", + "email": "support@ionix.io", "tier": "Partner", - "link": "https://www.cyberpion.com/contact/" + "link": "https://www.ionix.io/contact-us/" }, "dependencies": { "operator": "AND", @@ -597,7 +589,7 @@ }, "firstPublishDate": "2022-05-02", "providers": [ - "Cyberpion" + "IONIX" ], "categories": { "domains": [ diff --git a/Solutions/IONIX/ReleaseNotes.md b/Solutions/IONIX/ReleaseNotes.md new file mode 100644 index 00000000000..b6f11b13579 --- /dev/null +++ b/Solutions/IONIX/ReleaseNotes.md @@ -0,0 +1,5 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------------------------------------------------------| +| 3.0.0 | 20-09-2023 | A UI-only update as part of a re-branding from "Cyberpion" to "IONIX" (no change to core functionality) \| v1.0.1 | + + diff --git a/Solutions/Cyberpion/SolutionMetadata.json b/Solutions/IONIX/SolutionMetadata.json similarity index 65% rename from Solutions/Cyberpion/SolutionMetadata.json rename to Solutions/IONIX/SolutionMetadata.json index 1a81096923b..0303cbc96e5 100644 --- a/Solutions/Cyberpion/SolutionMetadata.json +++ b/Solutions/IONIX/SolutionMetadata.json @@ -2,15 +2,16 @@ "publisherId": "cyberpion1597832716616", "offerId": "cyberpion_mss", "firstPublishDate": "2022-05-02", - "providers": ["Cyberpion"], + "providers": ["IONIX"], "categories": { "domains" : ["Security - Threat Protection"], "verticals": [] }, "support": { - "name": "Cyberpion", + "name": "IONIX", + "email": "support@ionix.io", "tier": "Partner", - "link": "https://www.cyberpion.com/contact/" + "link": "https://www.ionix.io/contact-us/" } } diff --git a/Solutions/Cyberpion/Workbooks/CyberpionOverviewWorkbook.json b/Solutions/IONIX/Workbooks/IONIXOverviewWorkbook.json similarity index 99% rename from Solutions/Cyberpion/Workbooks/CyberpionOverviewWorkbook.json rename to Solutions/IONIX/Workbooks/IONIXOverviewWorkbook.json index 744826a7202..5888db9dd25 100644 --- a/Solutions/Cyberpion/Workbooks/CyberpionOverviewWorkbook.json +++ b/Solutions/IONIX/Workbooks/IONIXOverviewWorkbook.json @@ -4,7 +4,7 @@ { "type": 1, "content": { - "json": "## Cyberpion Action Items" + "json": "## IONIX Action Items" }, "name": "text - 2" }, diff --git a/Solutions/IONIX/Workbooks/Images/Logos/ionix-logo.svg b/Solutions/IONIX/Workbooks/Images/Logos/ionix-logo.svg new file mode 100644 index 00000000000..26f7d3cb422 --- /dev/null +++ b/Solutions/IONIX/Workbooks/Images/Logos/ionix-logo.svg @@ -0,0 +1,14 @@ + + + + diff --git a/Solutions/IONIX/Workbooks/Images/Previews/IONIXActionItemsBlack.png b/Solutions/IONIX/Workbooks/Images/Previews/IONIXActionItemsBlack.png new file mode 100644 index 00000000000..e3eb2a2621b Binary files /dev/null and b/Solutions/IONIX/Workbooks/Images/Previews/IONIXActionItemsBlack.png differ diff --git a/Solutions/IONIX/Workbooks/Images/Previews/IONIXActionItemsWhite.png b/Solutions/IONIX/Workbooks/Images/Previews/IONIXActionItemsWhite.png new file mode 100644 index 00000000000..5887b4bcc5b Binary files /dev/null and b/Solutions/IONIX/Workbooks/Images/Previews/IONIXActionItemsWhite.png differ diff --git a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/GetInboxRule/function.json b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/GetInboxRule/function.json new file mode 100644 index 00000000000..e03b7547950 --- /dev/null +++ b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/GetInboxRule/function.json @@ -0,0 +1,19 @@ +{ + "bindings": [ + { + "authLevel": "function", + "type": "httpTrigger", + "direction": "in", + "name": "Request", + "methods": [ + "get", + "post" + ] + }, + { + "type": "http", + "direction": "out", + "name": "Response" + } + ] +} diff --git a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/GetInboxRule/run.ps1 b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/GetInboxRule/run.ps1 new file mode 100644 index 00000000000..178c2b8271d --- /dev/null +++ b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/GetInboxRule/run.ps1 @@ -0,0 +1,44 @@ +using namespace System.Net + +# Input bindings are passed in via param block. +param($Request, $TriggerMetadata) +$flag = 0 +# Write to the Azure Functions log stream. +Write-Host "Fetching list of Malware policies" + +$Mailbox = $Request.Body.Mailbox +# Interact with query parameters or the body of the request. + +try{ +if($Mailbox) +{ + $Result = Get-InboxRule -Mailbox "$Mailbox" + if($?){Write-Host "Successfully fetched list of Inbox Rules" + $flag = 1 +} + else + {Write-Host "Failed to fetch list of Inbox Rules"} + +}else + {Write-Host "Mailbox not provided : Failed to fetch list of Inbox Rules"} +} + +catch{ + Write-Host "$_.Exception" + $Result = "$_.Exception" +} + +finally{ +if($flag){ + # Associate values to output bindings by calling 'Push-OutputBinding'. + Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = $Result + })}else{ + + Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = $Result + }) + } +} diff --git a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/O365DefenderFunctionApp.zip b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/O365DefenderFunctionApp.zip index fdfac24ccb9..b4812ae5379 100644 Binary files a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/O365DefenderFunctionApp.zip and b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/O365DefenderFunctionApp.zip differ diff --git a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/RemoveInboxRule/function.json b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/RemoveInboxRule/function.json new file mode 100644 index 00000000000..e03b7547950 --- /dev/null +++ b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/RemoveInboxRule/function.json @@ -0,0 +1,19 @@ +{ + "bindings": [ + { + "authLevel": "function", + "type": "httpTrigger", + "direction": "in", + "name": "Request", + "methods": [ + "get", + "post" + ] + }, + { + "type": "http", + "direction": "out", + "name": "Response" + } + ] +} diff --git a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/RemoveInboxRule/run.ps1 b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/RemoveInboxRule/run.ps1 new file mode 100644 index 00000000000..be8cc5f8721 --- /dev/null +++ b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/RemoveInboxRule/run.ps1 @@ -0,0 +1,45 @@ +using namespace System.Net + +# Input bindings are passed in via param block. +param($Request, $TriggerMetadata) +$flag = 0 +# Write to the Azure Functions log stream. +Write-Host "Proceeding with delete of Inbox Rule" + +$Mailbox = $Request.Body.Mailbox +$Identity = $Request.Body.Identity +# Interact with query parameters or the body of the request. + +try{ +if($Mailbox -AND $Identity) +{ + $Result = Remove-InboxRule -Mailbox "$Mailbox" -Identity "$Identity" -Confirm:$false + if($?){Write-Host "Successfully Deleted the rule" + $flag = 1 +} + else + {Write-Host "Failed to delete Inbox Rules"} + +}else + {Write-Host "Mailbox or Identity not provided : Failed to delete Inbox Rules"} +} + +catch{ + Write-Host "$_.Exception" + $Result = "$_.Exception" +} + +finally{ +if($flag){ + # Associate values to output bindings by calling 'Push-OutputBinding'. + Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = $Result + })}else{ + + Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = $Result + }) + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/readme.md b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/readme.md index bedaac14ac9..960a8ac2689 100644 --- a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/readme.md +++ b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/readme.md @@ -26,6 +26,8 @@ This Functions App Connector is to connect Defender for office 365 API. | **RemoveAllowBlockListItems** | Remove entries for email addresses from the Tenant Allow/Block List | | **ListMalwarePolicy** | View existing malware filter policies| | **BlockMalwareFileExtension** | Add Malware file extensions to malware policy block list | +| **GetInboxRule** | View list of existing Rules created in mailbox | +| **RemoveInboxRule** | Remove the Inbox rule from particular Mailbox | ### Deployment Instructions @@ -113,6 +115,15 @@ This Functions App Connector is to connect Defender for office 365 API. - { "MalwarePolicyName": "malware policy Name", "FileExtensions": "malicious file extension to be mark as blocked" for example["dgz","mde"] + } +12. GetInboxRule + - { + "Mailbox" : "mailbox name ex: abc@yahoo.com" + } +13. RemoveInboxRule + - { + "Mailbox" : "mailbox name ex: abc@yahoo.com", + "Identity" : "inbox rule name/RuleIdentity property" } ### References below link for more details diff --git a/Solutions/MicrosoftPurviewInsiderRiskManagement/Package/3.0.1.zip b/Solutions/MicrosoftPurviewInsiderRiskManagement/Package/3.0.1.zip index 81c701d33d7..5e4b7f0200a 100644 Binary files a/Solutions/MicrosoftPurviewInsiderRiskManagement/Package/3.0.1.zip and b/Solutions/MicrosoftPurviewInsiderRiskManagement/Package/3.0.1.zip differ diff --git a/Solutions/MicrosoftPurviewInsiderRiskManagement/Package/mainTemplate.json b/Solutions/MicrosoftPurviewInsiderRiskManagement/Package/mainTemplate.json index 3b041f930d4..b0bfbcd8202 100644 --- a/Solutions/MicrosoftPurviewInsiderRiskManagement/Package/mainTemplate.json +++ b/Solutions/MicrosoftPurviewInsiderRiskManagement/Package/mainTemplate.json @@ -975,7 +975,7 @@ "type": "ApiConnection", "inputs": { "body": { - "messageBody": "

Insider Risk Team,
\n
\nAn Insider Risk Management Alert was observed per the details below:
\n
\nSeverity of Alert: @{items('For_each')?['properties']?['severity']}
\n
\nAzure Sentinel Incident
\nTItle: @{triggerBody()?['object']?['properties']?['title']}
\nStatus: @{triggerBody()?['object']?['properties']?['status']}
\nNumber: @{triggerBody()?['object']?['properties']?['incidentNumber']}
\nCreated Time (UTC): @{triggerBody()?['object']?['properties']?['createdTimeUtc']}
\nIncident Link:  @{triggerBody()?['object']?['properties']?['incidentUrl']}
\n
\nAlert Details
\nAlert Display Name: @{items('For_each')?['properties']?['alertDisplayName']}
\nAlert Type: @{items('For_each')?['properties']?['alertType']}
\nSubscription ID: @{triggerBody()?['workspaceInfo']?['SubscriptionId']}
\nProvider Alert ID: @{items('For_each')?['properties']?['providerAlertId']}
\nAlert Link: @{items('For_each')?['properties']?['alertLink']}

", + "messageBody": "

Insider Risk Team,
\n
\nAn Insider Risk Management Alert was observed per the details below:
\n
\nSeverity of Alert: @{items('For_each')?['properties']?['severity']}
\n
\nMicrosoft Sentinel Incident
\nTItle: @{triggerBody()?['object']?['properties']?['title']}
\nStatus: @{triggerBody()?['object']?['properties']?['status']}
\nNumber: @{triggerBody()?['object']?['properties']?['incidentNumber']}
\nCreated Time (UTC): @{triggerBody()?['object']?['properties']?['createdTimeUtc']}
\nIncident Link:  @{triggerBody()?['object']?['properties']?['incidentUrl']}
\n
\nAlert Details
\nAlert Display Name: @{items('For_each')?['properties']?['alertDisplayName']}
\nAlert Type: @{items('For_each')?['properties']?['alertType']}
\nSubscription ID: @{triggerBody()?['workspaceInfo']?['SubscriptionId']}
\nProvider Alert ID: @{items('For_each')?['properties']?['providerAlertId']}
\nAlert Link: @{items('For_each')?['properties']?['alertLink']}

", "recipient": { "channelId": "[[parameters('TeamschannelId')]", "groupId": "[[parameters('TeamsgroupId')]" @@ -999,7 +999,7 @@ "type": "ApiConnection", "inputs": { "body": { - "Body": "

Insider Risk Team,
\n
\nAn Insider Risk Management Alert was observed per the details below:
\n
\n
\nAzure Sentinel Incident
\nTItle: @{triggerBody()?['object']?['properties']?['title']}
\nStatus: @{triggerBody()?['object']?['properties']?['status']}
\nNumber: @{triggerBody()?['object']?['properties']?['incidentNumber']}
\nIncident Severity: @{triggerBody()?['object']?['properties']?['severity']}
\nCreated Time (UTC): @{triggerBody()?['object']?['properties']?['createdTimeUtc']}
\nIncident Link:  @{triggerBody()?['object']?['properties']?['incidentUrl']}
\n
\nAlert Details
\nAlert Display Name: @{items('For_each')?['properties']?['alertDisplayName']}
\nAlert Product Name: @{items('For_each')?['properties']?['productName']}
\nAlert Severity: @{items('For_each')?['properties']?['severity']}
\nAlert Type: @{items('For_each')?['properties']?['alertType']}
\nSubscription ID: @{triggerBody()?['workspaceInfo']?['SubscriptionId']}
\nProvider Alert ID: @{items('For_each')?['properties']?['providerAlertId']}
\nAlert Link: @{items('For_each')?['properties']?['alertLink']}

", + "Body": "

Insider Risk Team,
\n
\nAn Insider Risk Management Alert was observed per the details below:
\n
\n
\nMicrosoft Sentinel Incident
\nTItle: @{triggerBody()?['object']?['properties']?['title']}
\nStatus: @{triggerBody()?['object']?['properties']?['status']}
\nNumber: @{triggerBody()?['object']?['properties']?['incidentNumber']}
\nIncident Severity: @{triggerBody()?['object']?['properties']?['severity']}
\nCreated Time (UTC): @{triggerBody()?['object']?['properties']?['createdTimeUtc']}
\nIncident Link:  @{triggerBody()?['object']?['properties']?['incidentUrl']}
\n
\nAlert Details
\nAlert Display Name: @{items('For_each')?['properties']?['alertDisplayName']}
\nAlert Product Name: @{items('For_each')?['properties']?['productName']}
\nAlert Severity: @{items('For_each')?['properties']?['severity']}
\nAlert Type: @{items('For_each')?['properties']?['alertType']}
\nSubscription ID: @{triggerBody()?['workspaceInfo']?['SubscriptionId']}
\nProvider Alert ID: @{items('For_each')?['properties']?['providerAlertId']}
\nAlert Link: @{items('For_each')?['properties']?['alertLink']}

", "Subject": "Insider Risk Management Alert", "To": "[[parameters('Email')]" }, diff --git a/Solutions/MimecastAudit/Data Connectors/MimecastAudit_API_AzureFunctionApp.json b/Solutions/MimecastAudit/Data Connectors/MimecastAudit_API_AzureFunctionApp.json index ed04ce5fac1..1bff46e8f39 100644 --- a/Solutions/MimecastAudit/Data Connectors/MimecastAudit_API_AzureFunctionApp.json +++ b/Solutions/MimecastAudit/Data Connectors/MimecastAudit_API_AzureFunctionApp.json @@ -115,7 +115,7 @@ }, { "title": "Deploy the Mimecast Audit & Authentication Data Connector:", - "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-mimecastauditdataconnector-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy. \n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> Audit checkpoints ---> Upload*** and create empty file on your machine named checkpoint.txt and select it for upload (this is done so that date_range for SIEM logs is stored in consistent state)\n" + "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAudit-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy. \n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> Audit checkpoints ---> Upload*** and create empty file on your machine named checkpoint.txt and select it for upload (this is done so that date_range for SIEM logs is stored in consistent state)\n" } ], "metadata": { diff --git a/Solutions/MimecastAudit/Data Connectors/azuredeploy_MimecastAudit_AzureFunctionApp.json b/Solutions/MimecastAudit/Data Connectors/azuredeploy_MimecastAudit_AzureFunctionApp.json index 927f64bc8dc..f19ffa6e12b 100644 --- a/Solutions/MimecastAudit/Data Connectors/azuredeploy_MimecastAudit_AzureFunctionApp.json +++ b/Solutions/MimecastAudit/Data Connectors/azuredeploy_MimecastAudit_AzureFunctionApp.json @@ -206,7 +206,7 @@ "active_directory_tenant_id": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'active-directory-tenant-id', '/)')]", "log_analytics_workspace_id": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'log-analytics-workspace-id', '/)')]", "log_analytics_workspace_key": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'log-analytics-workspace-key', '/)')]", - "WEBSITE_RUN_FROM_PACKAGE": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MimecastAudit/Data%20Connectors/MimecastAuditAzureConn.zip" + "WEBSITE_RUN_FROM_PACKAGE": "https://aka.ms/sentinel-MimecastAudit-functionapp" } } ] diff --git a/Solutions/MimecastAudit/Package/3.0.0.zip b/Solutions/MimecastAudit/Package/3.0.0.zip index ff5715d96b6..1fc3bfb2664 100644 Binary files a/Solutions/MimecastAudit/Package/3.0.0.zip and b/Solutions/MimecastAudit/Package/3.0.0.zip differ diff --git a/Solutions/MimecastAudit/Package/mainTemplate.json b/Solutions/MimecastAudit/Package/mainTemplate.json index daa85ce117a..c7c6eb01aa9 100644 --- a/Solutions/MimecastAudit/Package/mainTemplate.json +++ b/Solutions/MimecastAudit/Package/mainTemplate.json @@ -429,7 +429,7 @@ ] }, { - "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-mimecastauditdataconnector-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy. \n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> Audit checkpoints ---> Upload*** and create empty file on your machine named checkpoint.txt and select it for upload (this is done so that date_range for SIEM logs is stored in consistent state)\n", + "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAudit-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy. \n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> Audit checkpoints ---> Upload*** and create empty file on your machine named checkpoint.txt and select it for upload (this is done so that date_range for SIEM logs is stored in consistent state)\n", "title": "Deploy the Mimecast Audit & Authentication Data Connector:" } ], @@ -644,7 +644,7 @@ ] }, { - "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-mimecastauditdataconnector-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy. \n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> Audit checkpoints ---> Upload*** and create empty file on your machine named checkpoint.txt and select it for upload (this is done so that date_range for SIEM logs is stored in consistent state)\n", + "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAudit-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy. \n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> Audit checkpoints ---> Upload*** and create empty file on your machine named checkpoint.txt and select it for upload (this is done so that date_range for SIEM logs is stored in consistent state)\n", "title": "Deploy the Mimecast Audit & Authentication Data Connector:" } ], diff --git a/Solutions/MimecastSEG/Analytic Rules/MimecastDLP.yaml b/Solutions/MimecastSEG/Analytic Rules/MimecastDLP.yaml new file mode 100644 index 00000000000..f034afa90fd --- /dev/null +++ b/Solutions/MimecastSEG/Analytic Rules/MimecastDLP.yaml @@ -0,0 +1,41 @@ +id: 1818aeaa-4cc8-426b-ba54-539de896d299 +name: Mimecast Data Leak Prevention - Notifications +description: Detects threat for data leak when action is notification +severity: High +requiredDataConnectors: + - connectorId: MimecastSIEMAPI + dataTypes: + - MimecastDLP_CL +enabled: true +query: MimecastDLP_CL| where action_s == "notification"; +queryFrequency: 5m +queryPeriod: 15m +triggerOperator: gt +triggerThreshold: 0 +suppressionDuration: 5h +suppressionEnabled: false +tactics: +- Exfiltration +relevantTechniques: +- T1030 +alertRuleTemplateName: +incidentConfiguration: + createIncident: true + groupingConfiguration: + enabled: true + reopenClosedIncident: false + lookbackDuration: 1d + matchingMethod: AllEntities +eventGroupingSettings: + aggregationKind: SingleAlert +entityMappings: +- entityType: MailMessage + fieldMappings: + - identifier: Sender + columnName: senderAddress_s + - identifier: Recipient + columnName: recipientAddress_s + - identifier: DeliveryAction + columnName: action_s +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/MimecastSEG/Analytic Rules/MimecastDLP_Hold.yaml b/Solutions/MimecastSEG/Analytic Rules/MimecastDLP_Hold.yaml new file mode 100644 index 00000000000..2c5c15d0926 --- /dev/null +++ b/Solutions/MimecastSEG/Analytic Rules/MimecastDLP_Hold.yaml @@ -0,0 +1,40 @@ +id: 3e12b7b1-75e5-497c-ba01-b6cb30b60d7f +name: Mimecast Data Leak Prevention - Hold +description: Detects threat for data leak when action is hold +severity: Informational +requiredDataConnectors: + - connectorId: MimecastSIEMAPI + dataTypes: + - MimecastDLP_CL +enabled: true +query: MimecastDLP_CL| where action_s == "hold"; +queryFrequency: 5m +queryPeriod: 15m +triggerOperator: gt +triggerThreshold: 0 +suppressionDuration: 5h +suppressionEnabled: false +tactics: +- Exfiltration +relevantTechniques: +- T1030 +incidentConfiguration: + createIncident: true + groupingConfiguration: + enabled: true + reopenClosedIncident: false + lookbackDuration: 1d + matchingMethod: AllEntities +eventGroupingSettings: + aggregationKind: SingleAlert +entityMappings: +- entityType: MailMessage + fieldMappings: + - identifier: Sender + columnName: senderAddress_s + - identifier: Recipient + columnName: recipientAddress_s + - identifier: DeliveryAction + columnName: action_s +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_AV.yaml b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_AV.yaml new file mode 100644 index 00000000000..472c892188f --- /dev/null +++ b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_AV.yaml @@ -0,0 +1,56 @@ +id: 0f0dc725-29dc-48c3-bf10-bd2f34fd1cbb +name: Mimecast Secure Email Gateway - AV +description: Detects threats from email anti virus scan +severity: Informational +requiredDataConnectors: + - connectorId: MimecastSIEMAPI + dataTypes: + - MimecastSIEM_CL +enabled: true +query: MimecastSIEM_CL| where mimecastEventId_s=="mail_av" +queryFrequency: 5m +queryPeriod: 15m +triggerOperator: gt +triggerThreshold: 0 +suppressionDuration: 5h +suppressionEnabled: false +tactics: +- Execution +relevantTechniques: +- T1053 +incidentConfiguration: + createIncident: true + groupingConfiguration: + enabled: true + reopenClosedIncident: false + lookbackDuration: 1d + matchingMethod: AllEntities +eventGroupingSettings: + aggregationKind: SingleAlert +customDetails: + IP: IP_s + MsgId: MsgId_s + Route: Route_s + SenderDomain: SenderDomain_s + MimecastIP: MimecastIP_s + fileName: fileName_s + sha256: sha256_s + Size: Size_s + fileExt: fileExt_s + Virus: Virus_s + sha1: sha1_s + SenderDomainInternal: SenderDomainInternal_s + fileMime: fileMime_s + CustomerIP: CustomerIP_s + md5: md5_g +entityMappings: +- entityType: MailMessage + fieldMappings: + - identifier: Sender + columnName: Sender_s + - identifier: Recipient + columnName: Recipient_s + - identifier: Subject + columnName: Subject_s +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Attachment.yaml b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Attachment.yaml new file mode 100644 index 00000000000..7df8d30c011 --- /dev/null +++ b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Attachment.yaml @@ -0,0 +1,54 @@ +id: 72264f4f-61fb-4f4f-96c4-635571a376c2 +name: Mimecast Secure Email Gateway - Attachment Protect +description: Detect threat for mail attachment under the targeted threat protection +severity: High +requiredDataConnectors: + - connectorId: MimecastSIEMAPI + dataTypes: + - MimecastSIEM_CL +enabled: true +query: MimecastSIEM_CL| where mimecastEventId_s=="mail_ttp_attachment" +queryFrequency: 5m +queryPeriod: 15m +triggerOperator: gt +triggerThreshold: 0 +suppressionDuration: 5h +suppressionEnabled: false +tactics: +- Collection +- Exfiltration +- Discovery +- InitialAccess +- Execution +relevantTechniques: +- T1114 +- T1566 +- T0865 +incidentConfiguration: + createIncident: true + groupingConfiguration: + enabled: true + reopenClosedIncident: false + lookbackDuration: 1d + matchingMethod: AllEntities +eventGroupingSettings: + aggregationKind: SingleAlert +customDetails: + sha256: sha256_s + fileName: fileName_s + MsgId: MsgId_s +entityMappings: +- entityType: MailMessage + fieldMappings: + - identifier: Sender + columnName: Sender_s + - identifier: Recipient + columnName: Recipient_s + - identifier: Subject + columnName: Subject_s +- entityType: IP + fieldMappings: + - identifier: Address + columnName: IP_s +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Impersonation.yaml b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Impersonation.yaml new file mode 100644 index 00000000000..9abbe74c6f7 --- /dev/null +++ b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Impersonation.yaml @@ -0,0 +1,60 @@ +id: 7034abc9-6b66-4533-9bf3-056672fd9d9e +name: Mimecast Secure Email Gateway - Impersonation Protect +description: Detects threats from impersonation mail under targeted threat protection +severity: High +requiredDataConnectors: + - connectorId: MimecastSIEMAPI + dataTypes: + - MimecastSIEM_CL +enabled: true +query: MimecastSIEM_CL| where mimecastEventId_s == "mail_ttp_impersonation" +queryFrequency: 5m +queryPeriod: 15m +triggerOperator: gt +triggerThreshold: 0 +suppressionDuration: 5h +suppressionEnabled: false +tactics: +- Discovery +- LateralMovement +- Collection +relevantTechniques: +- T1114 +incidentConfiguration: + createIncident: true + groupingConfiguration: + enabled: true + reopenClosedIncident: false + lookbackDuration: 1d + matchingMethod: AllEntities +eventGroupingSettings: + aggregationKind: SingleAlert +customDetails: + Subject: Subject_s + MsgId: MsgId_s + Route: Route_s + CustomThreatDict: CustomThreatDictionary_s + Action: Action_s + Hits: Hits_s + SimilarCustExtDomain: SimilarCustomExternalDomain_s + TaggedExternal: TaggedExternal_s + SimilarIntDomain: SimilarInternalDomain_s + Definition: Definition_s + NewDomain: NewDomain_s + InternalName: InternalName_s + ThreatDictionary: ThreatDictionary_s + SimilarMCExtDomain: SimilarMimecastExternalDomain_s + CustomName: CustomName_s + TaggedMalicious: TaggedMalicious_s + ReplyMismatch: ReplyMismatch_s +entityMappings: +- entityType: MailMessage + fieldMappings: + - identifier: Sender + columnName: Sender_s + - identifier: SenderIP + columnName: IP_s + - identifier: Recipient + columnName: Recipient_s +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Internal_Mail_Protect.yaml b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Internal_Mail_Protect.yaml new file mode 100644 index 00000000000..12e3c737428 --- /dev/null +++ b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Internal_Mail_Protect.yaml @@ -0,0 +1,52 @@ +id: 5b66d176-e344-4abf-b915-e5f09a6430ef +name: Mimecast Secure Email Gateway - Internal Email Protect +description: Detects threats from internal email threat protection +severity: High +requiredDataConnectors: + - connectorId: MimecastSIEMAPI + dataTypes: + - MimecastSIEM_CL +enabled: true +query: MimecastSIEM_CL| where mimecastEventId_s=="mail_ttp_iep" +queryFrequency: 5m +queryPeriod: 15m +triggerOperator: gt +triggerThreshold: 0 +suppressionDuration: 5h +suppressionEnabled: false +tactics: +- LateralMovement +- Persistence +- Exfiltration +relevantTechniques: +- T1534 +- T1546 +incidentConfiguration: + createIncident: true + groupingConfiguration: + enabled: true + reopenClosedIncident: false + lookbackDuration: 1d + matchingMethod: AllEntities +eventGroupingSettings: + aggregationKind: SingleAlert +customDetails: + Subject: Subject_s + Route: Route_s + UrlCategory: UrlCategory_s + ScanResultInfo: ScanResultInfo_s +entityMappings: +- entityType: MailMessage + fieldMappings: + - identifier: Sender + columnName: Sender_s + - identifier: Recipient + columnName: Recipient_s + - identifier: InternetMessageId + columnName: MsgId_s +- entityType: URL + fieldMappings: + - identifier: Url + columnName: URL_s +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Spam_Event.yaml b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Spam_Event.yaml new file mode 100644 index 00000000000..19c1b682c88 --- /dev/null +++ b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Spam_Event.yaml @@ -0,0 +1,46 @@ +id: df1b9377-5c29-4928-872f-9934a6b4f611 +name: Mimecast Secure Email Gateway - Spam Event Thread +description: Detects threat from spam event thread protection logs +severity: Low +requiredDataConnectors: + - connectorId: MimecastSIEMAPI + dataTypes: + - MimecastSIEM_CL +enabled: true +query: MimecastSIEM_CL| where mimecastEventId_s=="mail_spameventthread" +queryFrequency: 5m +queryPeriod: 15m +triggerOperator: gt +triggerThreshold: 0 +suppressionDuration: 5h +suppressionEnabled: false +tactics: +- Discovery +relevantTechniques: +- T1083 +incidentConfiguration: + createIncident: true + groupingConfiguration: + enabled: true + reopenClosedIncident: false + lookbackDuration: 1d + matchingMethod: AllEntities +eventGroupingSettings: + aggregationKind: SingleAlert +customDetails: + MsgId: MsgId_s + headerFrom: headerFrom_s + Route: Route_s + SourceIP: SourceIP + SenderDomain: SenderDomain_s +entityMappings: +- entityType: MailMessage + fieldMappings: + - identifier: Sender + columnName: Sender_s + - identifier: Recipient + columnName: Recipient_s + - identifier: Subject + columnName: Subject_s +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Url_Protect.yaml b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Url_Protect.yaml new file mode 100644 index 00000000000..ff7ec861da5 --- /dev/null +++ b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Url_Protect.yaml @@ -0,0 +1,52 @@ +id: ea19dae6-bbb3-4444-a1b8-8e9ae6064aab +name: Mimecast Secure Email Gateway - URL Protect +description: Detect threat when potentially malicious url found +severity: High +requiredDataConnectors: + - connectorId: MimecastSIEMAPI + dataTypes: + - MimecastSIEM_CL +enabled: true +query: MimecastSIEM_CL| where mimecastEventId_s=="mail_ttp_url" and reason_s != "clean" +queryFrequency: 5m +queryPeriod: 15m +triggerOperator: gt +triggerThreshold: 0 +suppressionDuration: 5h +suppressionEnabled: false +tactics: +- InitialAccess +- Discovery +- Execution +relevantTechniques: +- T1566 +incidentConfiguration: + createIncident: true + groupingConfiguration: + enabled: true + reopenClosedIncident: false + lookbackDuration: 1d + matchingMethod: AllEntities +eventGroupingSettings: + aggregationKind: SingleAlert +customDetails: + senderDomain: senderDomain_s + credentialTheft: credentialTheft_s + urlCategory: urlCategory_s + action: action_s + url: url_s + msgid: msgid_s + route: route_s + SourceIP: SourceIP + reason: reason_s +entityMappings: +- entityType: MailMessage + fieldMappings: + - identifier: Sender + columnName: sender_s + - identifier: Recipient + columnName: recipient_s + - identifier: Subject + columnName: subject_s +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Virus.yaml b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Virus.yaml new file mode 100644 index 00000000000..b82f48fd539 --- /dev/null +++ b/Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Virus.yaml @@ -0,0 +1,54 @@ +id: 30f73baa-602c-4373-8f02-04ff5e51fc7f +name: Mimecast Secure Email Gateway - Virus +description: Detect threat for virus from mail receipt virus event +severity: Informational +requiredDataConnectors: + - connectorId: MimecastSIEMAPI + dataTypes: + - MimecastSIEM_CL +enabled: true +query: MimecastSIEM_CL| where mimecastEventId_s=="mail_receipt_virus" +queryFrequency: 5m +queryPeriod: 15m +triggerOperator: gt +triggerThreshold: 0 +suppressionDuration: 5h +suppressionEnabled: false +tactics: +- Execution +relevantTechniques: +- T1053 +incidentConfiguration: + createIncident: true + groupingConfiguration: + enabled: true + reopenClosedIncident: false + lookbackDuration: 1d + matchingMethod: AllEntities +eventGroupingSettings: + aggregationKind: SingleAlert +alertDetailsOverride: +customDetails: + IP: IP_s + MsgId: MsgId_s + Virus: Virus_s + RejType: RejType_s + Error: Error_s + RejCode: RejCode_s + Dir: Dir_s + headerFrom: headerFrom_s + Act: Act_s + RejInfo: RejInfo_s + TlsVer: TlsVer_s + Cphr: Cphr_s +entityMappings: +- entityType: MailMessage + fieldMappings: + - identifier: Sender + columnName: Sender_s + - identifier: Recipient + columnName: Rcpt_s + - identifier: Subject + columnName: Subject_s +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/MimecastSEG/Data Connectors/GetDLPLogs/__init__.py b/Solutions/MimecastSEG/Data Connectors/GetDLPLogs/__init__.py new file mode 100644 index 00000000000..2c093975389 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/GetDLPLogs/__init__.py @@ -0,0 +1,83 @@ +import datetime +import logging +import json +import os +import azure.functions as func + +from ..Helpers.date_helper import DateHelper +from ..Helpers.request_helper import RequestHelper +from ..Helpers.response_helper import ResponseHelper +from ..Helpers.azure_monitor_collector import AzureMonitorCollector +from ..Models.Error.errors import MimecastRequestError, AzureMonitorCollectorRequestError +from ..Models.Request.get_data_leak_protection_logs import GetDataLeakProtectionLogsRequest +from ..Models.Enum.mimecast_endpoints import MimecastEndpoints +from ..TransformData.dlp_parser import DLPParser + + +def main(mytimer: func.TimerRequest, checkpoint: str) -> str: + utc_timestamp = datetime.datetime.utcnow().replace( + tzinfo=datetime.timezone.utc).isoformat() + + if mytimer.past_due: + logging.info('The timer is past due!') + + logging.info('Python timer trigger function ran at %s', utc_timestamp) + + request_helper = RequestHelper() + response_helper = ResponseHelper() + azure_monitor_collector = AzureMonitorCollector() + + request_helper.set_request_credentials(email=os.environ['mimecast_email'], + password=os.environ['mimecast_password'], + app_id=os.environ['mimecast_app_id'], + app_key=os.environ['mimecast_app_key'], + access_key=os.environ['mimecast_access_key'], + secret_key=os.environ['mimecast_secret_key'], + base_url=os.environ['mimecast_base_url']) + + # datetime manipulation is done to assure there is neither duplicate nor missing logs + start_date = checkpoint if checkpoint else DateHelper.get_utc_time_in_past(days=7) + mimecast_start_date = datetime.datetime.strptime(start_date, "%Y-%m-%dT%H:%M:%S%z") + datetime.timedelta(seconds=1) + mimecast_start_date = mimecast_start_date.strftime("%Y-%m-%dT%H:%M:%S%z") + end_date = datetime.datetime.fromisoformat(utc_timestamp) - datetime.timedelta(seconds=15) + mimecast_end_date = end_date.strftime("%Y-%m-%dT%H:%M:%S%z") + + mapped_response_data, model, next_token, has_more_logs = request_helper.set_initial_values() + dlp_parser = DLPParser() + parsed_logs = [] + + try: + while has_more_logs: + model = GetDataLeakProtectionLogsRequest(mimecast_start_date, mimecast_end_date, next_token) + response = request_helper.send_post_request(model.payload, MimecastEndpoints.get_data_leak_protection_logs) + response_helper.check_response_codes(response, MimecastEndpoints.get_data_leak_protection_logs) + success_response = response_helper.parse_success_response(response) + has_more_logs, next_token = response_helper.get_next_token(response) + parsed_logs.extend(dlp_parser.parse(logs=success_response[0]['dlpLogs'])) + except MimecastRequestError as e: + logging.error('Failed to get DLP logs from Mimecast.', extra={'request_id': request_helper.request_id}) + e.request_id = request_helper.request_id + raise e + except Exception as e: + logging.error('Unknown Exception raised.', extra={'request_id': request_helper.request_id}) + raise e + + try: + if parsed_logs: + workspace_id = os.environ['log_analytics_workspace_id'] + workspace_key = os.environ['log_analytics_workspace_key'] + log_type = 'MimecastDLP' + body = json.dumps(parsed_logs) + azure_monitor_collector.post_data(workspace_id, workspace_key, body, log_type) + # logs are sorted so next line will return the latest log date + return parsed_logs[-1]['eventTime'] + else: + logging.info("There are no DLP logs for this period.") + return mimecast_end_date + except AzureMonitorCollectorRequestError as e: + logging.error('Failed to send DLP logs to Azure Sentinel.', extra={'request_id': request_helper.request_id}) + e.request_id = request_helper.request_id + raise e + except Exception as e: + logging.error('Unknown Exception raised.', extra={'request_id': request_helper.request_id}) + raise e diff --git a/Solutions/MimecastSEG/Data Connectors/GetDLPLogs/function.json b/Solutions/MimecastSEG/Data Connectors/GetDLPLogs/function.json new file mode 100644 index 00000000000..918e9ff28a8 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/GetDLPLogs/function.json @@ -0,0 +1,24 @@ +{ + "scriptFile": "__init__.py", + "bindings": [ + { + "name": "mytimer", + "type": "timerTrigger", + "direction": "in", + "schedule": "0 */5 * * * *" + }, + { + "name": "checkpoint", + "type": "blob", + "dataType": "string", + "path": "siem-checkpoints/dlp-checkpoint.txt", + "direction": "in" + }, + { + "name": "$return", + "type": "blob", + "path": "siem-checkpoints/dlp-checkpoint.txt", + "direction": "out" + } + ] +} \ No newline at end of file diff --git a/Solutions/MimecastSEG/Data Connectors/GetDLPLogs/readme.md b/Solutions/MimecastSEG/Data Connectors/GetDLPLogs/readme.md new file mode 100644 index 00000000000..e8b7e887365 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/GetDLPLogs/readme.md @@ -0,0 +1,11 @@ +# TimerTrigger - Python + +The `TimerTrigger` makes it incredibly easy to have your functions executed on a schedule. This sample demonstrates a simple use case of calling your function every 5 minutes. + +## How it works + +For a `TimerTrigger` to work, you provide a schedule in the form of a [cron expression](https://en.wikipedia.org/wiki/Cron#CRON_expression)(See the link for full details). A cron expression is a string with 6 separate expressions which represent a given schedule via patterns. The pattern we use to represent every 5 minutes is `0 */5 * * * *`. This, in plain text, means: "When seconds is equal to 0, minutes is divisible by 5, for any hour, day of the month, month, day of the week, or year". + +## Learn more + + Documentation diff --git a/Solutions/MimecastSEG/Data Connectors/GetSIEMLogs/__init__.py b/Solutions/MimecastSEG/Data Connectors/GetSIEMLogs/__init__.py new file mode 100644 index 00000000000..78f47d615e1 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/GetSIEMLogs/__init__.py @@ -0,0 +1,78 @@ +import datetime +import logging +import json +import os +import azure.functions as func +from ..Helpers.request_helper import RequestHelper +from ..Helpers.siem_response_helper import SIEMResponseHelper +from ..Helpers.azure_monitor_collector import AzureMonitorCollector +from ..Models.Error.errors import MimecastRequestError, AzureMonitorCollectorRequestError +from ..Models.Request.get_siem_logs import GetSIEMLogsRequest +from ..Models.Enum.mimecast_endpoints import MimecastEndpoints +from ..TransformData.siem_parser import SiemParser + + +def main(mytimer: func.TimerRequest, checkpoint: str) -> str: + utc_timestamp = datetime.datetime.utcnow().replace( + tzinfo=datetime.timezone.utc).isoformat() + + if mytimer.past_due: + logging.info('The timer is past due!') + + logging.info('Python timer trigger function ran at %s', utc_timestamp) + + request_helper = RequestHelper() + response_helper = SIEMResponseHelper() + azure_monitor_collector = AzureMonitorCollector() + + request_helper.set_request_credentials(email=os.environ['mimecast_email'], + password=os.environ['mimecast_password'], + app_id=os.environ['mimecast_app_id'], + app_key=os.environ['mimecast_app_key'], + access_key=os.environ['mimecast_access_key'], + secret_key=os.environ['mimecast_secret_key'], + base_url=os.environ['mimecast_base_url']) + next_token = checkpoint + has_more_logs = True + siem_parser = SiemParser() + parsed_logs = [] + file_format = 'key_value' + model = {} + + try: + while has_more_logs: + model = GetSIEMLogsRequest(file_format, next_token) + response = request_helper.send_post_request(model.payload, MimecastEndpoints.get_siem_logs) + response_helper.check_response_codes(response, MimecastEndpoints.get_siem_logs) + success_response = response_helper.parse_siem_success_response(response, file_format) + has_more_logs, next_token = response_helper.get_siem_next_token(response) + parsed_logs.extend(siem_parser.parse(logs=success_response)) + checkpoint = model.payload['data'][0]['token'] + SIEMResponseHelper.response = [] + + except MimecastRequestError as e: + logging.error('Failed to get SIEM logs from Mimecast.', extra={'request_id': request_helper.request_id}) + e.request_id = request_helper.request_id + raise e + except Exception as e: + logging.error('Unknown Exception raised.', extra={'request_id': request_helper.request_id}) + raise e + + try: + if parsed_logs: + workspace_id = os.environ['log_analytics_workspace_id'] + workspace_key = os.environ['log_analytics_workspace_key'] + log_type = 'MimecastSIEM' + body = json.dumps(parsed_logs) + azure_monitor_collector.post_data(workspace_id, workspace_key, body, log_type) + else: + logging.info("There are no SIEM logs for this period.") + return checkpoint + + except AzureMonitorCollectorRequestError as e: + logging.error('Failed to send SIEM logs to Azure Sentinel.', extra={'request_id': request_helper.request_id}) + e.request_id = request_helper.request_id + raise e + except Exception as e: + logging.error('Unknown Exception raised.', extra={'request_id': request_helper.request_id}) + raise e diff --git a/Solutions/MimecastSEG/Data Connectors/GetSIEMLogs/function.json b/Solutions/MimecastSEG/Data Connectors/GetSIEMLogs/function.json new file mode 100644 index 00000000000..e3cb8ad7734 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/GetSIEMLogs/function.json @@ -0,0 +1,24 @@ +{ + "scriptFile": "__init__.py", + "bindings": [ + { + "name": "mytimer", + "type": "timerTrigger", + "direction": "in", + "schedule": "0 */15 * * * *" + }, + { + "name": "checkpoint", + "type": "blob", + "dataType": "string", + "path": "siem-checkpoints/checkpoint.txt", + "direction": "in" + }, + { + "name": "$return", + "type": "blob", + "path": "siem-checkpoints/checkpoint.txt", + "direction": "out" + } + ] +} \ No newline at end of file diff --git a/Solutions/MimecastSEG/Data Connectors/GetSIEMLogs/readme.md b/Solutions/MimecastSEG/Data Connectors/GetSIEMLogs/readme.md new file mode 100644 index 00000000000..e8b7e887365 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/GetSIEMLogs/readme.md @@ -0,0 +1,11 @@ +# TimerTrigger - Python + +The `TimerTrigger` makes it incredibly easy to have your functions executed on a schedule. This sample demonstrates a simple use case of calling your function every 5 minutes. + +## How it works + +For a `TimerTrigger` to work, you provide a schedule in the form of a [cron expression](https://en.wikipedia.org/wiki/Cron#CRON_expression)(See the link for full details). A cron expression is a string with 6 separate expressions which represent a given schedule via patterns. The pattern we use to represent every 5 minutes is `0 */5 * * * *`. This, in plain text, means: "When seconds is equal to 0, minutes is divisible by 5, for any hour, day of the month, month, day of the week, or year". + +## Learn more + + Documentation diff --git a/Solutions/MimecastSEG/Data Connectors/Helpers/azure_monitor_collector.py b/Solutions/MimecastSEG/Data Connectors/Helpers/azure_monitor_collector.py new file mode 100644 index 00000000000..beee6be13f2 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/Helpers/azure_monitor_collector.py @@ -0,0 +1,50 @@ +import requests +import datetime +import hashlib +import hmac +import base64 +import logging + +from ..Models.Error.errors import AzureMonitorCollectorRequestError + + +class AzureMonitorCollector: + """AzureMonitorCollector responsible for sending data from all functions to Log Analytics Workspace(Sentinel).""" + + @staticmethod + def build_signature(customer_id, shared_key, date, content_length, method, content_type, resource): + """Generating proper Authorization header.""" + x_headers = 'x-ms-date:' + date + string_to_hash = method + "\n" + str(content_length) + "\n" + content_type + "\n" + x_headers + "\n" + resource + bytes_to_hash = bytes(string_to_hash, encoding="utf-8") + decoded_key = base64.b64decode(shared_key) + encoded_hash = base64.b64encode( + hmac.new(decoded_key, bytes_to_hash, digestmod=hashlib.sha256).digest()).decode() + authorization = "SharedKey {}:{}".format(customer_id, encoded_hash) + return authorization + + def post_data(self, customer_id, shared_key, body, log_type): + """Sending logs through proper API version to Log Analytics Workspace.""" + method = 'POST' + content_type = 'application/json' + resource = '/api/logs' + rfc1123date = datetime.datetime.utcnow().strftime('%a, %d %b %Y %H:%M:%S GMT') + content_length = len(body) + signature = self.build_signature(customer_id, shared_key, rfc1123date, content_length, method, content_type, + resource) + uri = 'https://' + customer_id + '.ods.opinsights.azure.com' + resource + '?api-version=2016-04-01' + + headers = { + 'content-type': content_type, + 'Authorization': signature, + 'Log-Type': log_type, + 'x-ms-date': rfc1123date, + 'time-generated-field': 'time_generated' + } + + response = requests.post(uri, data=body, headers=headers) + if 200 <= response.status_code <= 299: + logging.info('Logs sent successfully!') + else: + logging.error("Azure Monitor Collector response code: {}".format(response.status_code)) + raise AzureMonitorCollectorRequestError("Azure Monitor Collector response code: {}".format(response.status_code)) diff --git a/Solutions/MimecastSEG/Data Connectors/Helpers/date_helper.py b/Solutions/MimecastSEG/Data Connectors/Helpers/date_helper.py new file mode 100644 index 00000000000..d217a35e126 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/Helpers/date_helper.py @@ -0,0 +1,28 @@ +import datetime + +from ..Models.Error.errors import ParsingError + + +class DateHelper: + """DateHelper class responsible for making Mimecast specific date formats needed in request models.""" + + @staticmethod + def get_utc_time_in_past(days): + """Generating time by subtracting days from current UTC time.""" + now = datetime.datetime.utcnow() + offset_time = now - datetime.timedelta(days=days) + offset_time = offset_time.replace(tzinfo=datetime.timezone.utc) + return offset_time.strftime("%Y-%m-%dT%H:%M:%S%z") + + @staticmethod + def convert_from_mimecast_format(datetime_str): + try: + datetime_obj = datetime.datetime.strptime(datetime_str, '%Y-%m-%dT%H:%M:%S%z') + except ValueError: + try: + datetime_obj = datetime.datetime.strptime(datetime_str, '%Y-%m-%dT%H:%M:%S.%fZ') + except ValueError: + raise ParsingError(f'Unknown time format: {datetime_str}') + + converted_datetime = datetime_obj.astimezone(datetime.timezone.utc).isoformat() + return converted_datetime diff --git a/Solutions/MimecastSEG/Data Connectors/Helpers/request_helper.py b/Solutions/MimecastSEG/Data Connectors/Helpers/request_helper.py new file mode 100644 index 00000000000..a3d17cdc19a --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/Helpers/request_helper.py @@ -0,0 +1,124 @@ +from ..Models.Enum.mimecast_endpoints import MimecastEndpoints +from ..Models.Enum.mimecast_response_codes import MimecastResponseCodes +from ..Models.Error.errors import MimecastRequestError +from ..Models.Request.refresh_access_key import RefreshAccessKeyRequest +import base64 +from hashlib import sha1 as EncryptionAlgo +import hmac +import uuid +import datetime +import requests +import logging +import time +import math + + +class RequestHelper: + """HttpClient responsible for making proper request headers and sending POST requests to APIs.""" + + request_id = None + app_id = None + app_key = None + access_key = None + secret_key = None + base_url = None + email = None + password = None + https_ip = None + https_port = None + proxy_username = None + proxy_password = None + + def set_request_credentials(self, app_id, app_key, access_key, secret_key, base_url, email, password): + """Setting object credentials to be used for generating proper request headers.""" + self.app_id = app_id + self.app_key = app_key + self.access_key = access_key + self.secret_key = secret_key + self.base_url = base_url + self.email = email + self.password = password + + def set_proxy_credentials(self, https_ip, https_port, proxy_username, proxy_password): + """Setting object proxy credentials to be used for generating proper proxy request configuration.""" + self.https_ip = https_ip + self.https_port = https_port + self.proxy_username = proxy_username + self.proxy_password = proxy_password + + def send_post_request(self, payload, request_uri): + """Sending POST requests to Mimecast API.""" + headers = self.generate_proper_headers(request_uri) + proxies = {} + if hasattr(self, 'https_ip') and self.https_ip: + https_proxy = 'https://{https_ip}:{https_port}'.format(https_ip=self.https_ip, https_port=self.https_port) + proxies.update({'https': https_proxy}) + if hasattr(self, 'proxy_username') and self.proxy_username: + auth = 'https://{proxy_username}:{proxy_password}@{https_ip}:{https_port}/'.format( + proxy_username=self.proxy_username, + proxy_password=self.proxy_password, + https_ip=self.https_ip, + https_port=self.https_port) + proxies.update({'https': auth}) + try: + if proxies: + response = requests.post(url=self.base_url + request_uri, + headers=headers, + data=str(payload), + timeout=120, + proxies=proxies) + else: + response = requests.post(url=self.base_url + request_uri, + headers=headers, + data=str(payload), + timeout=120) + except Exception: + raise MimecastRequestError("Call to " + self.base_url + request_uri + " failed.") + + if response.status_code == MimecastResponseCodes.quota_exceeded: + sleep_duration = math.ceil(int(response.headers['X-RateLimit-Reset']) / 1000) + logging.info('Rate limit hit. Sleeping for {0} seconds.'.format(sleep_duration)) + if sleep_duration > 0: + time.sleep(sleep_duration) + logging.info('Trying again...') + response = self.send_post_request(payload, request_uri) + elif response.status_code == MimecastResponseCodes.binding_expired: + logging.info('Access key expired.') + raise MimecastRequestError("Access key expired.") + return response + + def generate_proper_headers(self, request_uri): + """Condition for generating headers for refresh access key request or for all other requests.""" + headers = self.make_request_headers(request_uri) + logging.info("URL: {0} Request ID: {1}".format(self.base_url + request_uri, headers['x-mc-req-id'])) + + return headers + + def make_request_headers(self, request_uri): + """Generating specific headers from Mimecast credentials.""" + self.request_id = str(uuid.uuid4()) + hdr_date = datetime.datetime.utcnow().strftime("%a, %d %b %Y %H:%M:%S UTC") + unsigned_auth_header = '{date}:{req_id}:{uri}:{app_key}'.format( + date=hdr_date, + req_id=self.request_id, + uri=request_uri, + app_key=self.app_key + ) + hmac_sha1 = hmac.new( + base64.b64decode(self.secret_key), + unsigned_auth_header.encode(), + digestmod=EncryptionAlgo).digest() + sig = base64.encodebytes(hmac_sha1).rstrip() + headers = { + 'Authorization': 'MC ' + self.access_key + ':' + sig.decode(), + 'x-mc-app-id': self.app_id, + 'x-mc-date': hdr_date, + 'x-mc-req-id': self.request_id, + 'Content-Type': 'application/json' + } + return headers + + @staticmethod + def set_initial_values(): + """Generating default values before execution enters the loop.""" + return [], {}, '', True diff --git a/Solutions/MimecastSEG/Data Connectors/Helpers/response_helper.py b/Solutions/MimecastSEG/Data Connectors/Helpers/response_helper.py new file mode 100644 index 00000000000..6a2980c161a --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/Helpers/response_helper.py @@ -0,0 +1,63 @@ +from ..Models.Enum.mimecast_response_codes import MimecastResponseCodes +import logging +import json + +from ..Models.Error.errors import InvalidDataError + + +class ResponseHelper: + """ResponseHelper responsible for checking is token in response headers, also parsing and mapping responses.""" + + next_token = '' + response = [] + + def __init__(self): + """Initial setup of logger and default value for Mimecast endpoint.""" + self.mimecast_endpoint = None + + def check_response_codes(self, response, mimecast_endpoint): + """Checking all response codes from Mimecast documentation and logging errors.""" + self.mimecast_endpoint = mimecast_endpoint + if response.status_code == MimecastResponseCodes.success: + return response + elif response.status_code == MimecastResponseCodes.bad_request: + logging.error("Request cannot be processed because it is either malformed or not correct.") + elif response.status_code == MimecastResponseCodes.unauthorized: + logging.error("Authorization information is either missing, incomplete or incorrect.") + elif response.status_code == MimecastResponseCodes.forbidden: + logging.error("Access is denied to the requested resource." + "The user may not have enough permission to perform the action.") + elif response.status_code == MimecastResponseCodes.not_found: + logging.error("The requested resource does not exist.") + elif response.status_code == MimecastResponseCodes.conflict: + logging.error("The current status of the relying data does not match what is defined in the request.") + elif response.status_code == MimecastResponseCodes.internal_server_error: + logging.error("The request was not processed successfully or an issue has occurred on the Mimecast side.") + else: + logging.error("Unknown error.Please contact API administrator.") + + def parse_success_response(self, response): + """Logging and checking response body for errors.""" + try: + response_text = json.loads(response.text) + except json.JSONDecodeError: + logging.error(self.mimecast_endpoint + ": Invalid content provided. Probably no more logs left.") + raise InvalidDataError('Invalid content provided. Probably no more logs.') + + if response_text['fail']: + logging.error(self.mimecast_endpoint + ": " + response_text['fail'][0]['errors'][0]['message']) + else: + return response_text['data'] + + @staticmethod + def get_next_token(response): + """Extracting token from response headers.""" + has_more_data = False + dictionary_response = json.loads(response.text) + if 'pagination' in dictionary_response['meta']: + if 'next' in dictionary_response['meta']['pagination']: + has_more_data = True + ResponseHelper.next_token = dictionary_response['meta']['pagination']['next'] + else: + ResponseHelper.next_token = '' + return has_more_data, ResponseHelper.next_token diff --git a/Solutions/MimecastSEG/Data Connectors/Helpers/siem_response_helper.py b/Solutions/MimecastSEG/Data Connectors/Helpers/siem_response_helper.py new file mode 100644 index 00000000000..ca77b0daeea --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/Helpers/siem_response_helper.py @@ -0,0 +1,105 @@ +from zipfile import ZipFile, BadZipfile +import logging +import json +import io + +from ..Models.Enum.mimecast_response_codes import MimecastResponseCodes +from ..Models.Error.errors import InvalidDataError, ParsingError, MimecastRequestError + + +class SIEMResponseHelper: + """SIEMResponseHelper responsible for checking is token in response headers and parsing responses.""" + + next_token = '' + mimecast_endpoint = None + + def check_response_codes(self, response, mimecast_endpoint): + """Checking all response codes from Mimecast documentation and logging errors.""" + self.mimecast_endpoint = mimecast_endpoint + if response.status_code == MimecastResponseCodes.success: + return response + elif response.status_code == MimecastResponseCodes.bad_request: + logging.error("Request cannot be processed because it is either malformed or not correct.") + elif response.status_code == MimecastResponseCodes.unauthorized: + logging.error("Authorization information is either missing, incomplete or incorrect.") + elif response.status_code == MimecastResponseCodes.forbidden: + logging.error("Access is denied to the requested resource." + "The user may not have enough permission to perform the action.") + elif response.status_code == MimecastResponseCodes.not_found: + logging.error("The requested resource does not exist.") + elif response.status_code == MimecastResponseCodes.conflict: + logging.error("The current status of the relying data does not match what is defined in the request.") + elif response.status_code == MimecastResponseCodes.internal_server_error: + logging.error("The request was not processed successfully or an issue has occurred on the Mimecast side.") + else: + logging.error("Unknown error.Please contact API administrator.") + + def parse_siem_success_response(self, response, file_format): + """Parsing SIEM responses depending on file format parameter.""" + if response.headers.get('Content-Type') == 'application/octet-stream': + parsed_events = SIEMResponseHelper.parse_compressed_data(response, file_format) + return parsed_events + else: + try: + response_text = json.loads(response.text) + except json.JSONDecodeError: + logging.error(self.mimecast_endpoint + ": Invalid content provided. Probably no more logs left.") + raise InvalidDataError('No more logs.') + else: + if response_text['fail']: + logging.error(self.mimecast_endpoint + ": " + response_text['fail'][0]['errors'][0]['message']) + raise MimecastRequestError(self.mimecast_endpoint + ": " + response_text['fail'][0]['errors'][0]['message']) + + @staticmethod + def parse_compressed_data(response, file_format): + """Parsing compressed responses.""" + events = [] + try: + byte_content = io.BytesIO(response.content) + zip_file = ZipFile(byte_content) + except TypeError: + raise ParsingError( + "Parsing of SIEM compressed data failed. Invalid content provided. Probably no more logs left.") + except BadZipfile: + raise ParsingError( + "Parsing of SIEM compressed data failed. Invalid zip file provided. Probably no more logs left.") + + for file_name in zip_file.namelist(): + content = zip_file.open(file_name).read() + splitted_filename = file_name.split('_') + if splitted_filename[0] == 'ttp': + log_type = '{0}_{1}'.format(splitted_filename[0], splitted_filename[1]) + else: + log_type = splitted_filename[0] + if file_format == 'key_value': + raw_events = SIEMResponseHelper.parse_key_value_response(content) + else: + raw_events = json.loads(content, encoding='utf-8')['data'] + for raw_event in raw_events: + raw_event.update({'logType': log_type}) + events += raw_events + return events + + @staticmethod + def parse_key_value_response(file): + """Parsing key_value file format responses.""" + events = [] + raw_events = file.decode('utf-8') + string_events = raw_events.split('datetime=') + for string_event in string_events: + if string_event != '': + event = "datetime={0}".format(string_event) + dict_string = dict(item.split("=", 1) for item in event.rstrip().split("|")) + events.append(dict_string) + return events + + @staticmethod + def get_siem_next_token(response): + """Extracting SIEM token from response headers.""" + has_more_logs = False + if 'mc-siem-token' in response.headers: + has_more_logs = True + SIEMResponseHelper.next_token = response.headers['mc-siem-token'] + else: + SIEMResponseHelper.next_token = '' + return has_more_logs, SIEMResponseHelper.next_token diff --git a/Solutions/MimecastSEG/Data Connectors/MimecastSEGSentinelConn.zip b/Solutions/MimecastSEG/Data Connectors/MimecastSEGSentinelConn.zip new file mode 100644 index 00000000000..5f68afbaeda Binary files /dev/null and b/Solutions/MimecastSEG/Data Connectors/MimecastSEGSentinelConn.zip differ diff --git a/Solutions/MimecastSEG/Data Connectors/MimecastSEG_API_AzureFunctionApp.json b/Solutions/MimecastSEG/Data Connectors/MimecastSEG_API_AzureFunctionApp.json new file mode 100644 index 00000000000..319ef81b4d4 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/MimecastSEG_API_AzureFunctionApp.json @@ -0,0 +1,153 @@ +{ + "id": "MimecastSIEMAPI", + "title": "Mimecast Secure Email Gateway", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Secure Email Gateway](https://community.mimecast.com/s/article/Azure-Sentinel) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Secure Email Gateway \n- Mimecast Data Leak Prevention\n ", + "graphQueries": [ + { + "metricName": "Total Secure Email Gateway data received", + "legend": "MimecastSIEM_CL", + "baseQuery": "MimecastSIEM_CL" + }, + { + "metricName": "Total Data Leak Prevention data received", + "legend": "MimecastDLP_CL", + "baseQuery": "MimecastDLP_CL" + } + ], + "sampleQueries": [ + { + "description" : "MimecastSIEM_CL", + "query": "MimecastSIEM_CL\n| sort by TimeGenerated desc" + }, + { + "description" : "MimecastDLP_CL", + "query": "MimecastDLP_CL\n| sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "MimecastSIEM_CL", + "lastDataReceivedQuery": "MimecastSIEM_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "MimecastDLP_CL", + "lastDataReceivedQuery": "MimecastDLP_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "MimecastSIEM_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "MimecastDLP_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": true + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "Mimecast API credentials", + "description": "You need to have the following pieces of information to configure the integration:\n- mimecastEmail: Email address of a dedicated Mimecast admin user\n- mimecastPassword: Password for the dedicated Mimecast admin user\n- mimecastAppId: API Application Id of the Mimecast Microsoft Sentinel app registered with Mimecast\n- mimecastAppKey: API Application Key of the Mimecast Microsoft Sentinel app registered with Mimecast\n- mimecastAccessKey: Access Key for the dedicated Mimecast admin user\n- mimecastSecretKey: Secret Key for the dedicated Mimecast admin user\n- mimecastBaseURL: Mimecast Regional API Base URL\n\n> The Mimecast Application Id, Application Key, along with the Access Key and Secret keys for the dedicated Mimecast admin user are obtainable via the Mimecast Administration Console: Administration | Services | API and Platform Integrations.\n\n> The Mimecast API Base URL for each region is documented here: https://integrations.mimecast.com/documentation/api-overview/global-base-urls/" + }, + { + "name": "Resource group", + "description": "You need to have a resource group created with a subscription you are going to use." + }, + { + "name": "Functions app", + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret" + } + ] + }, + "instructionSteps": [ + { + "title": "", + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "title": "", + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "title": "Configuration:", + "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)" + }, + { + "title": "", + "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Mimecast API authorization key(s) or Token, readily available.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Workspace ID" + }, + "type": "CopyableLabel" + }, + { + "parameters": { + "fillWith": [ + "PrimaryKey" + ], + "label": "Primary Key" + }, + "type": "CopyableLabel" + } + ] + }, + { + "title": "Deploy the Mimecast Secure Email Gateway Data Connector:", + "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastSEG-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> SIEM checkpoints ---> Upload*** and create empty file on your machine named checkpoint.txt, dlp-checkpoint.txt and select it for upload (this is done so that date_range for SIEM logs is stored in consistent state)\n" + } + ], + "metadata": { + "id": "d394478b-62f5-49c9-9ce7-96ed999cc727", + "version": "1.0.0", + "kind": "dataConnector", + "source": { + "kind": "solution", + "name": "Mimecast" + }, + "author": { + "name": "Mimecast" + }, + "support": { + "tier": "Partner", + "name": "Mimecast", + "email": "support@mimecast.com", + "link": "https://community.mimecast.com/s/contactsupport" + } + } +} \ No newline at end of file diff --git a/Solutions/MimecastSEG/Data Connectors/Models/Enum/__init__.py b/Solutions/MimecastSEG/Data Connectors/Models/Enum/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/Solutions/MimecastSEG/Data Connectors/Models/Enum/mimecast_endpoints.py b/Solutions/MimecastSEG/Data Connectors/Models/Enum/mimecast_endpoints.py new file mode 100644 index 00000000000..34460681966 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/Models/Enum/mimecast_endpoints.py @@ -0,0 +1,3 @@ +class MimecastEndpoints: + get_siem_logs = '/api/audit/get-siem-logs' + get_data_leak_protection_logs = '/api/dlp/get-logs' diff --git a/Solutions/MimecastSEG/Data Connectors/Models/Enum/mimecast_response_codes.py b/Solutions/MimecastSEG/Data Connectors/Models/Enum/mimecast_response_codes.py new file mode 100644 index 00000000000..559120d4992 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/Models/Enum/mimecast_response_codes.py @@ -0,0 +1,31 @@ +class MimecastResponseCodes: + + success = 200 + """The request was processed and executed. This does not mean that the requested action was successful. + Function-level success or failure is indicated in the response body content.""" + + bad_request = 400 + """The request cannot be processed because it is either malformed or not correct.""" + + unauthorized = 401 + """Authorization information is either missing, incomplete or incorrect.""" + + forbidden = 403 + """Access is denied to the requested resource. The user may not have enough permission to perform the action.""" + + not_found = 404 + """The requested resource does not exist.""" + + conflict = 409 + """The current status of the relying data does not match what is defined in the request.""" + + binding_expired = 418 + """The TTL of the access key and secret key issued on successful login has lapsed and the binding should be + refreshed as described in the Authentication guide.""" + + quota_exceeded = 429 + """The number of requests sent to the given resource has exceeded the rate limiting policy applied to the resource + for a given time period. Rate limiting is applied differently per resource and is subject to change.""" + + internal_server_error = 500 + """The request was not processed successfully or an issue has occurred in the Mimecast platform.""" diff --git a/Solutions/MimecastSEG/Data Connectors/Models/Enum/siem_types.py b/Solutions/MimecastSEG/Data Connectors/Models/Enum/siem_types.py new file mode 100644 index 00000000000..544910a5316 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/Models/Enum/siem_types.py @@ -0,0 +1,11 @@ +class SiemTypes: + TYPE_DELIVERY = 'delivery' + TYPE_PROCESS = 'process' + TYPE_RECEIPT = 'receipt' + TYPE_TTP_URL = 'ttp_url' + TYPE_TTP_ATTACHMENT = 'ttp_ap' + TYPE_TTP_IMPERSONATION = 'impersonation' + TYPE_TTP_IEP = 'iep' + TYPE_JOURNAL = 'jrnl' + TYPE_AV = 'av' + TYPE_SPAMEVENTTHREAD = 'spameventthread' diff --git a/Solutions/MimecastSEG/Data Connectors/Models/Error/__init__.py b/Solutions/MimecastSEG/Data Connectors/Models/Error/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/Solutions/MimecastSEG/Data Connectors/Models/Error/errors.py b/Solutions/MimecastSEG/Data Connectors/Models/Error/errors.py new file mode 100644 index 00000000000..7312edf8515 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/Models/Error/errors.py @@ -0,0 +1,23 @@ +class BaseError(Exception): + request_id = None + + def __init__(self, message, request_id=None): + if request_id: + self.request_id = request_id + super(BaseError, self).__init__(message) + + +class MimecastRequestError(BaseError): + pass + + +class ParsingError(MimecastRequestError): + pass + + +class InvalidDataError(MimecastRequestError): + pass + + +class AzureMonitorCollectorRequestError(BaseError): + pass diff --git a/Solutions/MimecastSEG/Data Connectors/Models/Request/__init__.py b/Solutions/MimecastSEG/Data Connectors/Models/Request/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/Solutions/MimecastSEG/Data Connectors/Models/Request/get_data_leak_protection_logs.py b/Solutions/MimecastSEG/Data Connectors/Models/Request/get_data_leak_protection_logs.py new file mode 100644 index 00000000000..3839f4a9071 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/Models/Request/get_data_leak_protection_logs.py @@ -0,0 +1,19 @@ + +class GetDataLeakProtectionLogsRequest: + def __init__(self, from_date, to_date, token): + self.payload = { + 'meta': { + 'pagination': { + 'pageSize': 500 + } + }, + 'data': [ + { + 'oldestFirst': True, + 'from': from_date, + 'to': to_date + } + ] + } + if token: + self.payload["meta"]["pagination"]["pageToken"] = token diff --git a/Solutions/MimecastSEG/Data Connectors/Models/Request/get_siem_logs.py b/Solutions/MimecastSEG/Data Connectors/Models/Request/get_siem_logs.py new file mode 100644 index 00000000000..8858e44638e --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/Models/Request/get_siem_logs.py @@ -0,0 +1,13 @@ +class GetSIEMLogsRequest: + def __init__(self, file_format, token): + self.payload = { + 'data': [ + { + 'type': 'MTA', + 'compress': True, + 'fileFormat': file_format + } + ] + } + if token: + self.payload['data'][0]['token'] = token diff --git a/Solutions/MimecastSEG/Data Connectors/Models/Request/refresh_access_key.py b/Solutions/MimecastSEG/Data Connectors/Models/Request/refresh_access_key.py new file mode 100644 index 00000000000..67d6a2a5576 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/Models/Request/refresh_access_key.py @@ -0,0 +1,5 @@ +class RefreshAccessKeyRequest: + def __init__(self, email, expired_access_key): + self.payload = {"data": [{"userName": email}]} + if expired_access_key: + self.payload['data'][0]['accessKey'] = expired_access_key diff --git a/Solutions/MimecastSEG/Data Connectors/TransformData/dlp_parser.py b/Solutions/MimecastSEG/Data Connectors/TransformData/dlp_parser.py new file mode 100644 index 00000000000..4a1b8931f0d --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/TransformData/dlp_parser.py @@ -0,0 +1,16 @@ +from ..Helpers.date_helper import DateHelper + + +class DLPParser: + + def __init__(self): + self.date_helper = DateHelper() + + def parse(self, logs): + for log in logs: + event_id = f"data_leak_prevention_{log.get('action')}" + category = "data_leak_prevention" + timestamp = self.date_helper.convert_from_mimecast_format(log['eventTime']) + log.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp}) + + return logs diff --git a/Solutions/MimecastSEG/Data Connectors/TransformData/siem_parser.py b/Solutions/MimecastSEG/Data Connectors/TransformData/siem_parser.py new file mode 100644 index 00000000000..922856441ed --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/TransformData/siem_parser.py @@ -0,0 +1,230 @@ +from ..Helpers.date_helper import DateHelper +from ..Models.Enum.siem_types import SiemTypes +import logging + + +class SiemParser: + + def __init__(self): + self.date_helper = DateHelper() + + def parse(self, logs): + parsed_logs = [] + if logs: + for log in logs: + if 'checkpoints' in log: + continue + log_type = log['logType'].strip() + if log_type == SiemTypes.TYPE_AV: + parsed_logs.append(self.parse_av_event(log)) + elif log_type == SiemTypes.TYPE_DELIVERY: + parsed_logs.append(self.parse_delivery_event(log)) + elif log_type == SiemTypes.TYPE_PROCESS: + parsed_logs.append(self.parse_process_event(log)) + elif log_type == SiemTypes.TYPE_RECEIPT: + parsed_logs.append(self.parse_receipt_event(log)) + elif log_type == SiemTypes.TYPE_TTP_URL: + parsed_logs.append(self.parse_ttp_url_event(log)) + elif log_type == SiemTypes.TYPE_TTP_IMPERSONATION: + parsed_logs.append(self.parse_ttp_impersonation_event(log)) + elif log_type == SiemTypes.TYPE_TTP_ATTACHMENT: + parsed_logs.append(self.parse_ttp_attachment_event(log)) + elif log_type == SiemTypes.TYPE_TTP_IEP: + parsed_logs.append(self.parse_ttp_iep_event(log)) + elif log_type == SiemTypes.TYPE_JOURNAL: + parsed_logs.append(self.parse_journal_event(log)) + elif log_type == SiemTypes.TYPE_SPAMEVENTTHREAD: + parsed_logs.append(self.parse_spameventthread(log)) + else: + parsed_logs.append(self.parse_other_event(log)) + + return parsed_logs + + def parse_av_event(self, event): + """ Parse a single AV event + :param event: event to be parsed (single line in log) + :return: parsed event + """ + category = 'mail_av' + event_id = 'mail_av' + timestamp = self.date_helper.convert_from_mimecast_format(event['datetime']) + event.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp}) + + return event + + def parse_delivery_event(self, event): + """ Parse a single Delivery event + Based on: + - Delivered (is the mail delivered at all) + - UseTls (was tls used) + :param event: event to be parsed (single line in log) + :return: parsed event + """ + delivered = event['Delivered'] if 'Delivered' in event else None + use_tls = event['UseTls'] if 'UseTls' in event else None + if delivered is not None: + if delivered == 'true': + if use_tls == 'Yes': + event_id = 'mail_delivery_delivered' + else: + event_id = 'mail_delivery_delivered_notls' + else: + event_id = 'mail_delivery_not_delivered' + else: + event_id = 'mail_delivery_other' + category = 'mail_delivery' + timestamp = self.date_helper.convert_from_mimecast_format(event['datetime']) + event.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp}) + + return event + + def parse_process_event(self, event): + """ Parse a single Process event + Based on: + - Act (action) + :param event: event to be parsed (single line in log) + :return: parsed event + """ + action = event['Act'] if 'Act' in event else None + if action == 'Acc': + event_id = 'mail_process_accepted' + elif action == 'Hld': + event_id = 'mail_process_held' + elif action == 'Sdbx': + event_id = 'mail_process_sandboxed' + elif action == 'Rty': + event_id = 'mail_process_retried' + elif action == 'Bnc': + event_id = 'mail_process_bounced' + else: + event_id = 'mail_process_other' + category = 'mail_process' + timestamp = self.date_helper.convert_from_mimecast_format(event['datetime']) + event.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp}) + + return event + + def parse_receipt_event(self, event): + """ Parse a single Receipt event + Based on: + - Act (action) + - TlsVer (TLS version) + - Virus (was there a virus in a mail) + - SpamInfo (is mail a spam) + :param event: event to be parsed (single line in log) + :return: parsed event + """ + action = event['Act'] if 'Act' in event else None + tls_version = event['TlsVer'] if 'TlsVer' in event else None + is_virus = True if 'Virus' in event else False + is_spam = False if 'SpamInfo' not in event or event['SpamInfo'] == '[]' else True + if is_virus: + event_id = 'mail_receipt_virus' + elif is_spam: + event_id = 'mail_receipt_spam' + elif action == 'Rej': + event_id = 'mail_receipt_rejected' + elif action == 'Ign': + event_id = 'mail_receipt_ignored' + elif action == 'Bnc': + event_id = 'mail_receipt_bounced' + elif tls_version is not None and tls_version.startswith('TLSv1'): + event_id = 'mail_receipt_received' + elif action == 'Acc' and (tls_version is None or + not tls_version.startswith('TLSv1')): + event_id = 'mail_receipt_received_notls' + else: + event_id = 'mail_receipt_other' + category = 'mail_receipt' + + timestamp = self.date_helper.convert_from_mimecast_format(event['datetime']) + event.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp}) + + return event + + def parse_ttp_url_event(self, event): + """ Parse a single TTP URL event + :param event: event to be parsed (single line in log) + :return: parsed event + """ + event_id = 'mail_ttp_url' + category = 'mail_ttp_url' + timestamp = self.date_helper.convert_from_mimecast_format(event['datetime']) + event.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp}) + + return event + + def parse_ttp_impersonation_event(self, event): + """ Parse a single TTP Impersonation event + :param event: event to be parsed (single line in log) + :return: parsed event + """ + event_id = 'mail_ttp_impersonation' + category = 'mail_ttp_impersonation' + timestamp = self.date_helper.convert_from_mimecast_format(event['datetime']) + event.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp}) + + return event + + def parse_ttp_attachment_event(self, event): + """ Parse a single TTP Attachment event + :param event: event to be parsed (single line in log) + :return: parsed event + """ + event_id = 'mail_ttp_attachment' + category = 'mail_ttp_attachment' + timestamp = self.date_helper.convert_from_mimecast_format(event['datetime']) + event.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp}) + + return event + + def parse_ttp_iep_event(self, event): + """ Parse a single TTP IEP event + :param event: event to be parsed (single line in log) + :return: parsed event + """ + event_id = 'mail_ttp_iep' + category = 'mail_ttp_iep' + timestamp = self.date_helper.convert_from_mimecast_format(event['datetime']) + event.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp}) + + return event + + def parse_journal_event(self, event): + """Parse a single Journaling event. + :param event: event to be parsed (single line in log) + :return: parsed event + """ + event_id = 'mail_journal' + category = 'mail_journal' + timestamp = self.date_helper.convert_from_mimecast_format(event['datetime']) + event.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp}) + + return event + + def parse_spameventthread(self, event): + """Parse a single Spameventthread event. + :param event: event to be parsed (single line in log) + :return: parsed event + """ + + event_id = 'mail_spameventthread' + category = 'mail_spameventthread' + timestamp = self.date_helper.convert_from_mimecast_format(event['datetime']) + event.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp}) + + return event + + def parse_other_event(self, event): + """ Parse a single event that we don't expect + :param event: event to be parsed (single line in log) + :event_type: name of event type from response header + :return: parsed event as unicode + """ + event_id = 'other_{0}'.format(event['logType']) + category = 'other' + logging.warning('Unexpected log type: "{0}"'.format(event['logType'])) + timestamp = self.date_helper.convert_from_mimecast_format(event['datetime']) + event.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp}) + + return event diff --git a/Solutions/MimecastSEG/Data Connectors/azuredeploy_MimecastSEG_AzureFunctionApp.json b/Solutions/MimecastSEG/Data Connectors/azuredeploy_MimecastSEG_AzureFunctionApp.json new file mode 100644 index 00000000000..c5f3558b757 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/azuredeploy_MimecastSEG_AzureFunctionApp.json @@ -0,0 +1,466 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "appName": { + "type": "string", + "metadata": { + "description": "The name of the function app that you wish to create." + } + }, + "objectId": { + "type": "string", + "metadata": { + "description": "Unique object ID in the Azure Active Directory." + } + }, + "storageAccountType": { + "type": "string", + "defaultValue": "Standard_LRS", + "allowedValues": [ + "Standard_LRS", + "Standard_GRS", + "Standard_RAGRS" + ], + "metadata": { + "description": "Storage Account type" + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for all resources." + } + }, + "appInsightsLocation": { + "type": "string", + "metadata": { + "description": "Location for Application Insights." + } + }, + "mimecastEmail": { + "type": "string", + "metadata": { + "description": "Mimecast API email address." + } + }, + "mimecastPassword": { + "type": "string", + "metadata": { + "description": "Mimecast API password." + } + }, + "mimecastAppId": { + "type": "string", + "metadata": { + "description": "Mimecast API Application ID." + } + }, + "mimecastAppKey": { + "type": "string", + "metadata": { + "description": "Mimecast API Application Key." + } + }, + "mimecastAccessKey": { + "type": "string", + "metadata": { + "description": "Mimecast API Access Key." + } + }, + "mimecastSecretKey": { + "type": "string", + "metadata": { + "description": "Mimecast API Secret Key." + } + }, + "mimecastBaseURL": { + "type": "string", + "metadata": { + "description": "Mimecast API Base URL in format https://region-api.mimecast.com." + } + }, + "activeDirectoryAppId": { + "type": "string", + "metadata": { + "description": "Application (client) ID of the registered application." + } + }, + "activeDirectoryAppSecret": { + "type": "string", + "metadata": { + "description": "Application secret of the registered application." + } + } + }, + "variables": { + "functionAppName": "[parameters('appName')]", + "hostingPlanName": "[parameters('appName')]", + "applicationInsightsName": "[parameters('appName')]", + "storageAccountName": "[parameters('appName')]" + }, + "resources": [ + { + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2019-06-01", + "name": "[variables('storageAccountName')]", + "location": "[parameters('location')]", + "sku": { + "name": "Standard_RAGRS", + "tier": "Standard" + }, + "kind": "StorageV2", + "resources": [ + { + "type": "blobServices/containers", + "apiVersion": "2019-06-01", + "name": "[concat('default/', 'siem-checkpoints')]", + "dependsOn": [ + "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]" + ], + "properties": { + "publicAccess": "None" + } + } + ] + }, + { + "type": "Microsoft.Web/serverfarms", + "apiVersion": "2020-09-01", + "name": "[variables('hostingPlanName')]", + "location": "[parameters('location')]", + "kind": "functionapp", + "sku": { + "name": "Y1", + "tier": "Dynamic", + "size": "Y1", + "family": "Y", + "capacity": 0 + }, + "properties": { + "name": "[variables('hostingPlanName')]", + "computeMode": "Dynamic", + "kind": "functionapp", + "reserved": true, + "isXenon": false, + "hyperV": false, + "azBalancing": false + } + }, + { + "type": "Microsoft.Web/sites", + "apiVersion": "2018-11-01", + "name": "[variables('functionAppName')]", + "location": "[parameters('location')]", + "kind": "functionapp,linux", + "identity": { + "type": "SystemAssigned" + }, + "dependsOn": [ + "[resourceId('Microsoft.Web/serverfarms', variables('hostingPlanName'))]", + "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]" + ], + "properties": { + "siteConfig": { + "linuxFxVersion": "Python|3.8" + }, + "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('hostingPlanName'))]", + "clientAffinityEnabled": false + }, + "resources": [ + { + "apiVersion": "2015-08-01", + "type": "config", + "name": "appsettings", + "dependsOn": [ + "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]", + "[resourceId('Microsoft.KeyVault/vaults/', variables('functionAppName'))]", + "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('functionAppName'), 'mimecast-email')]", + "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('functionAppName'), 'mimecast-password')]", + "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('functionAppName'), 'mimecast-app-id')]", + "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('functionAppName'), 'mimecast-app-key')]", + "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('functionAppName'), 'mimecast-access-key')]", + "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('functionAppName'), 'mimecast-secret-key')]", + "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('functionAppName'), 'mimecast-base-url')]", + "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('functionAppName'), 'active-directory-app-id')]", + "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('functionAppName'), 'active-directory-app-secret')]", + "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('functionAppName'), 'active-directory-tenant-id')]", + "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('functionAppName'), 'log-analytics-workspace-id')]", + "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('functionAppName'), 'log-analytics-workspace-key')]" + ], + "properties": { + "AzureWebJobsStorage": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';EndpointSuffix=', environment().suffixes.storage, ';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2019-06-01').keys[0].value)]", + "FUNCTIONS_EXTENSION_VERSION": "~3", + "FUNCTIONS_WORKER_RUNTIME": "python", + "APPINSIGHTS_INSTRUMENTATIONKEY": "[reference(resourceId('microsoft.insights/components', variables('applicationInsightsName')), '2020-02-02-preview').InstrumentationKey]", + "mimecast_email": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'mimecast-email', '/)')]", + "mimecast_password": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'mimecast-password', '/)')]", + "mimecast_app_id": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'mimecast-app-id', '/)')]", + "mimecast_app_key": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'mimecast-app-key', '/)')]", + "mimecast_access_key": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'mimecast-access-key', '/)')]", + "mimecast_secret_key": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'mimecast-secret-key', '/)')]", + "mimecast_base_url": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'mimecast-base-url', '/)')]", + "active_directory_app_id": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'active-directory-app-id', '/)')]", + "active_directory_app_secret": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'active-directory-app-secret', '/)')]", + "active_directory_tenant_id": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'active-directory-tenant-id', '/)')]", + "log_analytics_workspace_id": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'log-analytics-workspace-id', '/)')]", + "log_analytics_workspace_key": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'log-analytics-workspace-key', '/)')]", + "WEBSITE_RUN_FROM_PACKAGE": "https://aka.ms/sentinel-MimecastSEG-functionapp" + } + } + ] + }, + { + "apiVersion": "2015-03-20", + "name": "[variables('functionAppName')]", + "location": "[parameters('location')]", + "type": "Microsoft.OperationalInsights/workspaces", + "properties": { + "sku": { + "name": "pergb2018" + }, + "retentionInDays": 30, + "features": { + "legacy": 0, + "searchVersion": 1, + "enableLogAccessUsingOnlyResourcePermissions": true + }, + "publicNetworkAccessForIngestion": "Enabled", + "publicNetworkAccessForQuery": "Enabled" + } + }, + { + "type": "Microsoft.OperationsManagement/solutions", + "apiVersion": "2015-11-01-preview", + "name": "[concat('SecurityInsights','(', variables('functionAppName'),')')]", + "location": "[parameters('location')]", + "plan": { + "name": "[concat('SecurityInsights','(', variables('functionAppName'),')')]", + "promotionCode": "", + "product": "OMSGallery/SecurityInsights", + "publisher": "Microsoft" + }, + "dependsOn": [ + "[resourceId('Microsoft.OperationalInsights/workspaces/', variables('functionAppName'))]" + ], + "properties": { + "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces/', variables('functionAppName'))]" + } + }, + { + "type": "microsoft.insights/components", + "apiVersion": "2020-02-02-preview", + "name": "[variables('applicationInsightsName')]", + "location": "[parameters('appInsightsLocation')]", + "tags": { + "[concat('hidden-link:', resourceId('Microsoft.Web/sites', variables('applicationInsightsName')))]": "Resource" + }, + "properties": { + "ApplicationId": "[variables('applicationInsightsName')]", + "Request_Source": "IbizaWebAppExtensionCreate" + } + }, + { + "type": "Microsoft.KeyVault/vaults", + "name": "[variables('functionAppName')]", + "location": "[parameters('location')]", + "apiVersion": "2019-09-01", + "tags": { + "displayName": "KeyVault" + }, + "properties": { + "enabledForDeployment": false, + "enabledForTemplateDeployment": false, + "enabledForDiskEncryption": false, + "tenantId": "[subscription().tenantId]", + "accessPolicies": [ + { + "objectId": "[reference(resourceId('Microsoft.Web/sites', variables('functionAppName')),'2019-08-01', 'full').identity.principalId]", + "tenantId": "[subscription().tenantId]", + "permissions": { + "secrets": [ + "Get", + "List", + "Set", + "Delete", + "Recover", + "Backup", + "Restore" + ] + } + }, + { + "objectId": "[parameters('objectId')]", + "tenantId": "[subscription().tenantId]", + "permissions": { + "secrets": [ + "Get", + "List", + "Set", + "Delete", + "Recover", + "Backup", + "Restore" + ] + } + } + ], + "sku": { + "family": "A", + "name": "Standard" + }, + "networkAcls": { + "defaultAction": "Allow", + "bypass": "AzureServices" + } + } + }, + { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2019-09-01", + "name": "[concat(variables('functionAppName'), '/', 'mimecast-email')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.KeyVault/vaults', parameters('appName'))]" + ], + "properties": { + "value": "[parameters('mimecastEmail')]" + } + }, + { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2019-09-01", + "name": "[concat(variables('functionAppName'), '/', 'mimecast-password')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.KeyVault/vaults', parameters('appName'))]" + ], + "properties": { + "value": "[parameters('mimecastPassword')]" + } + }, + { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2019-09-01", + "name": "[concat(variables('functionAppName'), '/', 'mimecast-app-id')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.KeyVault/vaults', parameters('appName'))]" + ], + "properties": { + "value": "[parameters('mimecastAppId')]" + } + }, + { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2019-09-01", + "name": "[concat(variables('functionAppName'), '/', 'mimecast-app-key')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.KeyVault/vaults', parameters('appName'))]" + ], + "properties": { + "value": "[parameters('mimecastAppKey')]" + } + }, + { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2019-09-01", + "name": "[concat(variables('functionAppName'), '/', 'mimecast-access-key')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.KeyVault/vaults', parameters('appName'))]" + ], + "properties": { + "value": "[parameters('mimecastAccessKey')]" + } + }, + { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2019-09-01", + "name": "[concat(variables('functionAppName'), '/', 'mimecast-secret-key')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.KeyVault/vaults', parameters('appName'))]" + ], + "properties": { + "value": "[parameters('mimecastSecretKey')]" + } + }, + { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2019-09-01", + "name": "[concat(variables('functionAppName'), '/', 'mimecast-base-url')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.KeyVault/vaults', parameters('appName'))]" + ], + "properties": { + "value": "[parameters('mimecastBaseURL')]" + } + }, + { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2019-09-01", + "name": "[concat(variables('functionAppName'), '/', 'active-directory-app-id')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.KeyVault/vaults', parameters('appName'))]" + ], + "properties": { + "value": "[parameters('activeDirectoryAppId')]" + } + }, + { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2019-09-01", + "name": "[concat(variables('functionAppName'), '/', 'active-directory-app-secret')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.KeyVault/vaults', parameters('appName'))]" + ], + "properties": { + "value": "[parameters('activeDirectoryAppSecret')]" + } + }, + { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2019-09-01", + "name": "[concat(variables('functionAppName'), '/', 'active-directory-tenant-id')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.KeyVault/vaults', parameters('appName'))]" + ], + "properties": { + "value": "[subscription().tenantId]" + } + }, + { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2019-09-01", + "name": "[concat(variables('functionAppName'), '/', 'log-analytics-workspace-id')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.KeyVault/vaults', parameters('appName'))]", + "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('appName'))]" + ], + "properties": { + "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces/', parameters('appName')), '2015-03-20').customerId]" + } + }, + { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2019-09-01", + "name": "[concat(variables('functionAppName'), '/', 'log-analytics-workspace-key')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.KeyVault/vaults', parameters('appName'))]", + "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('appName'))]" + ], + "properties": { + "value": "[listKeys(resourceId('Microsoft.OperationalInsights/workspaces/', parameters('appName')), '2015-03-20').primarySharedKey]" + } + } + ] +} diff --git a/Solutions/MimecastSEG/Data Connectors/host.json b/Solutions/MimecastSEG/Data Connectors/host.json new file mode 100644 index 00000000000..8ce3f913565 --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/host.json @@ -0,0 +1,15 @@ +{ + "version": "2.0", + "logging": { + "applicationInsights": { + "samplingSettings": { + "isEnabled": true, + "excludedTypes": "Request" + } + } + }, + "extensionBundle": { + "id": "Microsoft.Azure.Functions.ExtensionBundle", + "version": "[2.*, 3.0.0)" + } +} \ No newline at end of file diff --git a/Solutions/MimecastSEG/Data Connectors/requirements.txt b/Solutions/MimecastSEG/Data Connectors/requirements.txt new file mode 100644 index 00000000000..25c984245fa --- /dev/null +++ b/Solutions/MimecastSEG/Data Connectors/requirements.txt @@ -0,0 +1,6 @@ +# Do not include azure-functions-worker as it may conflict with the Azure Functions platform + +azure-functions +datetime +requests~=2.25.1 +msal~=1.9.0 \ No newline at end of file diff --git a/Solutions/MimecastSEG/Data/Solution_MimecastSEG.json b/Solutions/MimecastSEG/Data/Solution_MimecastSEG.json new file mode 100644 index 00000000000..a03e40c4318 --- /dev/null +++ b/Solutions/MimecastSEG/Data/Solution_MimecastSEG.json @@ -0,0 +1,28 @@ +{ + "Name": "MimecastSEG", + "Author": "Mimecast - dlapi@mimecast.com", + "Logo": "", + "Description": "The data connector for [Mimecast Secure Email Gateway](https://community.mimecast.com/s/article/Azure-Sentinel) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Secure Email Gateway \n- Mimecast Data Leak Prevention\n \n\nMicrosoft Sentinel Solutions provide a consolidated way to acquire Microsoft Sentinel content like data connectors, workbooks, analytics, and automations in your workspace with a single deployment step.", + "Analytic Rules": [ + "Analytic Rules/MimecastDLP_Hold.yaml", + "Analytic Rules/MimecastDLP.yaml", + "Analytic Rules/MimecastSIEM_Attachment.yaml", + "Analytic Rules/MimecastSIEM_AV.yaml", + "Analytic Rules/MimecastSIEM_Impersonation.yaml", + "Analytic Rules/MimecastSIEM_Internal_Mail_Protect.yaml", + "Analytic Rules/MimecastSIEM_Spam_Event.yaml", + "Analytic Rules/MimecastSIEM_Url_Protect.yaml", + "Analytic Rules/MimecastSIEM_Virus.yaml" + ], + "Workbooks": [ + "Workbooks/MimecastSEGworkbook.json" + ], + "Data Connectors": [ + "Data Connectors/MimecastSEG_API_AzureFunctionApp.json" + ], + "BasePath": "C:\\Azure-Sentinel\\Solutions\\MimecastSEG", + "Version": "3.0.0", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false +} \ No newline at end of file diff --git a/Solutions/MimecastSEG/Package/3.0.0.zip b/Solutions/MimecastSEG/Package/3.0.0.zip new file mode 100644 index 00000000000..e7de0d45bb2 Binary files /dev/null and b/Solutions/MimecastSEG/Package/3.0.0.zip differ diff --git a/Solutions/MimecastSEG/Package/createUiDefinition.json b/Solutions/MimecastSEG/Package/createUiDefinition.json new file mode 100644 index 00000000000..b47c41e8d98 --- /dev/null +++ b/Solutions/MimecastSEG/Package/createUiDefinition.json @@ -0,0 +1,281 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#", + "handler": "Microsoft.Azure.CreateUIDef", + "version": "0.1.2-preview", + "parameters": { + "config": { + "isWizard": false, + "basics": { + "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe data connector for [Mimecast Secure Email Gateway](https://community.mimecast.com/s/article/Azure-Sentinel) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Secure Email Gateway \n- Mimecast Data Leak Prevention\n \n\nMicrosoft Sentinel Solutions provide a consolidated way to acquire Microsoft Sentinel content like data connectors, workbooks, analytics, and automations in your workspace with a single deployment step.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 9\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "subscription": { + "resourceProviders": [ + "Microsoft.OperationsManagement/solutions", + "Microsoft.OperationalInsights/workspaces/providers/alertRules", + "Microsoft.Insights/workbooks", + "Microsoft.Logic/workflows" + ] + }, + "location": { + "metadata": { + "hidden": "Hiding location, we get it from the log analytics workspace" + }, + "visible": false + }, + "resourceGroup": { + "allowExisting": true + } + } + }, + "basics": [ + { + "name": "getLAWorkspace", + "type": "Microsoft.Solutions.ArmApiControl", + "toolTip": "This filters by workspaces that exist in the Resource Group selected", + "condition": "[greater(length(resourceGroup().name),0)]", + "request": { + "method": "GET", + "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]" + } + }, + { + "name": "workspace", + "type": "Microsoft.Common.DropDown", + "label": "Workspace", + "placeholder": "Select a workspace", + "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected", + "constraints": { + "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": true + } + ], + "steps": [ + { + "name": "dataconnectors", + "label": "Data Connectors", + "bladeTitle": "Data Connectors", + "elements": [ + { + "name": "dataconnectors1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for MimecastSEG. You can get MimecastSEG custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors-link2", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more about connecting data sources", + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" + } + } + } + ] + }, + { + "name": "workbooks", + "label": "Workbooks", + "subLabel": { + "preValidation": "Configure the workbooks", + "postValidation": "Done" + }, + "bladeTitle": "Workbooks", + "elements": [ + { + "name": "workbooks-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." + } + }, + { + "name": "workbooks-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data" + } + } + }, + { + "name": "workbook1", + "type": "Microsoft.Common.Section", + "label": "MimecastSEG", + "elements": [ + { + "name": "workbook1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "A workbook providing insights into Mimecast Secure Email Gateway." + } + } + ] + } + ] + }, + { + "name": "analytics", + "label": "Analytics", + "subLabel": { + "preValidation": "Configure the analytics", + "postValidation": "Done" + }, + "bladeTitle": "Analytics", + "elements": [ + { + "name": "analytics-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view." + } + }, + { + "name": "analytics-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" + } + } + }, + { + "name": "analytic1", + "type": "Microsoft.Common.Section", + "label": "Mimecast Data Leak Prevention - Hold", + "elements": [ + { + "name": "analytic1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects threat for data leak when action is hold" + } + } + ] + }, + { + "name": "analytic2", + "type": "Microsoft.Common.Section", + "label": "Mimecast Data Leak Prevention - Notifications", + "elements": [ + { + "name": "analytic2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects threat for data leak when action is notification" + } + } + ] + }, + { + "name": "analytic3", + "type": "Microsoft.Common.Section", + "label": "Mimecast Secure Email Gateway - Attachment Protect", + "elements": [ + { + "name": "analytic3-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detect threat for mail attachment under the targeted threat protection" + } + } + ] + }, + { + "name": "analytic4", + "type": "Microsoft.Common.Section", + "label": "Mimecast Secure Email Gateway - AV", + "elements": [ + { + "name": "analytic4-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects threats from email anti virus scan" + } + } + ] + }, + { + "name": "analytic5", + "type": "Microsoft.Common.Section", + "label": "Mimecast Secure Email Gateway - Impersonation Protect", + "elements": [ + { + "name": "analytic5-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects threats from impersonation mail under targeted threat protection" + } + } + ] + }, + { + "name": "analytic6", + "type": "Microsoft.Common.Section", + "label": "Mimecast Secure Email Gateway - Internal Email Protect", + "elements": [ + { + "name": "analytic6-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects threats from internal email threat protection" + } + } + ] + }, + { + "name": "analytic7", + "type": "Microsoft.Common.Section", + "label": "Mimecast Secure Email Gateway - Spam Event Thread", + "elements": [ + { + "name": "analytic7-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects threat from spam event thread protection logs" + } + } + ] + }, + { + "name": "analytic8", + "type": "Microsoft.Common.Section", + "label": "Mimecast Secure Email Gateway - URL Protect", + "elements": [ + { + "name": "analytic8-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detect threat when potentially malicious url found" + } + } + ] + }, + { + "name": "analytic9", + "type": "Microsoft.Common.Section", + "label": "Mimecast Secure Email Gateway - Virus", + "elements": [ + { + "name": "analytic9-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detect threat for virus from mail receipt virus event" + } + } + ] + } + ] + } + ], + "outputs": { + "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", + "location": "[location()]", + "workspace": "[basics('workspace')]" + } + } +} diff --git a/Solutions/MimecastSEG/Package/mainTemplate.json b/Solutions/MimecastSEG/Package/mainTemplate.json new file mode 100644 index 00000000000..8b1a5cd1b32 --- /dev/null +++ b/Solutions/MimecastSEG/Package/mainTemplate.json @@ -0,0 +1,1944 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "author": "Mimecast - dlapi@mimecast.com", + "comments": "Solution template for MimecastSEG" + }, + "parameters": { + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "MimecastSEG", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + } + }, + "variables": { + "email": "dlapi@mimecast.com", + "_email": "[variables('email')]", + "_solutionName": "MimecastSEG", + "_solutionVersion": "3.0.0", + "solutionId": "mimecast.azure-sentinel-solution-mimecastseg", + "_solutionId": "[variables('solutionId')]", + "analyticRuleVersion1": "1.0.0", + "analyticRulecontentId1": "3e12b7b1-75e5-497c-ba01-b6cb30b60d7f", + "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))))]", + "analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId1'),'-', variables('analyticRuleVersion1'))))]", + "_analyticRulecontentProductId1": "[variables('analyticRulecontentProductId1')]", + "analyticRuleVersion2": "1.0.0", + "analyticRulecontentId2": "1818aeaa-4cc8-426b-ba54-539de896d299", + "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2'))))]", + "analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId2'),'-', variables('analyticRuleVersion2'))))]", + "_analyticRulecontentProductId2": "[variables('analyticRulecontentProductId2')]", + "analyticRuleVersion3": "1.0.0", + "analyticRulecontentId3": "72264f4f-61fb-4f4f-96c4-635571a376c2", + "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3'))))]", + "analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId3'),'-', variables('analyticRuleVersion3'))))]", + "_analyticRulecontentProductId3": "[variables('analyticRulecontentProductId3')]", + "analyticRuleVersion4": "1.0.0", + "analyticRulecontentId4": "0f0dc725-29dc-48c3-bf10-bd2f34fd1cbb", + "_analyticRulecontentId4": "[variables('analyticRulecontentId4')]", + "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId4'))]", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId4'))))]", + "analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId4'),'-', variables('analyticRuleVersion4'))))]", + "_analyticRulecontentProductId4": "[variables('analyticRulecontentProductId4')]", + "analyticRuleVersion5": "1.0.0", + "analyticRulecontentId5": "7034abc9-6b66-4533-9bf3-056672fd9d9e", + "_analyticRulecontentId5": "[variables('analyticRulecontentId5')]", + "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId5'))]", + "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId5'))))]", + "analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId5'),'-', variables('analyticRuleVersion5'))))]", + "_analyticRulecontentProductId5": "[variables('analyticRulecontentProductId5')]", + "analyticRuleVersion6": "1.0.0", + "analyticRulecontentId6": "5b66d176-e344-4abf-b915-e5f09a6430ef", + "_analyticRulecontentId6": "[variables('analyticRulecontentId6')]", + "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId6'))]", + "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId6'))))]", + "analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId6'),'-', variables('analyticRuleVersion6'))))]", + "_analyticRulecontentProductId6": "[variables('analyticRulecontentProductId6')]", + "analyticRuleVersion7": "1.0.0", + "analyticRulecontentId7": "df1b9377-5c29-4928-872f-9934a6b4f611", + "_analyticRulecontentId7": "[variables('analyticRulecontentId7')]", + "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId7'))]", + "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId7'))))]", + "analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId7'),'-', variables('analyticRuleVersion7'))))]", + "_analyticRulecontentProductId7": "[variables('analyticRulecontentProductId7')]", + "analyticRuleVersion8": "1.0.0", + "analyticRulecontentId8": "ea19dae6-bbb3-4444-a1b8-8e9ae6064aab", + "_analyticRulecontentId8": "[variables('analyticRulecontentId8')]", + "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId8'))]", + "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId8'))))]", + "analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId8'),'-', variables('analyticRuleVersion8'))))]", + "_analyticRulecontentProductId8": "[variables('analyticRulecontentProductId8')]", + "analyticRuleVersion9": "1.0.0", + "analyticRulecontentId9": "30f73baa-602c-4373-8f02-04ff5e51fc7f", + "_analyticRulecontentId9": "[variables('analyticRulecontentId9')]", + "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId9'))]", + "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId9'))))]", + "analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId9'),'-', variables('analyticRuleVersion9'))))]", + "_analyticRulecontentProductId9": "[variables('analyticRulecontentProductId9')]", + "workbookVersion1": "1.0.0", + "workbookContentId1": "MimecastSEG", + "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", + "_workbookContentId1": "[variables('workbookContentId1')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "_workbookcontentProductId1": "[variables('workbookcontentProductId1')]", + "uiConfigId1": "MimecastSIEMAPI", + "_uiConfigId1": "[variables('uiConfigId1')]", + "dataConnectorContentId1": "MimecastSIEMAPI", + "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", + "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "_dataConnectorId1": "[variables('dataConnectorId1')]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", + "dataConnectorVersion1": "1.0.0", + "dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "_dataConnectorcontentProductId1": "[variables('dataConnectorcontentProductId1')]", + "solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]", + "_solutioncontentProductId": "[variables('solutioncontentProductId')]", + "MessageId": "MsgId_s", + "_MessageId": "[variables('MessageId')]", + "msgid": "msgid_s", + "_msgid": "[variables('msgid')]" + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MimecastDLP_Hold_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId1')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects threat for data leak when action is hold", + "displayName": "Mimecast Data Leak Prevention - Hold", + "enabled": false, + "query": "MimecastDLP_CL| where action_s == \"hold\";", + "queryFrequency": "PT5M", + "queryPeriod": "PT15M", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "MimecastSIEMAPI", + "dataTypes": [ + "MimecastDLP_CL" + ] + } + ], + "tactics": [ + "Exfiltration" + ], + "techniques": [ + "T1030" + ], + "entityMappings": [ + { + "entityType": "MailMessage", + "fieldMappings": [ + { + "identifier": "Sender", + "columnName": "senderAddress_s" + }, + { + "identifier": "Recipient", + "columnName": "recipientAddress_s" + }, + { + "identifier": "DeliveryAction", + "columnName": "action_s" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "incidentConfiguration": { + "createIncident": true, + "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "AllEntities", + "enabled": true, + "lookbackDuration": "1d" + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", + "properties": { + "description": "MimecastSEG Analytics Rule 1", + "parentId": "[variables('analyticRuleId1')]", + "contentId": "[variables('_analyticRulecontentId1')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion1')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId1')]", + "contentKind": "AnalyticsRule", + "displayName": "Mimecast Data Leak Prevention - Hold", + "contentProductId": "[variables('_analyticRulecontentProductId1')]", + "id": "[variables('_analyticRulecontentProductId1')]", + "version": "[variables('analyticRuleVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName2')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MimecastDLP_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion2')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId2')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects threat for data leak when action is notification", + "displayName": "Mimecast Data Leak Prevention - Notifications", + "enabled": false, + "query": "MimecastDLP_CL| where action_s == \"notification\";", + "queryFrequency": "PT5M", + "queryPeriod": "PT15M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "MimecastSIEMAPI", + "dataTypes": [ + "MimecastDLP_CL" + ] + } + ], + "tactics": [ + "Exfiltration" + ], + "techniques": [ + "T1030" + ], + "entityMappings": [ + { + "entityType": "MailMessage", + "fieldMappings": [ + { + "identifier": "Sender", + "columnName": "senderAddress_s" + }, + { + "identifier": "Recipient", + "columnName": "recipientAddress_s" + }, + { + "identifier": "DeliveryAction", + "columnName": "action_s" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "incidentConfiguration": { + "createIncident": true, + "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "AllEntities", + "enabled": true, + "lookbackDuration": "1d" + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", + "properties": { + "description": "MimecastSEG Analytics Rule 2", + "parentId": "[variables('analyticRuleId2')]", + "contentId": "[variables('_analyticRulecontentId2')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion2')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId2')]", + "contentKind": "AnalyticsRule", + "displayName": "Mimecast Data Leak Prevention - Notifications", + "contentProductId": "[variables('_analyticRulecontentProductId2')]", + "id": "[variables('_analyticRulecontentProductId2')]", + "version": "[variables('analyticRuleVersion2')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName3')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MimecastSIEM_Attachment_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion3')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId3')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detect threat for mail attachment under the targeted threat protection", + "displayName": "Mimecast Secure Email Gateway - Attachment Protect", + "enabled": false, + "query": "MimecastSIEM_CL| where mimecastEventId_s==\"mail_ttp_attachment\"", + "queryFrequency": "PT5M", + "queryPeriod": "PT15M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "MimecastSIEMAPI", + "dataTypes": [ + "MimecastSIEM_CL" + ] + } + ], + "tactics": [ + "Collection", + "Exfiltration", + "Discovery", + "InitialAccess", + "Execution" + ], + "techniques": [ + "T1114", + "T1566", + "T0865" + ], + "entityMappings": [ + { + "entityType": "MailMessage", + "fieldMappings": [ + { + "identifier": "Sender", + "columnName": "Sender_s" + }, + { + "identifier": "Recipient", + "columnName": "Recipient_s" + }, + { + "identifier": "Subject", + "columnName": "Subject_s" + } + ] + }, + { + "entityType": "IP", + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "IP_s" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "MsgId": "[variables('_MessageId')]", + "fileName": "fileName_s", + "sha256": "sha256_s" + }, + "incidentConfiguration": { + "createIncident": true, + "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "AllEntities", + "enabled": true, + "lookbackDuration": "1d" + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId3'),'/'))))]", + "properties": { + "description": "MimecastSEG Analytics Rule 3", + "parentId": "[variables('analyticRuleId3')]", + "contentId": "[variables('_analyticRulecontentId3')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion3')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId3')]", + "contentKind": "AnalyticsRule", + "displayName": "Mimecast Secure Email Gateway - Attachment Protect", + "contentProductId": "[variables('_analyticRulecontentProductId3')]", + "id": "[variables('_analyticRulecontentProductId3')]", + "version": "[variables('analyticRuleVersion3')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName4')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MimecastSIEM_AV_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion4')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId4')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects threats from email anti virus scan", + "displayName": "Mimecast Secure Email Gateway - AV", + "enabled": false, + "query": "MimecastSIEM_CL| where mimecastEventId_s==\"mail_av\"", + "queryFrequency": "PT5M", + "queryPeriod": "PT15M", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "MimecastSIEMAPI", + "dataTypes": [ + "MimecastSIEM_CL" + ] + } + ], + "tactics": [ + "Execution" + ], + "techniques": [ + "T1053" + ], + "entityMappings": [ + { + "entityType": "MailMessage", + "fieldMappings": [ + { + "identifier": "Sender", + "columnName": "Sender_s" + }, + { + "identifier": "Recipient", + "columnName": "Recipient_s" + }, + { + "identifier": "Subject", + "columnName": "Subject_s" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "sha1": "sha1_s", + "fileName": "fileName_s", + "MimecastIP": "MimecastIP_s", + "SenderDomain": "SenderDomain_s", + "CustomerIP": "CustomerIP_s", + "fileMime": "fileMime_s", + "Route": "Route_s", + "sha256": "sha256_s", + "MsgId": "[variables('_MessageId')]", + "IP": "IP_s", + "fileExt": "fileExt_s", + "Virus": "Virus_s", + "SenderDomainInternal": "SenderDomainInternal_s", + "Size": "Size_s", + "md5": "md5_g" + }, + "incidentConfiguration": { + "createIncident": true, + "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "AllEntities", + "enabled": true, + "lookbackDuration": "1d" + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId4'),'/'))))]", + "properties": { + "description": "MimecastSEG Analytics Rule 4", + "parentId": "[variables('analyticRuleId4')]", + "contentId": "[variables('_analyticRulecontentId4')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion4')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId4')]", + "contentKind": "AnalyticsRule", + "displayName": "Mimecast Secure Email Gateway - AV", + "contentProductId": "[variables('_analyticRulecontentProductId4')]", + "id": "[variables('_analyticRulecontentProductId4')]", + "version": "[variables('analyticRuleVersion4')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName5')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MimecastSIEM_Impersonation_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion5')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId5')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects threats from impersonation mail under targeted threat protection", + "displayName": "Mimecast Secure Email Gateway - Impersonation Protect", + "enabled": false, + "query": "MimecastSIEM_CL| where mimecastEventId_s == \"mail_ttp_impersonation\"", + "queryFrequency": "PT5M", + "queryPeriod": "PT15M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "MimecastSIEMAPI", + "dataTypes": [ + "MimecastSIEM_CL" + ] + } + ], + "tactics": [ + "Discovery", + "LateralMovement", + "Collection" + ], + "techniques": [ + "T1114" + ], + "entityMappings": [ + { + "entityType": "MailMessage", + "fieldMappings": [ + { + "identifier": "Sender", + "columnName": "Sender_s" + }, + { + "identifier": "SenderIP", + "columnName": "IP_s" + }, + { + "identifier": "Recipient", + "columnName": "Recipient_s" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "SimilarCustExtDomain": "SimilarCustomExternalDomain_s", + "ThreatDictionary": "ThreatDictionary_s", + "Hits": "Hits_s", + "CustomName": "CustomName_s", + "Definition": "Definition_s", + "SimilarIntDomain": "SimilarInternalDomain_s", + "ReplyMismatch": "ReplyMismatch_s", + "TaggedExternal": "TaggedExternal_s", + "SimilarMCExtDomain": "SimilarMimecastExternalDomain_s", + "Action": "Action_s", + "Route": "Route_s", + "Subject": "Subject_s", + "MsgId": "[variables('_MessageId')]", + "InternalName": "InternalName_s", + "NewDomain": "NewDomain_s", + "TaggedMalicious": "TaggedMalicious_s", + "CustomThreatDict": "CustomThreatDictionary_s" + }, + "incidentConfiguration": { + "createIncident": true, + "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "AllEntities", + "enabled": true, + "lookbackDuration": "1d" + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId5'),'/'))))]", + "properties": { + "description": "MimecastSEG Analytics Rule 5", + "parentId": "[variables('analyticRuleId5')]", + "contentId": "[variables('_analyticRulecontentId5')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion5')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId5')]", + "contentKind": "AnalyticsRule", + "displayName": "Mimecast Secure Email Gateway - Impersonation Protect", + "contentProductId": "[variables('_analyticRulecontentProductId5')]", + "id": "[variables('_analyticRulecontentProductId5')]", + "version": "[variables('analyticRuleVersion5')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName6')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MimecastSIEM_Internal_Mail_Protect_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion6')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId6')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects threats from internal email threat protection", + "displayName": "Mimecast Secure Email Gateway - Internal Email Protect", + "enabled": false, + "query": "MimecastSIEM_CL| where mimecastEventId_s==\"mail_ttp_iep\"", + "queryFrequency": "PT5M", + "queryPeriod": "PT15M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "MimecastSIEMAPI", + "dataTypes": [ + "MimecastSIEM_CL" + ] + } + ], + "tactics": [ + "LateralMovement", + "Persistence", + "Exfiltration" + ], + "techniques": [ + "T1534", + "T1546" + ], + "entityMappings": [ + { + "entityType": "MailMessage", + "fieldMappings": [ + { + "identifier": "Sender", + "columnName": "Sender_s" + }, + { + "identifier": "Recipient", + "columnName": "Recipient_s" + }, + { + "identifier": "InternetMessageId", + "columnName": "[variables('_MessageId')]" + } + ] + }, + { + "entityType": "URL", + "fieldMappings": [ + { + "identifier": "Url", + "columnName": "URL_s" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "Subject": "Subject_s", + "UrlCategory": "UrlCategory_s", + "Route": "Route_s", + "ScanResultInfo": "ScanResultInfo_s" + }, + "incidentConfiguration": { + "createIncident": true, + "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "AllEntities", + "enabled": true, + "lookbackDuration": "1d" + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId6'),'/'))))]", + "properties": { + "description": "MimecastSEG Analytics Rule 6", + "parentId": "[variables('analyticRuleId6')]", + "contentId": "[variables('_analyticRulecontentId6')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion6')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId6')]", + "contentKind": "AnalyticsRule", + "displayName": "Mimecast Secure Email Gateway - Internal Email Protect", + "contentProductId": "[variables('_analyticRulecontentProductId6')]", + "id": "[variables('_analyticRulecontentProductId6')]", + "version": "[variables('analyticRuleVersion6')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName7')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MimecastSIEM_Spam_Event_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion7')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId7')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects threat from spam event thread protection logs", + "displayName": "Mimecast Secure Email Gateway - Spam Event Thread", + "enabled": false, + "query": "MimecastSIEM_CL| where mimecastEventId_s==\"mail_spameventthread\"", + "queryFrequency": "PT5M", + "queryPeriod": "PT15M", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "MimecastSIEMAPI", + "dataTypes": [ + "MimecastSIEM_CL" + ] + } + ], + "tactics": [ + "Discovery" + ], + "techniques": [ + "T1083" + ], + "entityMappings": [ + { + "entityType": "MailMessage", + "fieldMappings": [ + { + "identifier": "Sender", + "columnName": "Sender_s" + }, + { + "identifier": "Recipient", + "columnName": "Recipient_s" + }, + { + "identifier": "Subject", + "columnName": "Subject_s" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "MsgId": "[variables('_MessageId')]", + "SenderDomain": "SenderDomain_s", + "headerFrom": "headerFrom_s", + "Route": "Route_s", + "SourceIP": "SourceIP" + }, + "incidentConfiguration": { + "createIncident": true, + "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "AllEntities", + "enabled": true, + "lookbackDuration": "1d" + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId7'),'/'))))]", + "properties": { + "description": "MimecastSEG Analytics Rule 7", + "parentId": "[variables('analyticRuleId7')]", + "contentId": "[variables('_analyticRulecontentId7')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion7')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId7')]", + "contentKind": "AnalyticsRule", + "displayName": "Mimecast Secure Email Gateway - Spam Event Thread", + "contentProductId": "[variables('_analyticRulecontentProductId7')]", + "id": "[variables('_analyticRulecontentProductId7')]", + "version": "[variables('analyticRuleVersion7')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName8')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MimecastSIEM_Url_Protect_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion8')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId8')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detect threat when potentially malicious url found", + "displayName": "Mimecast Secure Email Gateway - URL Protect", + "enabled": false, + "query": "MimecastSIEM_CL| where mimecastEventId_s==\"mail_ttp_url\" and reason_s != \"clean\"", + "queryFrequency": "PT5M", + "queryPeriod": "PT15M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "MimecastSIEMAPI", + "dataTypes": [ + "MimecastSIEM_CL" + ] + } + ], + "tactics": [ + "InitialAccess", + "Discovery", + "Execution" + ], + "techniques": [ + "T1566" + ], + "entityMappings": [ + { + "entityType": "MailMessage", + "fieldMappings": [ + { + "identifier": "Sender", + "columnName": "sender_s" + }, + { + "identifier": "Recipient", + "columnName": "recipient_s" + }, + { + "identifier": "Subject", + "columnName": "subject_s" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "msgid": "[variables('_msgid')]", + "route": "route_s", + "credentialTheft": "credentialTheft_s", + "action": "action_s", + "urlCategory": "urlCategory_s", + "SourceIP": "SourceIP", + "senderDomain": "senderDomain_s", + "url": "url_s", + "reason": "reason_s" + }, + "incidentConfiguration": { + "createIncident": true, + "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "AllEntities", + "enabled": true, + "lookbackDuration": "1d" + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId8'),'/'))))]", + "properties": { + "description": "MimecastSEG Analytics Rule 8", + "parentId": "[variables('analyticRuleId8')]", + "contentId": "[variables('_analyticRulecontentId8')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion8')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId8')]", + "contentKind": "AnalyticsRule", + "displayName": "Mimecast Secure Email Gateway - URL Protect", + "contentProductId": "[variables('_analyticRulecontentProductId8')]", + "id": "[variables('_analyticRulecontentProductId8')]", + "version": "[variables('analyticRuleVersion8')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName9')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MimecastSIEM_Virus_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion9')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId9')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detect threat for virus from mail receipt virus event", + "displayName": "Mimecast Secure Email Gateway - Virus", + "enabled": false, + "query": "MimecastSIEM_CL| where mimecastEventId_s==\"mail_receipt_virus\"", + "queryFrequency": "PT5M", + "queryPeriod": "PT15M", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "MimecastSIEMAPI", + "dataTypes": [ + "MimecastSIEM_CL" + ] + } + ], + "tactics": [ + "Execution" + ], + "techniques": [ + "T1053" + ], + "entityMappings": [ + { + "entityType": "MailMessage", + "fieldMappings": [ + { + "identifier": "Sender", + "columnName": "Sender_s" + }, + { + "identifier": "Recipient", + "columnName": "Rcpt_s" + }, + { + "identifier": "Subject", + "columnName": "Subject_s" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "TlsVer": "TlsVer_s", + "IP": "IP_s", + "RejCode": "RejCode_s", + "headerFrom": "headerFrom_s", + "Dir": "Dir_s", + "Cphr": "Cphr_s", + "RejType": "RejType_s", + "Act": "Act_s", + "RejInfo": "RejInfo_s", + "Error": "Error_s", + "MsgId": "[variables('_MessageId')]", + "Virus": "Virus_s" + }, + "incidentConfiguration": { + "createIncident": true, + "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "AllEntities", + "enabled": true, + "lookbackDuration": "1d" + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId9'),'/'))))]", + "properties": { + "description": "MimecastSEG Analytics Rule 9", + "parentId": "[variables('analyticRuleId9')]", + "contentId": "[variables('_analyticRulecontentId9')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion9')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId9')]", + "contentKind": "AnalyticsRule", + "displayName": "Mimecast Secure Email Gateway - Virus", + "contentProductId": "[variables('_analyticRulecontentProductId9')]", + "id": "[variables('_analyticRulecontentProductId9')]", + "version": "[variables('analyticRuleVersion9')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MimecastSEGworkbookWorkbook Workbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('workbookVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", + "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "A workbook providing insights into Mimecast Secure Email Gateway." + }, + "properties": { + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"8ccaabbc-2531-4a3a-a4d1-22890e77fe7e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"time_range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1209600000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6\"},{\"type\":1,\"content\":{\"json\":\"# Mail Receipt Events\"},\"name\":\"text - 2\"},{\"type\":1,\"content\":{\"json\":\"## Receipt Events by Mimecast Event Id\",\"style\":\"info\"},\"name\":\"text - 25\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"receipt\\\"\\n| summarize count() by mimecastEventId_s, bin(TimeGenerated, 1h)\",\"size\":3,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"mail_receipt_received\",\"label\":\"Received\"},{\"seriesName\":\"mail_receipt_virus\",\"label\":\"Viruses\"},{\"seriesName\":\"mail_receipt_received_notls\",\"label\":\"Non-TLS\"},{\"seriesName\":\"mail_receipt_rejected\",\"label\":\"Rejected\"},{\"seriesName\":\"mail_receipt_spam\",\"label\":\"Spam\"}]}},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"## Rejection Types\",\"style\":\"info\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"receipt\\\" and mimecastEventId_s == \\\"mail_receipt_rejected\\\" and RejType_s !=\\\"\\\"\\n| summarize count() by RejType_s , bin(TimeGenerated, 1h)\",\"size\":3,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"RejType_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":true,\"size\":\"auto\"},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"RejType_s\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"nodeIdField\":\"RejType_s\",\"sourceIdField\":\"TimeGenerated\",\"targetIdField\":\"count_\",\"graphOrientation\":1,\"showOrientationToggles\":false,\"nodeSize\":\"\",\"staticNodeSize\":100,\"colorSettings\":\"\",\"hivesMargin\":5},\"chartSettings\":{\"createOtherGroup\":0},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"count_\",\"heatmapPalette\":\"greenRed\"}}},\"name\":\"query - 14\"},{\"type\":1,\"content\":{\"json\":\"## Rejections - Spam\",\"style\":\"info\"},\"name\":\"text - 13\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"receipt\\\" and mimecastEventId_s==\\\"mail_receipt_spam\\\"\\n| summarize count() by Sender_s, headerFrom_s, Rcpt_s, IP_s, Subject_s, SpamScore_s, bin(TimeGenerated, 1h)\\n\",\"size\":0,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"SpamScore_s\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"SpamScore_s\",\"sortOrder\":1}],\"chartSettings\":{\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"mail_receipt_spam\",\"label\":\"Spam\"}]}},\"name\":\"query - 14\"},{\"type\":1,\"content\":{\"json\":\"## Rejections - Malware\",\"style\":\"info\"},\"name\":\"text - 15\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"receipt\\\" and mimecastEventId_s == \\\"mail_receipt_virus\\\" and RejType_s != \\\"\\\"\\n| summarize count() by Sender_s, headerFrom_s, Rcpt_s, IP_s, Subject_s, RejInfo_s, Virus_s, Error_s, bin(TimeGenerated, 1h)\",\"size\":0,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"Sender_s\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"mapSettings\":{\"locInfo\":\"AzureResource\",\"locInfoColumn\":\"Error_s\",\"sizeAggregation\":\"Count\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"thresholds\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"blue\"}]}}},\"name\":\"query - 16\"},{\"type\":1,\"content\":{\"json\":\"# Mail Process Events\",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"process\\\"\\n| summarize dcount=count() by TenantId, SourceSystem, MG, ManagementGroupName, TimeGenerated, Computer, RawData, Err_s, datetime_t, aCode_s, acc_s, Sender_s, Rcpt_s, RcptActType_s, Dir_s, RcptHdrType_s, logType_s, mimecastEventId_s, mimecastEventCategory_s, CustomThreatDictionary_s, Action_s, Hits_s, SimilarCustomExternalDomain_s, TaggedExternal_s, SimilarInternalDomain_s, IP_s, Definition_s, Recipient_s, NewDomain_s, InternalName_s, ThreatDictionary_s, MsgId_s, Subject_s, SimilarMimecastExternalDomain_s, CustomName_s, TaggedMalicious_s, ReplyMismatch_s, Route_s, Delivered_s, AttCnt_s, ReceiptAck_s, Latency_s, AttSize_s, Attempt_s, TlsVer_s, Cphr_s, Snt_s, UseTls_s, Hld_s, IPNewDomain_s, AttNames_s, MsgSize_s, IPThreadDict_s, IPSimilarDomain_s, Act_s, IPReplyMismatch_s, IPInternalName_s, SpamLimit_s, headerFrom_s, SpamInfo_s, SpamScore_s, SpamProcessingDetail_s, fileName_s, sha256_s, Size_s, SenderDomain_s, fileExt_s, sha1_s, fileMime_s, md5_g, RejType_s, Error_s, RejCode_s, RejInfo_s, aCode_g, Virus_s, UrlCategory_s, ScanResultInfo_s, URL_s, MimecastIP_s, SenderDomainInternal_s, CustomerIP_s, SourceIP, reason_s, subject_s, msgid_s, url_s, route_s, sender_s, recipient_s, action_s, urlCategory_s, credentialTheft_s, senderDomain_s, Type, _ResourceId\\n| summarize count() by mimecastEventId_s, bin(TimeGenerated, 1h)\",\"size\":3,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"mail_process_accepted\",\"label\":\"Accepted\",\"color\":\"green\"},{\"seriesName\":\"mail_process_held\",\"label\":\"Held\",\"color\":\"brown\"},{\"seriesName\":\"mail_process_sandboxed\",\"label\":\"Sandboxed\",\"color\":\"turquoise\"},{\"seriesName\":\"mail_process_retried\",\"label\":\"Retries\",\"color\":\"pink\"}]}},\"name\":\"query - 3\"},{\"type\":1,\"content\":{\"json\":\"## Held Messages\",\"style\":\"info\"},\"name\":\"text - 18\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"process\\\" and Hld_s != \\\"\\\"\\n| summarize count() by TenantId, SourceSystem, MG, ManagementGroupName, TimeGenerated, Computer, RawData, Err_s, datetime_t, aCode_s, acc_s, Sender_s, Rcpt_s, RcptActType_s, Dir_s, RcptHdrType_s, logType_s, mimecastEventId_s, mimecastEventCategory_s, CustomThreatDictionary_s, Action_s, Hits_s, SimilarCustomExternalDomain_s, TaggedExternal_s, SimilarInternalDomain_s, IP_s, Definition_s, Recipient_s, NewDomain_s, InternalName_s, ThreatDictionary_s, MsgId_s, Subject_s, SimilarMimecastExternalDomain_s, CustomName_s, TaggedMalicious_s, ReplyMismatch_s, Route_s, Delivered_s, AttCnt_s, ReceiptAck_s, Latency_s, AttSize_s, Attempt_s, TlsVer_s, Cphr_s, Snt_s, UseTls_s, Hld_s, IPNewDomain_s, AttNames_s, MsgSize_s, IPThreadDict_s, IPSimilarDomain_s, Act_s, IPReplyMismatch_s, IPInternalName_s, SpamLimit_s, headerFrom_s, SpamInfo_s, SpamScore_s, SpamProcessingDetail_s, fileName_s, sha256_s, Size_s, SenderDomain_s, fileExt_s, sha1_s, fileMime_s, md5_g, RejType_s, Error_s, RejCode_s, RejInfo_s, aCode_g, Virus_s, UrlCategory_s, ScanResultInfo_s, URL_s, MimecastIP_s, SenderDomainInternal_s, CustomerIP_s, SourceIP, reason_s, subject_s, msgid_s, url_s, route_s, sender_s, recipient_s, action_s, urlCategory_s, credentialTheft_s, senderDomain_s, Type, _ResourceId\\n| summarize count() by Hld_s, Sender_s, Subject_s, AttSize_s, AttCnt_s, AttNames_s, MsgSize_s, bin(TimeGenerated, 1h)\\n\",\"size\":0,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 17\"},{\"type\":1,\"content\":{\"json\":\"## Message Delivery Retried\\n\",\"style\":\"info\"},\"name\":\"text - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"process\\\" and mimecastEventId_s==\\\"mail_process_retried\\\"\\n| summarize count() by TenantId, SourceSystem, MG, ManagementGroupName, TimeGenerated, Computer, RawData, Err_s, datetime_t, aCode_s, acc_s, Sender_s, Rcpt_s, RcptActType_s, Dir_s, RcptHdrType_s, logType_s, mimecastEventId_s, mimecastEventCategory_s, CustomThreatDictionary_s, Action_s, Hits_s, SimilarCustomExternalDomain_s, TaggedExternal_s, SimilarInternalDomain_s, IP_s, Definition_s, Recipient_s, NewDomain_s, InternalName_s, ThreatDictionary_s, MsgId_s, Subject_s, SimilarMimecastExternalDomain_s, CustomName_s, TaggedMalicious_s, ReplyMismatch_s, Route_s, Delivered_s, AttCnt_s, ReceiptAck_s, Latency_s, AttSize_s, Attempt_s, TlsVer_s, Cphr_s, Snt_s, UseTls_s, Hld_s, IPNewDomain_s, AttNames_s, MsgSize_s, IPThreadDict_s, IPSimilarDomain_s, Act_s, IPReplyMismatch_s, IPInternalName_s, SpamLimit_s, headerFrom_s, SpamInfo_s, SpamScore_s, SpamProcessingDetail_s, fileName_s, sha256_s, Size_s, SenderDomain_s, fileExt_s, sha1_s, fileMime_s, md5_g, RejType_s, Error_s, RejCode_s, RejInfo_s, aCode_g, Virus_s, UrlCategory_s, ScanResultInfo_s, URL_s, MimecastIP_s, SenderDomainInternal_s, CustomerIP_s, SourceIP, reason_s, subject_s, msgid_s, url_s, route_s, sender_s, recipient_s, action_s, urlCategory_s, credentialTheft_s, senderDomain_s, Type, _ResourceId\\n| summarize count() by Sender_s, Subject_s, MsgId_s, AttCnt_s, AttNames_s, AttSize_s, MsgSize_s, bin(TimeGenerated, 1h)\\n\",\"size\":0,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"name\":\"query - 20\"},{\"type\":1,\"content\":{\"json\":\"## Messages with Sandboxed Attachments\",\"style\":\"info\"},\"name\":\"text - 21\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"process\\\" and mimecastEventId_s==\\\"mail_process_sandboxed\\\"\\n| summarize count() by TenantId, SourceSystem, MG, ManagementGroupName, TimeGenerated, Computer, RawData, Err_s, datetime_t, aCode_s, acc_s, Sender_s, Rcpt_s, RcptActType_s, Dir_s, RcptHdrType_s, logType_s, mimecastEventId_s, mimecastEventCategory_s, CustomThreatDictionary_s, Action_s, Hits_s, SimilarCustomExternalDomain_s, TaggedExternal_s, SimilarInternalDomain_s, IP_s, Definition_s, Recipient_s, NewDomain_s, InternalName_s, ThreatDictionary_s, MsgId_s, Subject_s, SimilarMimecastExternalDomain_s, CustomName_s, TaggedMalicious_s, ReplyMismatch_s, Route_s, Delivered_s, AttCnt_s, ReceiptAck_s, Latency_s, AttSize_s, Attempt_s, TlsVer_s, Cphr_s, Snt_s, UseTls_s, Hld_s, IPNewDomain_s, AttNames_s, MsgSize_s, IPThreadDict_s, IPSimilarDomain_s, Act_s, IPReplyMismatch_s, IPInternalName_s, SpamLimit_s, headerFrom_s, SpamInfo_s, SpamScore_s, SpamProcessingDetail_s, fileName_s, sha256_s, Size_s, SenderDomain_s, fileExt_s, sha1_s, fileMime_s, md5_g, RejType_s, Error_s, RejCode_s, RejInfo_s, aCode_g, Virus_s, UrlCategory_s, ScanResultInfo_s, URL_s, MimecastIP_s, SenderDomainInternal_s, CustomerIP_s, SourceIP, reason_s, subject_s, msgid_s, url_s, route_s, sender_s, recipient_s, action_s, urlCategory_s, credentialTheft_s, senderDomain_s, Type, _ResourceId\\n| summarize count() by Sender_s, Subject_s, MsgId_s, AttSize_s, AttCnt_s, bin(TimeGenerated, 1h)\\n\",\"size\":0,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"name\":\"query - 22\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Mail Delivery Events\",\"style\":\"info\"},\"name\":\"text - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"delivery\\\"\\n| summarize count() by mimecastEventId_s, bin(TimeGenerated, 1h)\",\"size\":3,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"mail_delivery_delivered\",\"label\":\"Delivered with TLS\",\"color\":\"green\"},{\"seriesName\":\"mail_delivery_delivered_notls\",\"label\":\"Delivered without TLS\",\"color\":\"orange\"},{\"seriesName\":\"mail_delivery_not_delivered\",\"label\":\"Undelivered\",\"color\":\"red\"}]}},\"name\":\"query - 5\"}]},\"customWidth\":\"33\",\"name\":\"group - 2\",\"styleSettings\":{\"maxWidth\":\"33%\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## TLS Versions in Use\",\"style\":\"info\"},\"name\":\"text - 32\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"delivery\\\" and UseTls_s==\\\"Yes\\\"\\n| summarize count() by TlsVer_s, bin(TimeGenerated, 1h)\\n\",\"size\":3,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"query - 33\"}]},\"customWidth\":\"33\",\"name\":\"group - 4\",\"styleSettings\":{\"maxWidth\":\"33%\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## TLS Cipher Suites in Use\",\"style\":\"info\"},\"name\":\"text - 34\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"delivery\\\" and UseTls_s==\\\"Yes\\\"\\n| summarize count() by Cphr_s, bin(TimeGenerated, 1h)\",\"size\":3,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":0}},\"name\":\"query - 35\"}]},\"customWidth\":\"33\",\"name\":\"group - 5\",\"styleSettings\":{\"maxWidth\":\"33%\"}}]},\"name\":\"group - 31\"},{\"type\":1,\"content\":{\"json\":\"## Undelivered Messages\",\"style\":\"info\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"delivery\\\" and mimecastEventId_s == \\\"mail_delivery_not_delivered\\\"\\n| summarize count() by Dir_s, Route_s, Sender_s, Rcpt_s, RejType_s, RejCode_s, RejInfo_s, bin(TimeGenerated, 1h)\\n\",\"size\":0,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"mail_delivery_not_delivered\",\"label\":\"Undelivered\"}]}},\"name\":\"query - 12\"},{\"type\":1,\"content\":{\"json\":\"## Messages Delivered without TLS\",\"style\":\"info\"},\"name\":\"text - 17\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastSIEM_CL\\n| where logType_s==\\\"delivery\\\" and mimecastEventId_s==\\\"mail_delivery_delivered_notls\\\"\\n| summarize count() by Dir_s, Route_s, IP_s, Sender_s, Rcpt_s, Subject_s, Delivered_s, ReceiptAck_s, bin(TimeGenerated, 1h)\\n\",\"size\":0,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 18\"},{\"type\":1,\"content\":{\"json\":\"# Data Leak Prevention Events\"},\"name\":\"text - 24\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastDLP_CL\\n| where mimecastEventCategory_s == \\\"data_leak_prevention\\\"\\n| summarize count() by mimecastEventId_s, bin(TimeGenerated, 1h)\\n\",\"size\":3,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"group\":\"mimecastEventId_s\",\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"data_leak_prevention_notification\",\"label\":\"Notification\"},{\"seriesName\":\"data_leak_prevention_hold\",\"label\":\"Hold\"},{\"seriesName\":\"data_leak_prevention_smart_folder\",\"label\":\"Smart Folder\"},{\"seriesName\":\"data_leak_prevention_secure_messaging\",\"label\":\"Secure Messaging\"},{\"seriesName\":\"data_leak_prevention_secure_delivery\",\"label\":\"Secure Delivery\"},{\"seriesName\":\"data_leak_prevention_bounce\",\"label\":\"Bounce\"},{\"seriesName\":\"data_leak_prevention_stationery\",\"label\":\"Stationary\"},{\"seriesName\":\"data_leak_prevention_delete\",\"label\":\"Delete\"},{\"seriesName\":\"data_leak_prevention_meta_expire\",\"label\":\"Meta Expire\"},{\"seriesName\":\"data_leak_prevention_content_expire\",\"label\":\"Content Expire\"}]}},\"name\":\"query - 23\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## DLP Events by Route\",\"style\":\"info\"},\"name\":\"text - 31\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastDLP_CL\\n| where mimecastEventCategory_s == \\\"data_leak_prevention\\\"\\n| summarize count() by route_s, bin(TimeGenerated, 1h)\\n\",\"size\":3,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":0}},\"name\":\"query - 30\"}]},\"customWidth\":\"33\",\"name\":\"group - 2\",\"styleSettings\":{\"maxWidth\":\"33%\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## DLP Events by Actions Triggered\",\"style\":\"info\"},\"name\":\"text - 28\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastDLP_CL\\n| where mimecastEventCategory_s == \\\"data_leak_prevention\\\"\\n| summarize count() by action_s, bin(TimeGenerated, 1h)\\n\",\"size\":3,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":0}},\"name\":\"query - 29\"}]},\"customWidth\":\"33\",\"name\":\"group - 1\",\"styleSettings\":{\"maxWidth\":\"33%\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## DLP Events by Policies Triggered\",\"style\":\"info\"},\"name\":\"text - 26\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastDLP_CL\\n| where mimecastEventCategory_s == \\\"data_leak_prevention\\\"\\n| summarize count() by policy_s, bin(TimeGenerated, 1h)\\n\",\"size\":3,\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":0}},\"name\":\"query - 27\"}]},\"customWidth\":\"33\",\"name\":\"group - 4\",\"styleSettings\":{\"maxWidth\":\"33%\"}}]},\"name\":\"group - 36\"}],\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", + "properties": { + "description": "@{workbookKey=MimecastSEGWorkbook; logoFileName=Mimecast.svg; description=A workbook providing insights into Mimecast Secure Email Gateway.; dataTypesDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=MimecastSEG; templateRelativePath=MimecastSEGworkbook.json; subtitle=Mimecast Secure Email Gateway; provider=Mimecast}.description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "MimecastDLP_CL", + "kind": "DataType" + }, + { + "contentId": "MimecastSIEM_CL", + "kind": "DataType" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MimecastSEG data connector with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId1')]", + "title": "Mimecast Secure Email Gateway (using Azure Functions)", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Secure Email Gateway](https://community.mimecast.com/s/article/Azure-Sentinel) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Secure Email Gateway \n- Mimecast Data Leak Prevention\n ", + "graphQueries": [ + { + "metricName": "Total Secure Email Gateway data received", + "legend": "MimecastSIEM_CL", + "baseQuery": "MimecastSIEM_CL" + }, + { + "metricName": "Total Data Leak Prevention data received", + "legend": "MimecastDLP_CL", + "baseQuery": "MimecastDLP_CL" + } + ], + "sampleQueries": [ + { + "description": "MimecastSIEM_CL", + "query": "MimecastSIEM_CL\n| sort by TimeGenerated desc" + }, + { + "description": "MimecastDLP_CL", + "query": "MimecastDLP_CL\n| sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "MimecastSIEM_CL", + "lastDataReceivedQuery": "MimecastSIEM_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "MimecastDLP_CL", + "lastDataReceivedQuery": "MimecastDLP_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "MimecastSIEM_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "MimecastDLP_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "Mimecast API credentials", + "description": "You need to have the following pieces of information to configure the integration:\n- mimecastEmail: Email address of a dedicated Mimecast admin user\n- mimecastPassword: Password for the dedicated Mimecast admin user\n- mimecastAppId: API Application Id of the Mimecast Microsoft Sentinel app registered with Mimecast\n- mimecastAppKey: API Application Key of the Mimecast Microsoft Sentinel app registered with Mimecast\n- mimecastAccessKey: Access Key for the dedicated Mimecast admin user\n- mimecastSecretKey: Secret Key for the dedicated Mimecast admin user\n- mimecastBaseURL: Mimecast Regional API Base URL\n\n> The Mimecast Application Id, Application Key, along with the Access Key and Secret keys for the dedicated Mimecast admin user are obtainable via the Mimecast Administration Console: Administration | Services | API and Platform Integrations.\n\n> The Mimecast API Base URL for each region is documented here: https://integrations.mimecast.com/documentation/api-overview/global-base-urls/" + }, + { + "name": "Resource group", + "description": "You need to have a resource group created with a subscription you are going to use." + }, + { + "name": "Functions app", + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", + "title": "Configuration:" + }, + { + "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Mimecast API authorization key(s) or Token, readily available.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Workspace ID" + }, + "type": "CopyableLabel" + }, + { + "parameters": { + "fillWith": [ + "PrimaryKey" + ], + "label": "Primary Key" + }, + "type": "CopyableLabel" + } + ] + }, + { + "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastSEG-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> SIEM checkpoints ---> Upload*** and create empty file on your machine named checkpoint.txt, dlp-checkpoint.txt and select it for upload (this is done so that date_range for SIEM logs is stored in consistent state)\n", + "title": "Deploy the Mimecast Secure Email Gateway Data Connector:" + } + ], + "metadata": { + "id": "d394478b-62f5-49c9-9ce7-96ed999cc727", + "version": "1.0.0", + "kind": "dataConnector", + "source": { + "kind": "solution", + "name": "Mimecast" + }, + "author": { + "name": "Mimecast" + }, + "support": { + "tier": "Partner", + "name": "Mimecast", + "email": "support@mimecast.com", + "link": "https://community.mimecast.com/s/contactsupport" + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "Mimecast Secure Email Gateway (using Azure Functions)", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId1')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "Mimecast Secure Email Gateway (using Azure Functions)", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Secure Email Gateway](https://community.mimecast.com/s/article/Azure-Sentinel) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Secure Email Gateway \n- Mimecast Data Leak Prevention\n ", + "graphQueries": [ + { + "metricName": "Total Secure Email Gateway data received", + "legend": "MimecastSIEM_CL", + "baseQuery": "MimecastSIEM_CL" + }, + { + "metricName": "Total Data Leak Prevention data received", + "legend": "MimecastDLP_CL", + "baseQuery": "MimecastDLP_CL" + } + ], + "dataTypes": [ + { + "name": "MimecastSIEM_CL", + "lastDataReceivedQuery": "MimecastSIEM_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "MimecastDLP_CL", + "lastDataReceivedQuery": "MimecastDLP_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "MimecastSIEM_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "MimecastDLP_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "MimecastSIEM_CL", + "query": "MimecastSIEM_CL\n| sort by TimeGenerated desc" + }, + { + "description": "MimecastDLP_CL", + "query": "MimecastDLP_CL\n| sort by TimeGenerated desc" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "Mimecast API credentials", + "description": "You need to have the following pieces of information to configure the integration:\n- mimecastEmail: Email address of a dedicated Mimecast admin user\n- mimecastPassword: Password for the dedicated Mimecast admin user\n- mimecastAppId: API Application Id of the Mimecast Microsoft Sentinel app registered with Mimecast\n- mimecastAppKey: API Application Key of the Mimecast Microsoft Sentinel app registered with Mimecast\n- mimecastAccessKey: Access Key for the dedicated Mimecast admin user\n- mimecastSecretKey: Secret Key for the dedicated Mimecast admin user\n- mimecastBaseURL: Mimecast Regional API Base URL\n\n> The Mimecast Application Id, Application Key, along with the Access Key and Secret keys for the dedicated Mimecast admin user are obtainable via the Mimecast Administration Console: Administration | Services | API and Platform Integrations.\n\n> The Mimecast API Base URL for each region is documented here: https://integrations.mimecast.com/documentation/api-overview/global-base-urls/" + }, + { + "name": "Resource group", + "description": "You need to have a resource group created with a subscription you are going to use." + }, + { + "name": "Functions app", + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", + "title": "Configuration:" + }, + { + "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Mimecast API authorization key(s) or Token, readily available.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Workspace ID" + }, + "type": "CopyableLabel" + }, + { + "parameters": { + "fillWith": [ + "PrimaryKey" + ], + "label": "Primary Key" + }, + "type": "CopyableLabel" + } + ] + }, + { + "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastSEG-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> SIEM checkpoints ---> Upload*** and create empty file on your machine named checkpoint.txt, dlp-checkpoint.txt and select it for upload (this is done so that date_range for SIEM logs is stored in consistent state)\n", + "title": "Deploy the Mimecast Secure Email Gateway Data Connector:" + } + ], + "id": "[variables('_uiConfigId1')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", + "location": "[parameters('workspace-location')]", + "properties": { + "version": "3.0.0", + "kind": "Solution", + "contentSchemaVersion": "3.0.0", + "displayName": "MimecastSEG", + "publisherDisplayName": "Mimecast", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The data connector for Mimecast Secure Email Gateway allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required:

\n
    \n
  • Mimecast Secure Email Gateway
    • \n
  • Mimecast Data Leak Prevention
    • \n
\n

Microsoft Sentinel Solutions provide a consolidated way to acquire Microsoft Sentinel content like data connectors, workbooks, analytics, and automations in your workspace with a single deployment step.

\n

Data Connectors: 1, Workbooks: 1, Analytic Rules: 9

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", + "contentId": "[variables('_solutionId')]", + "parentId": "[variables('_solutionId')]", + "source": { + "kind": "Solution", + "name": "MimecastSEG", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId1')]", + "version": "[variables('analyticRuleVersion1')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId2')]", + "version": "[variables('analyticRuleVersion2')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId3')]", + "version": "[variables('analyticRuleVersion3')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId4')]", + "version": "[variables('analyticRuleVersion4')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId5')]", + "version": "[variables('analyticRuleVersion5')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId6')]", + "version": "[variables('analyticRuleVersion6')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId7')]", + "version": "[variables('analyticRuleVersion7')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId8')]", + "version": "[variables('analyticRuleVersion8')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId9')]", + "version": "[variables('analyticRuleVersion9')]" + }, + { + "kind": "Workbook", + "contentId": "[variables('_workbookContentId1')]", + "version": "[variables('workbookVersion1')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId1')]", + "version": "[variables('dataConnectorVersion1')]" + } + ] + }, + "firstPublishDate": "2022-02-24", + "lastPublishDate": "2022-02-24", + "providers": [ + "Mimecast" + ], + "categories": { + "domains": [ + "Security - Network" + ] + } + }, + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + } + ], + "outputs": {} +} diff --git a/Solutions/MimecastSEG/ReleaseNotes.md b/Solutions/MimecastSEG/ReleaseNotes.md new file mode 100644 index 00000000000..a97fa385729 --- /dev/null +++ b/Solutions/MimecastSEG/ReleaseNotes.md @@ -0,0 +1,3 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|---------------------------------------------| +| 3.0.0 | 23-08-2023 | Initial solution release | diff --git a/Solutions/MimecastSEG/SolutionMetadata.json b/Solutions/MimecastSEG/SolutionMetadata.json new file mode 100644 index 00000000000..9810b8dc14c --- /dev/null +++ b/Solutions/MimecastSEG/SolutionMetadata.json @@ -0,0 +1,20 @@ +{ + "publisherId": "mimecast", + "offerId": "azure-sentinel-solution-mimecastseg", + "firstPublishDate": "2022-02-24", + "lastPublishDate": "2022-02-24", + "providers": [ + "Mimecast" + ], + "categories": { + "domains": [ + "Security - Network" + ] + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://community.mimecast.com/s/contactsupport" + } +} \ No newline at end of file diff --git a/Solutions/MimecastSEG/Workbooks/Images/Preview/MimecastSEGBlack.png b/Solutions/MimecastSEG/Workbooks/Images/Preview/MimecastSEGBlack.png new file mode 100644 index 00000000000..8ae01ce763b Binary files /dev/null and b/Solutions/MimecastSEG/Workbooks/Images/Preview/MimecastSEGBlack.png differ diff --git a/Solutions/MimecastSEG/Workbooks/Images/Preview/MimecastSEGWhite.png b/Solutions/MimecastSEG/Workbooks/Images/Preview/MimecastSEGWhite.png new file mode 100644 index 00000000000..bd6aa01ccae Binary files /dev/null and b/Solutions/MimecastSEG/Workbooks/Images/Preview/MimecastSEGWhite.png differ diff --git a/Solutions/MimecastSEG/Workbooks/MimecastSEGworkbook.json b/Solutions/MimecastSEG/Workbooks/MimecastSEGworkbook.json new file mode 100644 index 00000000000..c35d9391285 --- /dev/null +++ b/Solutions/MimecastSEG/Workbooks/MimecastSEGworkbook.json @@ -0,0 +1,858 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "8ccaabbc-2531-4a3a-a4d1-22890e77fe7e", + "version": "KqlParameterItem/1.0", + "name": "time_range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 1209600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "timeContext": { + "durationMs": 86400000 + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 6" + }, + { + "type": 1, + "content": { + "json": "# Mail Receipt Events" + }, + "name": "text - 2" + }, + { + "type": 1, + "content": { + "json": "## Receipt Events by Mimecast Event Id", + "style": "info" + }, + "name": "text - 25" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"receipt\"\n| summarize count() by mimecastEventId_s, bin(TimeGenerated, 1h)", + "size": 3, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "barchart", + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "mail_receipt_received", + "label": "Received" + }, + { + "seriesName": "mail_receipt_virus", + "label": "Viruses" + }, + { + "seriesName": "mail_receipt_received_notls", + "label": "Non-TLS" + }, + { + "seriesName": "mail_receipt_rejected", + "label": "Rejected" + }, + { + "seriesName": "mail_receipt_spam", + "label": "Spam" + } + ] + } + }, + "name": "query - 1" + }, + { + "type": 1, + "content": { + "json": "## Rejection Types", + "style": "info" + }, + "name": "text - 7" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"receipt\" and mimecastEventId_s == \"mail_receipt_rejected\" and RejType_s !=\"\"\n| summarize count() by RejType_s , bin(TimeGenerated, 1h)", + "size": 3, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "titleContent": { + "columnMatch": "RejType_s", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "showBorder": true, + "size": "auto" + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "RejType_s", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "count_", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "nodeIdField": "RejType_s", + "sourceIdField": "TimeGenerated", + "targetIdField": "count_", + "graphOrientation": 1, + "showOrientationToggles": false, + "nodeSize": null, + "staticNodeSize": 100, + "colorSettings": null, + "hivesMargin": 5 + }, + "chartSettings": { + "createOtherGroup": 0 + }, + "mapSettings": { + "locInfo": "LatLong", + "sizeSettings": "count_", + "sizeAggregation": "Sum", + "legendMetric": "count_", + "legendAggregation": "Sum", + "itemColorSettings": { + "type": "heatmap", + "colorAggregation": "Sum", + "nodeColorField": "count_", + "heatmapPalette": "greenRed" + } + } + }, + "name": "query - 14" + }, + { + "type": 1, + "content": { + "json": "## Rejections - Spam", + "style": "info" + }, + "name": "text - 13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"receipt\" and mimecastEventId_s==\"mail_receipt_spam\"\n| summarize count() by Sender_s, headerFrom_s, Rcpt_s, IP_s, Subject_s, SpamScore_s, bin(TimeGenerated, 1h)\n", + "size": 0, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "sortBy": [ + { + "itemKey": "SpamScore_s", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "SpamScore_s", + "sortOrder": 1 + } + ], + "chartSettings": { + "createOtherGroup": 0, + "seriesLabelSettings": [ + { + "seriesName": "mail_receipt_spam", + "label": "Spam" + } + ] + } + }, + "name": "query - 14" + }, + { + "type": 1, + "content": { + "json": "## Rejections - Malware", + "style": "info" + }, + "name": "text - 15" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"receipt\" and mimecastEventId_s == \"mail_receipt_virus\" and RejType_s != \"\"\n| summarize count() by Sender_s, headerFrom_s, Rcpt_s, IP_s, Subject_s, RejInfo_s, Virus_s, Error_s, bin(TimeGenerated, 1h)", + "size": 0, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "Sender_s", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "count_", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "mapSettings": { + "locInfo": "AzureResource", + "locInfoColumn": "Error_s", + "sizeAggregation": "Count", + "legendMetric": "count_", + "legendAggregation": "Sum", + "itemColorSettings": { + "nodeColorField": "count_", + "colorAggregation": "Sum", + "type": "thresholds", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "blue" + } + ] + } + } + }, + "name": "query - 16" + }, + { + "type": 1, + "content": { + "json": "# Mail Process Events", + "style": "info" + }, + "name": "text - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"process\"\n| summarize dcount=count() by TenantId, SourceSystem, MG, ManagementGroupName, TimeGenerated, Computer, RawData, Err_s, datetime_t, aCode_s, acc_s, Sender_s, Rcpt_s, RcptActType_s, Dir_s, RcptHdrType_s, logType_s, mimecastEventId_s, mimecastEventCategory_s, CustomThreatDictionary_s, Action_s, Hits_s, SimilarCustomExternalDomain_s, TaggedExternal_s, SimilarInternalDomain_s, IP_s, Definition_s, Recipient_s, NewDomain_s, InternalName_s, ThreatDictionary_s, MsgId_s, Subject_s, SimilarMimecastExternalDomain_s, CustomName_s, TaggedMalicious_s, ReplyMismatch_s, Route_s, Delivered_s, AttCnt_s, ReceiptAck_s, Latency_s, AttSize_s, Attempt_s, TlsVer_s, Cphr_s, Snt_s, UseTls_s, Hld_s, IPNewDomain_s, AttNames_s, MsgSize_s, IPThreadDict_s, IPSimilarDomain_s, Act_s, IPReplyMismatch_s, IPInternalName_s, SpamLimit_s, headerFrom_s, SpamInfo_s, SpamScore_s, SpamProcessingDetail_s, fileName_s, sha256_s, Size_s, SenderDomain_s, fileExt_s, sha1_s, fileMime_s, md5_g, RejType_s, Error_s, RejCode_s, RejInfo_s, aCode_g, Virus_s, UrlCategory_s, ScanResultInfo_s, URL_s, MimecastIP_s, SenderDomainInternal_s, CustomerIP_s, SourceIP, reason_s, subject_s, msgid_s, url_s, route_s, sender_s, recipient_s, action_s, urlCategory_s, credentialTheft_s, senderDomain_s, Type, _ResourceId\n| summarize count() by mimecastEventId_s, bin(TimeGenerated, 1h)", + "size": 3, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "mail_process_accepted", + "label": "Accepted", + "color": "green" + }, + { + "seriesName": "mail_process_held", + "label": "Held", + "color": "brown" + }, + { + "seriesName": "mail_process_sandboxed", + "label": "Sandboxed", + "color": "turquoise" + }, + { + "seriesName": "mail_process_retried", + "label": "Retries", + "color": "pink" + } + ] + } + }, + "name": "query - 3" + }, + { + "type": 1, + "content": { + "json": "## Held Messages", + "style": "info" + }, + "name": "text - 18" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"process\" and Hld_s != \"\"\n| summarize count() by TenantId, SourceSystem, MG, ManagementGroupName, TimeGenerated, Computer, RawData, Err_s, datetime_t, aCode_s, acc_s, Sender_s, Rcpt_s, RcptActType_s, Dir_s, RcptHdrType_s, logType_s, mimecastEventId_s, mimecastEventCategory_s, CustomThreatDictionary_s, Action_s, Hits_s, SimilarCustomExternalDomain_s, TaggedExternal_s, SimilarInternalDomain_s, IP_s, Definition_s, Recipient_s, NewDomain_s, InternalName_s, ThreatDictionary_s, MsgId_s, Subject_s, SimilarMimecastExternalDomain_s, CustomName_s, TaggedMalicious_s, ReplyMismatch_s, Route_s, Delivered_s, AttCnt_s, ReceiptAck_s, Latency_s, AttSize_s, Attempt_s, TlsVer_s, Cphr_s, Snt_s, UseTls_s, Hld_s, IPNewDomain_s, AttNames_s, MsgSize_s, IPThreadDict_s, IPSimilarDomain_s, Act_s, IPReplyMismatch_s, IPInternalName_s, SpamLimit_s, headerFrom_s, SpamInfo_s, SpamScore_s, SpamProcessingDetail_s, fileName_s, sha256_s, Size_s, SenderDomain_s, fileExt_s, sha1_s, fileMime_s, md5_g, RejType_s, Error_s, RejCode_s, RejInfo_s, aCode_g, Virus_s, UrlCategory_s, ScanResultInfo_s, URL_s, MimecastIP_s, SenderDomainInternal_s, CustomerIP_s, SourceIP, reason_s, subject_s, msgid_s, url_s, route_s, sender_s, recipient_s, action_s, urlCategory_s, credentialTheft_s, senderDomain_s, Type, _ResourceId\n| summarize count() by Hld_s, Sender_s, Subject_s, AttSize_s, AttCnt_s, AttNames_s, MsgSize_s, bin(TimeGenerated, 1h)\n", + "size": 0, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "query - 17" + }, + { + "type": 1, + "content": { + "json": "## Message Delivery Retried\n", + "style": "info" + }, + "name": "text - 19" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"process\" and mimecastEventId_s==\"mail_process_retried\"\n| summarize count() by TenantId, SourceSystem, MG, ManagementGroupName, TimeGenerated, Computer, RawData, Err_s, datetime_t, aCode_s, acc_s, Sender_s, Rcpt_s, RcptActType_s, Dir_s, RcptHdrType_s, logType_s, mimecastEventId_s, mimecastEventCategory_s, CustomThreatDictionary_s, Action_s, Hits_s, SimilarCustomExternalDomain_s, TaggedExternal_s, SimilarInternalDomain_s, IP_s, Definition_s, Recipient_s, NewDomain_s, InternalName_s, ThreatDictionary_s, MsgId_s, Subject_s, SimilarMimecastExternalDomain_s, CustomName_s, TaggedMalicious_s, ReplyMismatch_s, Route_s, Delivered_s, AttCnt_s, ReceiptAck_s, Latency_s, AttSize_s, Attempt_s, TlsVer_s, Cphr_s, Snt_s, UseTls_s, Hld_s, IPNewDomain_s, AttNames_s, MsgSize_s, IPThreadDict_s, IPSimilarDomain_s, Act_s, IPReplyMismatch_s, IPInternalName_s, SpamLimit_s, headerFrom_s, SpamInfo_s, SpamScore_s, SpamProcessingDetail_s, fileName_s, sha256_s, Size_s, SenderDomain_s, fileExt_s, sha1_s, fileMime_s, md5_g, RejType_s, Error_s, RejCode_s, RejInfo_s, aCode_g, Virus_s, UrlCategory_s, ScanResultInfo_s, URL_s, MimecastIP_s, SenderDomainInternal_s, CustomerIP_s, SourceIP, reason_s, subject_s, msgid_s, url_s, route_s, sender_s, recipient_s, action_s, urlCategory_s, credentialTheft_s, senderDomain_s, Type, _ResourceId\n| summarize count() by Sender_s, Subject_s, MsgId_s, AttCnt_s, AttNames_s, AttSize_s, MsgSize_s, bin(TimeGenerated, 1h)\n", + "size": 0, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "sortBy": [] + }, + "name": "query - 20" + }, + { + "type": 1, + "content": { + "json": "## Messages with Sandboxed Attachments", + "style": "info" + }, + "name": "text - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"process\" and mimecastEventId_s==\"mail_process_sandboxed\"\n| summarize count() by TenantId, SourceSystem, MG, ManagementGroupName, TimeGenerated, Computer, RawData, Err_s, datetime_t, aCode_s, acc_s, Sender_s, Rcpt_s, RcptActType_s, Dir_s, RcptHdrType_s, logType_s, mimecastEventId_s, mimecastEventCategory_s, CustomThreatDictionary_s, Action_s, Hits_s, SimilarCustomExternalDomain_s, TaggedExternal_s, SimilarInternalDomain_s, IP_s, Definition_s, Recipient_s, NewDomain_s, InternalName_s, ThreatDictionary_s, MsgId_s, Subject_s, SimilarMimecastExternalDomain_s, CustomName_s, TaggedMalicious_s, ReplyMismatch_s, Route_s, Delivered_s, AttCnt_s, ReceiptAck_s, Latency_s, AttSize_s, Attempt_s, TlsVer_s, Cphr_s, Snt_s, UseTls_s, Hld_s, IPNewDomain_s, AttNames_s, MsgSize_s, IPThreadDict_s, IPSimilarDomain_s, Act_s, IPReplyMismatch_s, IPInternalName_s, SpamLimit_s, headerFrom_s, SpamInfo_s, SpamScore_s, SpamProcessingDetail_s, fileName_s, sha256_s, Size_s, SenderDomain_s, fileExt_s, sha1_s, fileMime_s, md5_g, RejType_s, Error_s, RejCode_s, RejInfo_s, aCode_g, Virus_s, UrlCategory_s, ScanResultInfo_s, URL_s, MimecastIP_s, SenderDomainInternal_s, CustomerIP_s, SourceIP, reason_s, subject_s, msgid_s, url_s, route_s, sender_s, recipient_s, action_s, urlCategory_s, credentialTheft_s, senderDomain_s, Type, _ResourceId\n| summarize count() by Sender_s, Subject_s, MsgId_s, AttSize_s, AttCnt_s, bin(TimeGenerated, 1h)\n", + "size": 0, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "sortBy": [] + }, + "name": "query - 22" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Mail Delivery Events", + "style": "info" + }, + "name": "text - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"delivery\"\n| summarize count() by mimecastEventId_s, bin(TimeGenerated, 1h)", + "size": 3, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "mail_delivery_delivered", + "label": "Delivered with TLS", + "color": "green" + }, + { + "seriesName": "mail_delivery_delivered_notls", + "label": "Delivered without TLS", + "color": "orange" + }, + { + "seriesName": "mail_delivery_not_delivered", + "label": "Undelivered", + "color": "red" + } + ] + } + }, + "name": "query - 5" + } + ] + }, + "customWidth": "33", + "name": "group - 2", + "styleSettings": { + "maxWidth": "33%" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## TLS Versions in Use", + "style": "info" + }, + "name": "text - 32" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"delivery\" and UseTls_s==\"Yes\"\n| summarize count() by TlsVer_s, bin(TimeGenerated, 1h)\n", + "size": 3, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart" + }, + "name": "query - 33" + } + ] + }, + "customWidth": "33", + "name": "group - 4", + "styleSettings": { + "maxWidth": "33%" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## TLS Cipher Suites in Use", + "style": "info" + }, + "name": "text - 34" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"delivery\" and UseTls_s==\"Yes\"\n| summarize count() by Cphr_s, bin(TimeGenerated, 1h)", + "size": 3, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "chartSettings": { + "createOtherGroup": 0 + } + }, + "name": "query - 35" + } + ] + }, + "customWidth": "33", + "name": "group - 5", + "styleSettings": { + "maxWidth": "33%" + } + } + ] + }, + "name": "group - 31" + }, + { + "type": 1, + "content": { + "json": "## Undelivered Messages", + "style": "info" + }, + "name": "text - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"delivery\" and mimecastEventId_s == \"mail_delivery_not_delivered\"\n| summarize count() by Dir_s, Route_s, Sender_s, Rcpt_s, RejType_s, RejCode_s, RejInfo_s, bin(TimeGenerated, 1h)\n", + "size": 0, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "mail_delivery_not_delivered", + "label": "Undelivered" + } + ] + } + }, + "name": "query - 12" + }, + { + "type": 1, + "content": { + "json": "## Messages Delivered without TLS", + "style": "info" + }, + "name": "text - 17" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastSIEM_CL\n| where logType_s==\"delivery\" and mimecastEventId_s==\"mail_delivery_delivered_notls\"\n| summarize count() by Dir_s, Route_s, IP_s, Sender_s, Rcpt_s, Subject_s, Delivered_s, ReceiptAck_s, bin(TimeGenerated, 1h)\n", + "size": 0, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "query - 18" + }, + { + "type": 1, + "content": { + "json": "# Data Leak Prevention Events" + }, + "name": "text - 24" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastDLP_CL\n| where mimecastEventCategory_s == \"data_leak_prevention\"\n| summarize count() by mimecastEventId_s, bin(TimeGenerated, 1h)\n", + "size": 3, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "barchart", + "chartSettings": { + "group": "mimecastEventId_s", + "createOtherGroup": 0, + "seriesLabelSettings": [ + { + "seriesName": "data_leak_prevention_notification", + "label": "Notification" + }, + { + "seriesName": "data_leak_prevention_hold", + "label": "Hold" + }, + { + "seriesName": "data_leak_prevention_smart_folder", + "label": "Smart Folder" + }, + { + "seriesName": "data_leak_prevention_secure_messaging", + "label": "Secure Messaging" + }, + { + "seriesName": "data_leak_prevention_secure_delivery", + "label": "Secure Delivery" + }, + { + "seriesName": "data_leak_prevention_bounce", + "label": "Bounce" + }, + { + "seriesName": "data_leak_prevention_stationery", + "label": "Stationary" + }, + { + "seriesName": "data_leak_prevention_delete", + "label": "Delete" + }, + { + "seriesName": "data_leak_prevention_meta_expire", + "label": "Meta Expire" + }, + { + "seriesName": "data_leak_prevention_content_expire", + "label": "Content Expire" + } + ] + } + }, + "name": "query - 23" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## DLP Events by Route", + "style": "info" + }, + "name": "text - 31" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastDLP_CL\n| where mimecastEventCategory_s == \"data_leak_prevention\"\n| summarize count() by route_s, bin(TimeGenerated, 1h)\n", + "size": 3, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "sortBy": [], + "chartSettings": { + "createOtherGroup": 0 + } + }, + "name": "query - 30" + } + ] + }, + "customWidth": "33", + "name": "group - 2", + "styleSettings": { + "maxWidth": "33%" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## DLP Events by Actions Triggered", + "style": "info" + }, + "name": "text - 28" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastDLP_CL\n| where mimecastEventCategory_s == \"data_leak_prevention\"\n| summarize count() by action_s, bin(TimeGenerated, 1h)\n", + "size": 3, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "chartSettings": { + "createOtherGroup": 0 + } + }, + "name": "query - 29" + } + ] + }, + "customWidth": "33", + "name": "group - 1", + "styleSettings": { + "maxWidth": "33%" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## DLP Events by Policies Triggered", + "style": "info" + }, + "name": "text - 26" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastDLP_CL\n| where mimecastEventCategory_s == \"data_leak_prevention\"\n| summarize count() by policy_s, bin(TimeGenerated, 1h)\n", + "size": 3, + "timeContext": { + "durationMs": 1209600000 + }, + "timeContextFromParameter": "time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "chartSettings": { + "createOtherGroup": 0 + } + }, + "name": "query - 27" + } + ] + }, + "customWidth": "33", + "name": "group - 4", + "styleSettings": { + "maxWidth": "33%" + } + } + ] + }, + "name": "group - 36" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Solutions/MimecastTTP/Data Connectors/MimecastTTP_API_FunctionApp.json b/Solutions/MimecastTTP/Data Connectors/MimecastTTP_API_FunctionApp.json index fb8758c95cb..b408483a971 100644 --- a/Solutions/MimecastTTP/Data Connectors/MimecastTTP_API_FunctionApp.json +++ b/Solutions/MimecastTTP/Data Connectors/MimecastTTP_API_FunctionApp.json @@ -143,7 +143,7 @@ }, { "title": "Deploy the Mimecast Targeted Threat Protection Data Connector:", - "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-mimecastttp-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> TTP checkpoints ---> Upload*** and create empty files on your machine named attachment-checkpoint.txt, impersonation-checkpoint.txt, url-checkpoint.txt and select them for upload (this is done so that date_range for TTP logs are stored in consistent state)\n" + "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastTTP-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> TTP checkpoints ---> Upload*** and create empty files on your machine named attachment-checkpoint.txt, impersonation-checkpoint.txt, url-checkpoint.txt and select them for upload (this is done so that date_range for TTP logs are stored in consistent state)\n" } ], "metadata": { diff --git a/Solutions/MimecastTTP/Data Connectors/azuredeploy_MimecastTTP_AzureFunctionApp.json b/Solutions/MimecastTTP/Data Connectors/azuredeploy_MimecastTTP_AzureFunctionApp.json index 9c351d85c08..9c31dfe37c6 100644 --- a/Solutions/MimecastTTP/Data Connectors/azuredeploy_MimecastTTP_AzureFunctionApp.json +++ b/Solutions/MimecastTTP/Data Connectors/azuredeploy_MimecastTTP_AzureFunctionApp.json @@ -205,7 +205,7 @@ "active_directory_tenant_id": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'active-directory-tenant-id', '/)')]", "log_analytics_workspace_id": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'log-analytics-workspace-id', '/)')]", "log_analytics_workspace_key": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'log-analytics-workspace-key', '/)')]", - "WEBSITE_RUN_FROM_PACKAGE": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MimecastTTP/Data%20Connectors/MimecastTTPAzureConn.zip" + "WEBSITE_RUN_FROM_PACKAGE": "https://aka.ms/sentinel-MimecastTTP-functionapp" } }] }, diff --git a/Solutions/MimecastTTP/Package/3.0.0.zip b/Solutions/MimecastTTP/Package/3.0.0.zip index 465c1bdb038..ee14592f60b 100644 Binary files a/Solutions/MimecastTTP/Package/3.0.0.zip and b/Solutions/MimecastTTP/Package/3.0.0.zip differ diff --git a/Solutions/MimecastTTP/Package/mainTemplate.json b/Solutions/MimecastTTP/Package/mainTemplate.json index 304012f93f3..18f641b1857 100644 --- a/Solutions/MimecastTTP/Package/mainTemplate.json +++ b/Solutions/MimecastTTP/Package/mainTemplate.json @@ -743,7 +743,7 @@ ] }, { - "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-mimecastttp-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> TTP checkpoints ---> Upload*** and create empty files on your machine named attachment-checkpoint.txt, impersonation-checkpoint.txt, url-checkpoint.txt and select them for upload (this is done so that date_range for TTP logs are stored in consistent state)\n", + "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastTTP-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> TTP checkpoints ---> Upload*** and create empty files on your machine named attachment-checkpoint.txt, impersonation-checkpoint.txt, url-checkpoint.txt and select them for upload (this is done so that date_range for TTP logs are stored in consistent state)\n", "title": "Deploy the Mimecast Targeted Threat Protection Data Connector:" } ], @@ -986,7 +986,7 @@ ] }, { - "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-mimecastttp-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> TTP checkpoints ---> Upload*** and create empty files on your machine named attachment-checkpoint.txt, impersonation-checkpoint.txt, url-checkpoint.txt and select them for upload (this is done so that date_range for TTP logs are stored in consistent state)\n", + "description": "\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastTTP-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following fields:\n - appName: Unique string that will be used as id for the app in Azure platform\n - objectId: Azure portal ---> Azure Active Directory ---> more info ---> Profile -----> Object ID\n - appInsightsLocation(default): westeurope\n - mimecastEmail: Email address of dedicated user for this integraion\n - mimecastPassword: Password for dedicated user\n - mimecastAppId: Application Id from the Microsoft Sentinel app registered with Mimecast\n - mimecastAppKey: Application Key from the Microsoft Sentinel app registered with Mimecast\n - mimecastAccessKey: Access Key for the dedicated Mimecast user\n - mimecastSecretKey: Secret Key for dedicated Mimecast user\n - mimecastBaseURL: Regional Mimecast API Base URL\n - activeDirectoryAppId: Azure portal ---> App registrations ---> [your_app] ---> Application ID\n - activeDirectoryAppSecret: Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> [your_app_secret]\n\n >Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n\n6. Go to ***Azure portal ---> Resource groups ---> [your_resource_group] ---> [appName](type: Storage account) ---> Storage Explorer ---> BLOB CONTAINERS ---> TTP checkpoints ---> Upload*** and create empty files on your machine named attachment-checkpoint.txt, impersonation-checkpoint.txt, url-checkpoint.txt and select them for upload (this is done so that date_range for TTP logs are stored in consistent state)\n", "title": "Deploy the Mimecast Targeted Threat Protection Data Connector:" } ], diff --git a/Solutions/NXLogDnsLogs/Data Connectors/NXLogDnsLogs.json b/Solutions/NXLogDnsLogs/Data Connectors/NXLogDnsLogs.json index e2d9b2f84e7..e53993ba988 100644 --- a/Solutions/NXLogDnsLogs/Data Connectors/NXLogDnsLogs.json +++ b/Solutions/NXLogDnsLogs/Data Connectors/NXLogDnsLogs.json @@ -1,8 +1,8 @@ { - "id": "NXLogDnsLogs", + "id": "NXLogDNSLogs", "title": "NXLog DNS Logs", "publisher": "NXLog", - "descriptionMarkdown": "The NXLog DNS Logs data connector uses Event Tracing for Windows ([ETW](https://docs.microsoft.com/windows/apps/trace-processing/overview)) for collecting both Audit and Analytical DNS Server events. The [NXLog *im_etw* module](https://nxlog.co/documentation/nxlog-user-guide/im_etw.html) reads event tracing data directly for maximum efficiency, without the need to capture the event trace into an .etl file. This REST API connector can forward DNS Server events to Microsoft Sentinel in real time.", + "descriptionMarkdown": "The NXLog DNS Logs data connector uses Event Tracing for Windows ([ETW](https://docs.microsoft.com/windows/apps/trace-processing/overview)) for collecting both Audit and Analytical DNS Server events. The [NXLog *im_etw* module](https://docs.nxlog.co/refman/current/im/etw.html) reads event tracing data directly for maximum efficiency, without the need to capture the event trace into an .etl file. This REST API connector can forward DNS Server events to Microsoft Sentinel in real time.", "additionalRequirementBanner": "This data connector depends on parsers based on Kusto functions deployed with the Microsoft Sentinel Solution to work as expected. The [**ASimDnsMicrosoftNXLog **](https://aka.ms/sentinel-nxlogdnslogs-parser) is designed to leverage Microsoft Sentinel's built-in DNS-related analytics capabilities.", "graphQueries": [ { @@ -76,7 +76,7 @@ }, { "title": "", - "description": "Follow the step-by-step instructions in the *NXLog User Guide* Integration Topic [Microsoft Sentinel](https://nxlog.co/documentation/nxlog-user-guide/sentinel.html) to configure this connector.", + "description": "Follow the step-by-step instructions in the *NXLog User Guide* Integration Topic [Microsoft Sentinel](https://docs.nxlog.co/userguide/integrate/microsoft-azure-sentinel.html) to configure this connector.", "instructions": [ { "parameters": { diff --git a/Solutions/NXLogDnsLogs/Data/Solution_NXLogDnsLogs.json b/Solutions/NXLogDnsLogs/Data/Solution_NXLogDnsLogs.json index ae7a7201dfc..985bfd00243 100644 --- a/Solutions/NXLogDnsLogs/Data/Solution_NXLogDnsLogs.json +++ b/Solutions/NXLogDnsLogs/Data/Solution_NXLogDnsLogs.json @@ -1,17 +1,17 @@ { - "Name": "NXLogDnsLogs", + "Name": "NXLogDNSLogs", "Author": "NXLog", "Logo": "", - "Description": "The [NXLog DnsLogs](https://docs.nxlog.co/refman/v5.5/im/etw.html) solution for Microsoft Sentinel enables you to ingest DNS server events. NXLog DnsLogs uses Event Tracing for Windows [(ETW)](https://docs.microsoft.com/windows/apps/trace-processing/overview?WT.mc_id=Portal-fx) for collecting both Audit and Analytical DNS server events.[The NXLog im_etw module](https://docs.nxlog.co/refman/v5.5/im/etw.html)reads event tracing data directly for maximum efficiency, without the need to capture the event trace into an .etl file. \n \n **Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)", + "Description": "The [NXLog DNSLogs](https://docs.nxlog.co/refman/current/im/etw.html) solution for Microsoft Sentinel enables you to ingest DNS server events. NXLog DNSLogs uses Event Tracing for Windows [(ETW)](https://docs.microsoft.com/windows/apps/trace-processing/overview?WT.mc_id=Portal-fx) for collecting both Audit and Analytical DNS server events.[The NXLog im_etw module](https://docs.nxlog.co/refman/current/im/etw.html) reads event tracing data directly for maximum efficiency, without the need to capture the event trace into an .etl file. \n \n **Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)", "Data Connectors": [ "Data Connectors/NXLogDnsLogs.json" ], "Parsers": [ - "Parsers/ASimDnsMicrosoftNXLog.txt" + "Parsers/ASimDnsMicrosoftNXLog.yaml" ], - "BasePath": "C:\\GitHub\\azure\\Solutions\\NXLogDnsLogs", - "Version": "2.0.1", + "BasePath": "C:\\One\\Azure-Sentinel-jszigetvari\\Solutions\\NXLogDnsLogs", + "Version": "3.0.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false -} \ No newline at end of file +} diff --git a/Solutions/NXLogDnsLogs/Package/3.0.0.zip b/Solutions/NXLogDnsLogs/Package/3.0.0.zip new file mode 100644 index 00000000000..4ba4a625d73 Binary files /dev/null and b/Solutions/NXLogDnsLogs/Package/3.0.0.zip differ diff --git a/Solutions/NXLogDnsLogs/Package/createUiDefinition.json b/Solutions/NXLogDnsLogs/Package/createUiDefinition.json index 3fb5d8f3377..af507b043d2 100644 --- a/Solutions/NXLogDnsLogs/Package/createUiDefinition.json +++ b/Solutions/NXLogDnsLogs/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [NXLog DnsLogs](https://docs.nxlog.co/refman/v5.5/im/etw.html) solution for Microsoft Sentinel enables you to ingest DNS server events. NXLog DnsLogs uses Event Tracing for Windows [(ETW)](https://docs.microsoft.com/windows/apps/trace-processing/overview?WT.mc_id=Portal-fx) for collecting both Audit and Analytical DNS server events. [The NXLog im_etw module](https://docs.nxlog.co/refman/v5.5/im/etw.html) reads event tracing data directly for maximum efficiency, without the need to capture the event trace into an .etl file. \r\n \n **Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\n**Data Connectors:** 1, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [NXLog DNSLogs](https://docs.nxlog.co/refman/current/im/etw.html) solution for Microsoft Sentinel enables you to ingest DNS server events. NXLog DNSLogs uses Event Tracing for Windows [(ETW)](https://docs.microsoft.com/windows/apps/trace-processing/overview?WT.mc_id=Portal-fx) for collecting both Audit and Analytical DNS server events.[The NXLog im_etw module](https://docs.nxlog.co/refman/current/im/etw.html) reads event tracing data directly for maximum efficiency, without the need to capture the event trace into an .etl file. \n \n **Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\n**Data Connectors:** 1, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,14 +60,14 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This solution installs the data connector for ingesting DNS server events from NXLog DnsLogs into Microsoft Sentinel through the Azure Monitor HTTP Data Collector REST API. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This Solution installs the data connector for NXLogDNSLogs. You can get NXLogDNSLogs custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The solution also installs a parser that transforms ingested data. The transformed logs can be accessed using the NXLogDnsLogs Kusto Function alias." + "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." } }, { diff --git a/Solutions/NXLogDnsLogs/Package/mainTemplate.json b/Solutions/NXLogDnsLogs/Package/mainTemplate.json index c2b3d3d6564..90e426f7991 100644 --- a/Solutions/NXLogDnsLogs/Package/mainTemplate.json +++ b/Solutions/NXLogDnsLogs/Package/mainTemplate.json @@ -3,7 +3,7 @@ "contentVersion": "1.0.0.0", "metadata": { "author": "NXLog", - "comments": "Solution template for NXLogDnsLogs" + "comments": "Solution template for NXLogDNSLogs" }, "parameters": { "location": { @@ -30,55 +30,41 @@ } }, "variables": { + "_solutionName": "NXLogDNSLogs", + "_solutionVersion": "3.0.0", "solutionId": "nxlogltd1589381969261.nxlog_dns_logs", "_solutionId": "[variables('solutionId')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "uiConfigId1": "NXLogDnsLogs", + "uiConfigId1": "NXLogDNSLogs", "_uiConfigId1": "[variables('uiConfigId1')]", - "dataConnectorContentId1": "NXLogDnsLogs", + "dataConnectorContentId1": "NXLogDNSLogs", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", - "parserVersion1": "1.0.0", - "parserContentId1": "ASimDnsMicrosoftNXLog-Parser", - "_parserContentId1": "[variables('parserContentId1')]", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", "parserName1": "ASimDnsMicrosoftNXLog", "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1')))]" + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", + "parserVersion1": "1.0.0", + "parserContentId1": "ASimDnsMicrosoftNXLog-Parser", + "_parserContentId1": "[variables('parserContentId1')]", + "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "NXLogDnsLogs data connector with template", - "displayName": "NXLogDnsLogs template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NXLogDnsLogs data connector with template version 2.0.1", + "description": "NXLogDNSLogs data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -96,7 +82,7 @@ "id": "[variables('_uiConfigId1')]", "title": "NXLog DNS Logs", "publisher": "NXLog", - "descriptionMarkdown": "The NXLog DNS Logs data connector uses Event Tracing for Windows ([ETW](https://docs.microsoft.com/windows/apps/trace-processing/overview)) for collecting both Audit and Analytical DNS Server events. The [NXLog *im_etw* module](https://nxlog.co/documentation/nxlog-user-guide/im_etw.html) reads event tracing data directly for maximum efficiency, without the need to capture the event trace into an .etl file. This REST API connector can forward DNS Server events to Microsoft Sentinel in real time.", + "descriptionMarkdown": "The NXLog DNS Logs data connector uses Event Tracing for Windows ([ETW](https://docs.microsoft.com/windows/apps/trace-processing/overview)) for collecting both Audit and Analytical DNS Server events. The [NXLog *im_etw* module](https://docs.nxlog.co/refman/current/im/etw.html) reads event tracing data directly for maximum efficiency, without the need to capture the event trace into an .etl file. This REST API connector can forward DNS Server events to Microsoft Sentinel in real time.", "additionalRequirementBanner": "This data connector depends on parsers based on Kusto functions deployed with the Microsoft Sentinel Solution to work as expected. The [**ASimDnsMicrosoftNXLog **](https://aka.ms/sentinel-nxlogdnslogs-parser) is designed to leverage Microsoft Sentinel's built-in DNS-related analytics capabilities.", "graphQueries": [ { @@ -166,7 +152,7 @@ "description": ">**NOTE:** This data connector depends on parsers based on Kusto functions deployed with the Microsoft Sentinel Solution to work as expected. The [**ASimDnsMicrosoftNXLog **](https://aka.ms/sentinel-nxlogdnslogs-parser) is designed to leverage Microsoft Sentinel's built-in DNS-related analytics capabilities." }, { - "description": "Follow the step-by-step instructions in the *NXLog User Guide* Integration Topic [Microsoft Sentinel](https://nxlog.co/documentation/nxlog-user-guide/sentinel.html) to configure this connector.", + "description": "Follow the step-by-step instructions in the *NXLog User Guide* Integration Topic [Microsoft Sentinel](https://docs.nxlog.co/userguide/integrate/microsoft-azure-sentinel.html) to configure this connector.", "instructions": [ { "parameters": { @@ -194,7 +180,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -203,7 +189,7 @@ "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", - "name": "NXLogDnsLogs", + "name": "NXLogDNSLogs", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -212,17 +198,28 @@ "support": { "name": "NXLog", "tier": "Partner", - "link": "https://nxlog.co/user?destination=node/add/support-ticket" + "link": "https://nxlog.co/support-tickets/add/support-ticket" } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "NXLog DNS Logs", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -235,7 +232,7 @@ "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", - "name": "NXLogDnsLogs", + "name": "NXLogDNSLogs", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -244,7 +241,7 @@ "support": { "name": "NXLog", "tier": "Partner", - "link": "https://nxlog.co/user?destination=node/add/support-ticket" + "link": "https://nxlog.co/support-tickets/add/support-ticket" } } }, @@ -258,7 +255,7 @@ "connectorUiConfig": { "title": "NXLog DNS Logs", "publisher": "NXLog", - "descriptionMarkdown": "The NXLog DNS Logs data connector uses Event Tracing for Windows ([ETW](https://docs.microsoft.com/windows/apps/trace-processing/overview)) for collecting both Audit and Analytical DNS Server events. The [NXLog *im_etw* module](https://nxlog.co/documentation/nxlog-user-guide/im_etw.html) reads event tracing data directly for maximum efficiency, without the need to capture the event trace into an .etl file. This REST API connector can forward DNS Server events to Microsoft Sentinel in real time.", + "descriptionMarkdown": "The NXLog DNS Logs data connector uses Event Tracing for Windows ([ETW](https://docs.microsoft.com/windows/apps/trace-processing/overview)) for collecting both Audit and Analytical DNS Server events. The [NXLog *im_etw* module](https://docs.nxlog.co/refman/current/im/etw.html) reads event tracing data directly for maximum efficiency, without the need to capture the event trace into an .etl file. This REST API connector can forward DNS Server events to Microsoft Sentinel in real time.", "graphQueries": [ { "metricName": "Total data received", @@ -327,7 +324,7 @@ "description": ">**NOTE:** This data connector depends on parsers based on Kusto functions deployed with the Microsoft Sentinel Solution to work as expected. The [**ASimDnsMicrosoftNXLog **](https://aka.ms/sentinel-nxlogdnslogs-parser) is designed to leverage Microsoft Sentinel's built-in DNS-related analytics capabilities." }, { - "description": "Follow the step-by-step instructions in the *NXLog User Guide* Integration Topic [Microsoft Sentinel](https://nxlog.co/documentation/nxlog-user-guide/sentinel.html) to configure this connector.", + "description": "Follow the step-by-step instructions in the *NXLog User Guide* Integration Topic [Microsoft Sentinel](https://docs.nxlog.co/userguide/integrate/microsoft-azure-sentinel.html) to configure this connector.", "instructions": [ { "parameters": { @@ -356,33 +353,15 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('parserTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, - "properties": { - "description": "ASimDnsMicrosoftNXLog Data Parser with template", - "displayName": "ASimDnsMicrosoftNXLog Data Parser template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('parserTemplateSpecName1'),'/',variables('parserVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('parserTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ASimDnsMicrosoftNXLog Data Parser with template version 2.0.1", + "description": "ASimDnsMicrosoftNXLog Data Parser with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserVersion1')]", @@ -391,20 +370,21 @@ "resources": [ { "name": "[variables('_parserName1')]", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "ASimDnsMicrosoftNXLog", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "ASimDnsMicrosoftNXLog", - "query": "\nlet ASimDnsMicrosoftNXLog = view () {\r\n let EventTypeTable=datatable(EventOriginalType:real,EventType:string)[\r\n 256, 'Query'\r\n , 257, 'Query'\r\n , 258, 'Query'\r\n , 259, 'Query'\r\n , 260, 'Query'\r\n , 261, 'Query'\r\n , 262, 'Query'\r\n , 263, 'Dynamic update'\r\n , 264, 'Dynamic update'\r\n , 265, 'Zone XFR'\r\n , 266, 'Zone XFR'\r\n , 267, 'Zone XFR'\r\n , 268, 'Zone XFR'\r\n , 269, 'Zone XFR'\r\n , 270, 'Zone XFR'\r\n , 271, 'Zone XFR'\r\n , 272, 'Zone XFR'\r\n , 273, 'Zone XFR'\r\n , 274, 'Zone XFR'\r\n , 275, 'Zone XFR'\r\n , 276, 'Zone XFR'\r\n , 277, 'Dynamic update'\r\n , 278, 'Dynamic update'\r\n , 279, 'Query'\r\n , 280, 'Query'\r\n ];\r\n let EventSubTypeTable=datatable(EventOriginalType:real,EventSubType:string)[\r\n 256, 'request'\r\n , 257, 'response'\r\n , 258, 'response'\r\n , 259, 'response'\r\n , 260, 'request'\r\n , 261, 'response'\r\n , 262, 'response'\r\n , 263, 'request'\r\n , 264, 'response'\r\n , 265, 'request'\r\n , 266, 'request'\r\n , 267, 'response'\r\n , 268, 'response'\r\n , 269, 'request'\r\n , 270, 'request'\r\n , 271, 'response'\r\n , 272, 'response'\r\n , 273, 'request'\r\n , 274, 'request'\r\n , 275, 'response'\r\n , 276, 'response'\r\n , 277, 'request'\r\n , 278, 'response'\r\n , 279, 'NA'\r\n , 280, 'NA'\r\n ];\r\n let EventResultTable=datatable(EventOriginalType:real,EventResult:string)[\r\n 256, 'NA'\r\n , 257, 'Success'\r\n , 258, 'Failure'\r\n , 259, 'Failure'\r\n , 260, 'NA'\r\n , 261, 'NA'\r\n , 262, 'Failure'\r\n , 263, 'NA'\r\n , 264, 'Based on RCODE'\r\n , 265, 'NA'\r\n , 266, 'NA'\r\n , 267, 'Based on RCODE'\r\n , 268, 'Based on RCODE'\r\n , 269, 'NA'\r\n , 270, 'NA'\r\n , 271, 'Based on RCODE'\r\n , 272, 'Based on RCODE'\r\n , 273, 'NA'\r\n , 274, 'NA'\r\n , 275, 'Success'\r\n , 276, 'Success'\r\n , 277, 'NA'\r\n , 278, 'Based on RCODE'\r\n , 279, 'NA'\r\n , 280, 'NA'\r\n ];\r\n let RCodeTable=datatable(DnsResponseCode:int,ResponseCodeName:string)[\r\n 0,'NOERROR'\r\n , 1,'FORMERR'\r\n , 2,'SERVFAIL'\r\n , 3,'NXDOMAIN'\r\n , 4,'NOTIMP'\r\n , 5,'REFUSED'\r\n , 6,'YXDOMAIN'\r\n , 7,'YXRRSET'\r\n , 8,'NXRRSET'\r\n , 9,'NOTAUTH'\r\n , 10,'NOTZONE'\r\n , 11,'DSOTYPENI'\r\n , 16,'BADVERS'\r\n , 16,'BADSIG'\r\n , 17,'BADKEY'\r\n , 18,'BADTIME'\r\n , 19,'BADMODE'\r\n , 20,'BADNAME'\r\n , 21,'BADALG'\r\n , 22,'BADTRUNC'\r\n , 23,'BADCOOKIE'\r\n ];\r\n let QTypeTable=datatable(DnsQueryType:int,QTypeName:string)[\r\n 0, 'Reserved'\r\n , 1, 'A'\r\n , 2, 'NS'\r\n , 3, 'MD'\r\n , 4, 'MF'\r\n , 5, 'CNAME'\r\n , 6, 'SOA'\r\n , 7, 'MB'\r\n , 8 ,'MG'\r\n , 9 ,'MR'\r\n , 10,'NULL'\r\n , 11,'WKS'\r\n , 12,'PTR'\r\n , 13,'HINFO'\r\n , 14,'MINFO'\r\n , 15,'MX'\r\n , 16,'TXT'\r\n , 17,'RP'\r\n , 18,'AFSDB'\r\n , 19,'X25'\r\n , 20,'ISDN'\r\n , 21,'RT'\r\n , 22,'NSAP'\r\n , 23,'NSAP-PTR'\r\n , 24,'SIG'\r\n , 25,'KEY'\r\n , 26,'PX'\r\n , 27,'GPOS'\r\n , 28,'AAAA'\r\n , 29,'LOC'\r\n , 30,'NXT'\r\n , 31,'EID'\r\n , 32,'NIMLOC'\r\n , 33,'SRV'\r\n ];\r\n NXLog_DNS_Server_CL\r\n | where EventID_d < 281\r\n | project-rename\r\n DnsFlags=Flags_s,\r\n DnsQuery=QNAME_s,\r\n DnsQueryType=QTYPE_s,\r\n DnsResponseCode=RCODE_s,\r\n DnsResponseName=PacketData_s,\r\n Dvc=Hostname_s,\r\n DvcIpAddr=HostIP_s,\r\n EventOriginalType=EventID_d,\r\n EventOriginalUid=GUID_g,\r\n EventStartTime=EventTime_t,\r\n SrcPortNumber=Port_s,\r\n SrcIpAddr=Source_s\r\n | extend\r\n DnsQuery=trim_end(\".\",DnsQuery),\r\n DnsQueryType=toint(DnsQueryType),\r\n DnsResponseCode=toint(DnsResponseCode),\r\n DvcHostname=Dvc,\r\n EventEndTime=EventStartTime,\r\n EventProduct=\"Microsoft DNS Server\",\r\n EventSchemaVersion=\"0.1.1\",\r\n EventVendor=\"Microsoft\",\r\n NetworkProtocol=iff(TCP_s == \"0\",\"UDP\",\"TCP\"),\r\n TransactionIdHex=tohex(toint(XID_s))\r\n | lookup EventTypeTable on EventOriginalType\r\n | lookup EventSubTypeTable on EventOriginalType\r\n | lookup EventResultTable on EventOriginalType\r\n | lookup RCodeTable on DnsResponseCode\r\n | lookup QTypeTable on DnsQueryType\r\n | extend\r\n EventResultDetails = case (isnotempty(ResponseCodeName), ResponseCodeName\r\n , DnsResponseCode between (3841 .. 4095), 'Reserved for Private Use'\r\n , 'Unassigned')\r\n | extend\r\n Domain=DnsQuery,\r\n DnsResponseCodeName=EventResultDetails,\r\n DnsQueryTypeName = case (isnotempty(QTypeName), QTypeName\r\n , DnsQueryType between (66 .. 98), 'Unassigned'\r\n , DnsQueryType between (110 .. 248), 'Unassigned'\r\n , DnsQueryType between (261 .. 32767), 'Unassigned'\r\n , 'Unassigned'),\r\n EventResult=iff (DnsResponseCode == 0 and EventResult == 'Informational','Success',EventResult)\r\n | project-away\r\n AA_s,\r\n AD_s,\r\n AdditionalInfo_s,\r\n BufferSize_s,\r\n AccountName_s,\r\n AccountType_s,\r\n CacheScope_s,\r\n ChannelID_d,\r\n Destination_s,\r\n DNSSEC_s,\r\n Domain_s,\r\n ElapsedTime_s,\r\n EventReceivedTime_t,\r\n EventType_s,\r\n ExecutionProcessID_d,\r\n ExecutionThreadID_d,\r\n InterfaceIP_s,\r\n Keywords_s,\r\n OpcodeValue_d,\r\n PolicyName_s,\r\n ProviderGuid_g,\r\n QXID_s,\r\n RD_s,\r\n Reason_s,\r\n RecursionDepth_s,\r\n RecursionScope_s,\r\n ResponseCodeName,\r\n Scope_s,\r\n Severity_s,\r\n SeverityValue_d,\r\n SourceModuleName_s,\r\n SourceModuleType_s,\r\n SourceName_s,\r\n TaskValue_d,\r\n TCP_s,\r\n UserID_s,\r\n Version_d,\r\n XID_s,\r\n Zone_s\r\n};\r\nASimDnsMicrosoftNXLog();", - "version": 1, + "query": "_Im_Dns\n| where EventVendor == \"Microsoft\" and EventProduct == \"DNS Server\"\n", + "functionParameters": "", + "version": 2, "tags": [ { "name": "description", - "value": "ASimDnsMicrosoftNXLog" + "value": "" } ] } @@ -422,7 +402,7 @@ "kind": "Parser", "version": "[variables('parserVersion1')]", "source": { - "name": "NXLogDnsLogs", + "name": "NXLogDNSLogs", "kind": "Solution", "sourceId": "[variables('_solutionId')]" }, @@ -432,26 +412,44 @@ "support": { "name": "NXLog", "tier": "Partner", - "link": "https://nxlog.co/user?destination=node/add/support-ticket" + "link": "https://nxlog.co/support-tickets/add/support-ticket" } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_parserContentId1')]", + "contentKind": "Parser", + "displayName": "ASimDnsMicrosoftNXLog", + "contentProductId": "[variables('_parsercontentProductId1')]", + "id": "[variables('_parsercontentProductId1')]", + "version": "[variables('parserVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2021-06-01", + "apiVersion": "2022-10-01", "name": "[variables('_parserName1')]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "ASimDnsMicrosoftNXLog", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "ASimDnsMicrosoftNXLog", - "query": "\nlet ASimDnsMicrosoftNXLog = view () {\r\n let EventTypeTable=datatable(EventOriginalType:real,EventType:string)[\r\n 256, 'Query'\r\n , 257, 'Query'\r\n , 258, 'Query'\r\n , 259, 'Query'\r\n , 260, 'Query'\r\n , 261, 'Query'\r\n , 262, 'Query'\r\n , 263, 'Dynamic update'\r\n , 264, 'Dynamic update'\r\n , 265, 'Zone XFR'\r\n , 266, 'Zone XFR'\r\n , 267, 'Zone XFR'\r\n , 268, 'Zone XFR'\r\n , 269, 'Zone XFR'\r\n , 270, 'Zone XFR'\r\n , 271, 'Zone XFR'\r\n , 272, 'Zone XFR'\r\n , 273, 'Zone XFR'\r\n , 274, 'Zone XFR'\r\n , 275, 'Zone XFR'\r\n , 276, 'Zone XFR'\r\n , 277, 'Dynamic update'\r\n , 278, 'Dynamic update'\r\n , 279, 'Query'\r\n , 280, 'Query'\r\n ];\r\n let EventSubTypeTable=datatable(EventOriginalType:real,EventSubType:string)[\r\n 256, 'request'\r\n , 257, 'response'\r\n , 258, 'response'\r\n , 259, 'response'\r\n , 260, 'request'\r\n , 261, 'response'\r\n , 262, 'response'\r\n , 263, 'request'\r\n , 264, 'response'\r\n , 265, 'request'\r\n , 266, 'request'\r\n , 267, 'response'\r\n , 268, 'response'\r\n , 269, 'request'\r\n , 270, 'request'\r\n , 271, 'response'\r\n , 272, 'response'\r\n , 273, 'request'\r\n , 274, 'request'\r\n , 275, 'response'\r\n , 276, 'response'\r\n , 277, 'request'\r\n , 278, 'response'\r\n , 279, 'NA'\r\n , 280, 'NA'\r\n ];\r\n let EventResultTable=datatable(EventOriginalType:real,EventResult:string)[\r\n 256, 'NA'\r\n , 257, 'Success'\r\n , 258, 'Failure'\r\n , 259, 'Failure'\r\n , 260, 'NA'\r\n , 261, 'NA'\r\n , 262, 'Failure'\r\n , 263, 'NA'\r\n , 264, 'Based on RCODE'\r\n , 265, 'NA'\r\n , 266, 'NA'\r\n , 267, 'Based on RCODE'\r\n , 268, 'Based on RCODE'\r\n , 269, 'NA'\r\n , 270, 'NA'\r\n , 271, 'Based on RCODE'\r\n , 272, 'Based on RCODE'\r\n , 273, 'NA'\r\n , 274, 'NA'\r\n , 275, 'Success'\r\n , 276, 'Success'\r\n , 277, 'NA'\r\n , 278, 'Based on RCODE'\r\n , 279, 'NA'\r\n , 280, 'NA'\r\n ];\r\n let RCodeTable=datatable(DnsResponseCode:int,ResponseCodeName:string)[\r\n 0,'NOERROR'\r\n , 1,'FORMERR'\r\n , 2,'SERVFAIL'\r\n , 3,'NXDOMAIN'\r\n , 4,'NOTIMP'\r\n , 5,'REFUSED'\r\n , 6,'YXDOMAIN'\r\n , 7,'YXRRSET'\r\n , 8,'NXRRSET'\r\n , 9,'NOTAUTH'\r\n , 10,'NOTZONE'\r\n , 11,'DSOTYPENI'\r\n , 16,'BADVERS'\r\n , 16,'BADSIG'\r\n , 17,'BADKEY'\r\n , 18,'BADTIME'\r\n , 19,'BADMODE'\r\n , 20,'BADNAME'\r\n , 21,'BADALG'\r\n , 22,'BADTRUNC'\r\n , 23,'BADCOOKIE'\r\n ];\r\n let QTypeTable=datatable(DnsQueryType:int,QTypeName:string)[\r\n 0, 'Reserved'\r\n , 1, 'A'\r\n , 2, 'NS'\r\n , 3, 'MD'\r\n , 4, 'MF'\r\n , 5, 'CNAME'\r\n , 6, 'SOA'\r\n , 7, 'MB'\r\n , 8 ,'MG'\r\n , 9 ,'MR'\r\n , 10,'NULL'\r\n , 11,'WKS'\r\n , 12,'PTR'\r\n , 13,'HINFO'\r\n , 14,'MINFO'\r\n , 15,'MX'\r\n , 16,'TXT'\r\n , 17,'RP'\r\n , 18,'AFSDB'\r\n , 19,'X25'\r\n , 20,'ISDN'\r\n , 21,'RT'\r\n , 22,'NSAP'\r\n , 23,'NSAP-PTR'\r\n , 24,'SIG'\r\n , 25,'KEY'\r\n , 26,'PX'\r\n , 27,'GPOS'\r\n , 28,'AAAA'\r\n , 29,'LOC'\r\n , 30,'NXT'\r\n , 31,'EID'\r\n , 32,'NIMLOC'\r\n , 33,'SRV'\r\n ];\r\n NXLog_DNS_Server_CL\r\n | where EventID_d < 281\r\n | project-rename\r\n DnsFlags=Flags_s,\r\n DnsQuery=QNAME_s,\r\n DnsQueryType=QTYPE_s,\r\n DnsResponseCode=RCODE_s,\r\n DnsResponseName=PacketData_s,\r\n Dvc=Hostname_s,\r\n DvcIpAddr=HostIP_s,\r\n EventOriginalType=EventID_d,\r\n EventOriginalUid=GUID_g,\r\n EventStartTime=EventTime_t,\r\n SrcPortNumber=Port_s,\r\n SrcIpAddr=Source_s\r\n | extend\r\n DnsQuery=trim_end(\".\",DnsQuery),\r\n DnsQueryType=toint(DnsQueryType),\r\n DnsResponseCode=toint(DnsResponseCode),\r\n DvcHostname=Dvc,\r\n EventEndTime=EventStartTime,\r\n EventProduct=\"Microsoft DNS Server\",\r\n EventSchemaVersion=\"0.1.1\",\r\n EventVendor=\"Microsoft\",\r\n NetworkProtocol=iff(TCP_s == \"0\",\"UDP\",\"TCP\"),\r\n TransactionIdHex=tohex(toint(XID_s))\r\n | lookup EventTypeTable on EventOriginalType\r\n | lookup EventSubTypeTable on EventOriginalType\r\n | lookup EventResultTable on EventOriginalType\r\n | lookup RCodeTable on DnsResponseCode\r\n | lookup QTypeTable on DnsQueryType\r\n | extend\r\n EventResultDetails = case (isnotempty(ResponseCodeName), ResponseCodeName\r\n , DnsResponseCode between (3841 .. 4095), 'Reserved for Private Use'\r\n , 'Unassigned')\r\n | extend\r\n Domain=DnsQuery,\r\n DnsResponseCodeName=EventResultDetails,\r\n DnsQueryTypeName = case (isnotempty(QTypeName), QTypeName\r\n , DnsQueryType between (66 .. 98), 'Unassigned'\r\n , DnsQueryType between (110 .. 248), 'Unassigned'\r\n , DnsQueryType between (261 .. 32767), 'Unassigned'\r\n , 'Unassigned'),\r\n EventResult=iff (DnsResponseCode == 0 and EventResult == 'Informational','Success',EventResult)\r\n | project-away\r\n AA_s,\r\n AD_s,\r\n AdditionalInfo_s,\r\n BufferSize_s,\r\n AccountName_s,\r\n AccountType_s,\r\n CacheScope_s,\r\n ChannelID_d,\r\n Destination_s,\r\n DNSSEC_s,\r\n Domain_s,\r\n ElapsedTime_s,\r\n EventReceivedTime_t,\r\n EventType_s,\r\n ExecutionProcessID_d,\r\n ExecutionThreadID_d,\r\n InterfaceIP_s,\r\n Keywords_s,\r\n OpcodeValue_d,\r\n PolicyName_s,\r\n ProviderGuid_g,\r\n QXID_s,\r\n RD_s,\r\n Reason_s,\r\n RecursionDepth_s,\r\n RecursionScope_s,\r\n ResponseCodeName,\r\n Scope_s,\r\n Severity_s,\r\n SeverityValue_d,\r\n SourceModuleName_s,\r\n SourceModuleType_s,\r\n SourceName_s,\r\n TaskValue_d,\r\n TCP_s,\r\n UserID_s,\r\n Version_d,\r\n XID_s,\r\n Zone_s\r\n};\r\nASimDnsMicrosoftNXLog();", - "version": 1 + "query": "_Im_Dns\n| where EventVendor == \"Microsoft\" and EventProduct == \"DNS Server\"\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { @@ -469,7 +467,7 @@ "version": "[variables('parserVersion1')]", "source": { "kind": "Solution", - "name": "NXLogDnsLogs", + "name": "NXLogDNSLogs", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -478,23 +476,30 @@ "support": { "name": "NXLog", "tier": "Partner", - "link": "https://nxlog.co/user?destination=node/add/support-ticket" + "link": "https://nxlog.co/support-tickets/add/support-ticket" } } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.1", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "NXLogDNSLogs", + "publisherDisplayName": "NXLog", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The NXLog DNSLogs solution for Microsoft Sentinel enables you to ingest DNS server events. NXLog DNSLogs uses Event Tracing for Windows (ETW) for collecting both Audit and Analytical DNS server events.The NXLog im_etw module reads event tracing data directly for maximum efficiency, without the need to capture the event trace into an .etl file.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Azure Monitor HTTP Data Collector API
    2. \n
\n

Data Connectors: 1, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { "kind": "Solution", - "name": "NXLogDnsLogs", + "name": "NXLogDNSLogs", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -503,7 +508,7 @@ "support": { "name": "NXLog", "tier": "Partner", - "link": "https://nxlog.co/user?destination=node/add/support-ticket" + "link": "https://nxlog.co/support-tickets/add/support-ticket" }, "dependencies": { "operator": "AND", diff --git a/Solutions/NXLogDnsLogs/Parsers/ASimDnsMicrosoftNXLog.yaml b/Solutions/NXLogDnsLogs/Parsers/ASimDnsMicrosoftNXLog.yaml index e1d22df0835..dee0b90a24e 100644 --- a/Solutions/NXLogDnsLogs/Parsers/ASimDnsMicrosoftNXLog.yaml +++ b/Solutions/NXLogDnsLogs/Parsers/ASimDnsMicrosoftNXLog.yaml @@ -7,230 +7,5 @@ Category: Microsoft Sentinel Parser FunctionName: ASimDnsMicrosoftNXLog FunctionAlias: ASimDnsMicrosoftNXLog FunctionQuery: | - let ASimDnsMicrosoftNXLog = view () { - let EventTypeTable=datatable(EventOriginalType:real,EventType:string)[ - 256, 'Query' - , 257, 'Query' - , 258, 'Query' - , 259, 'Query' - , 260, 'Query' - , 261, 'Query' - , 262, 'Query' - , 263, 'Dynamic update' - , 264, 'Dynamic update' - , 265, 'Zone XFR' - , 266, 'Zone XFR' - , 267, 'Zone XFR' - , 268, 'Zone XFR' - , 269, 'Zone XFR' - , 270, 'Zone XFR' - , 271, 'Zone XFR' - , 272, 'Zone XFR' - , 273, 'Zone XFR' - , 274, 'Zone XFR' - , 275, 'Zone XFR' - , 276, 'Zone XFR' - , 277, 'Dynamic update' - , 278, 'Dynamic update' - , 279, 'Query' - , 280, 'Query' - ]; - let EventSubTypeTable=datatable(EventOriginalType:real,EventSubType:string)[ - 256, 'request' - , 257, 'response' - , 258, 'response' - , 259, 'response' - , 260, 'request' - , 261, 'response' - , 262, 'response' - , 263, 'request' - , 264, 'response' - , 265, 'request' - , 266, 'request' - , 267, 'response' - , 268, 'response' - , 269, 'request' - , 270, 'request' - , 271, 'response' - , 272, 'response' - , 273, 'request' - , 274, 'request' - , 275, 'response' - , 276, 'response' - , 277, 'request' - , 278, 'response' - , 279, 'NA' - , 280, 'NA' - ]; - let EventResultTable=datatable(EventOriginalType:real,EventResult:string)[ - 256, 'NA' - , 257, 'Success' - , 258, 'Failure' - , 259, 'Failure' - , 260, 'NA' - , 261, 'NA' - , 262, 'Failure' - , 263, 'NA' - , 264, 'Based on RCODE' - , 265, 'NA' - , 266, 'NA' - , 267, 'Based on RCODE' - , 268, 'Based on RCODE' - , 269, 'NA' - , 270, 'NA' - , 271, 'Based on RCODE' - , 272, 'Based on RCODE' - , 273, 'NA' - , 274, 'NA' - , 275, 'Success' - , 276, 'Success' - , 277, 'NA' - , 278, 'Based on RCODE' - , 279, 'NA' - , 280, 'NA' - ]; - let RCodeTable=datatable(DnsResponseCode:int,ResponseCodeName:string)[ - 0,'NOERROR' - , 1,'FORMERR' - , 2,'SERVFAIL' - , 3,'NXDOMAIN' - , 4,'NOTIMP' - , 5,'REFUSED' - , 6,'YXDOMAIN' - , 7,'YXRRSET' - , 8,'NXRRSET' - , 9,'NOTAUTH' - , 10,'NOTZONE' - , 11,'DSOTYPENI' - , 16,'BADVERS' - , 16,'BADSIG' - , 17,'BADKEY' - , 18,'BADTIME' - , 19,'BADMODE' - , 20,'BADNAME' - , 21,'BADALG' - , 22,'BADTRUNC' - , 23,'BADCOOKIE' - ]; - let QTypeTable=datatable(DnsQueryType:int,QTypeName:string)[ - 0, 'Reserved' - , 1, 'A' - , 2, 'NS' - , 3, 'MD' - , 4, 'MF' - , 5, 'CNAME' - , 6, 'SOA' - , 7, 'MB' - , 8 ,'MG' - , 9 ,'MR' - , 10,'NULL' - , 11,'WKS' - , 12,'PTR' - , 13,'HINFO' - , 14,'MINFO' - , 15,'MX' - , 16,'TXT' - , 17,'RP' - , 18,'AFSDB' - , 19,'X25' - , 20,'ISDN' - , 21,'RT' - , 22,'NSAP' - , 23,'NSAP-PTR' - , 24,'SIG' - , 25,'KEY' - , 26,'PX' - , 27,'GPOS' - , 28,'AAAA' - , 29,'LOC' - , 30,'NXT' - , 31,'EID' - , 32,'NIMLOC' - , 33,'SRV' - ]; - NXLog_DNS_Server_CL - | where EventID_d < 281 - | project-rename - DnsFlags=Flags_s, - DnsQuery=QNAME_s, - DnsQueryType=QTYPE_s, - DnsResponseCode=RCODE_s, - DnsResponseName=PacketData_s, - Dvc=Hostname_s, - DvcIpAddr=HostIP_s, - EventOriginalType=EventID_d, - EventOriginalUid=GUID_g, - EventStartTime=EventTime_t, - SrcPortNumber=Port_s, - SrcIpAddr=Source_s - | extend - DnsQuery=trim_end(".",DnsQuery), - DnsQueryType=toint(DnsQueryType), - DnsResponseCode=toint(DnsResponseCode), - DvcHostname=Dvc, - EventEndTime=EventStartTime, - EventProduct="Microsoft DNS Server", - EventSchemaVersion="0.1.1", - EventVendor="Microsoft", - NetworkProtocol=iff(TCP_s == "0","UDP","TCP"), - TransactionIdHex=tohex(toint(XID_s)) - | lookup EventTypeTable on EventOriginalType - | lookup EventSubTypeTable on EventOriginalType - | lookup EventResultTable on EventOriginalType - | lookup RCodeTable on DnsResponseCode - | lookup QTypeTable on DnsQueryType - | extend - EventResultDetails = case (isnotempty(ResponseCodeName), ResponseCodeName - , DnsResponseCode between (3841 .. 4095), 'Reserved for Private Use' - , 'Unassigned') - | extend - Domain=DnsQuery, - DnsResponseCodeName=EventResultDetails, - DnsQueryTypeName = case (isnotempty(QTypeName), QTypeName - , DnsQueryType between (66 .. 98), 'Unassigned' - , DnsQueryType between (110 .. 248), 'Unassigned' - , DnsQueryType between (261 .. 32767), 'Unassigned' - , 'Unassigned'), - EventResult=iff (DnsResponseCode == 0 and EventResult == 'Informational','Success',EventResult) - | project-away - AA_s, - AD_s, - AdditionalInfo_s, - BufferSize_s, - AccountName_s, - AccountType_s, - CacheScope_s, - ChannelID_d, - Destination_s, - DNSSEC_s, - Domain_s, - ElapsedTime_s, - EventReceivedTime_t, - EventType_s, - ExecutionProcessID_d, - ExecutionThreadID_d, - InterfaceIP_s, - Keywords_s, - OpcodeValue_d, - PolicyName_s, - ProviderGuid_g, - QXID_s, - RD_s, - Reason_s, - RecursionDepth_s, - RecursionScope_s, - ResponseCodeName, - Scope_s, - Severity_s, - SeverityValue_d, - SourceModuleName_s, - SourceModuleType_s, - SourceName_s, - TaskValue_d, - TCP_s, - UserID_s, - Version_d, - XID_s, - Zone_s - }; - ASimDnsMicrosoftNXLog(); \ No newline at end of file + _Im_Dns + | where EventVendor == "Microsoft" and EventProduct == "DNS Server" \ No newline at end of file diff --git a/Solutions/NXLogDnsLogs/SolutionMetadata.json b/Solutions/NXLogDnsLogs/SolutionMetadata.json index 8d045a47285..54bcf6b8d78 100644 --- a/Solutions/NXLogDnsLogs/SolutionMetadata.json +++ b/Solutions/NXLogDnsLogs/SolutionMetadata.json @@ -9,6 +9,6 @@ "support": { "name": "NXLog", "tier": "Partner", - "link": "https://nxlog.co/user?destination=node/add/support-ticket" + "link": "https://nxlog.co/support-tickets/add/support-ticket" } -} \ No newline at end of file +} diff --git a/Solutions/OneLoginIAM/Data Connectors/OneLogin_Webhooks_FunctionApp.json b/Solutions/OneLoginIAM/Data Connectors/OneLogin_Webhooks_FunctionApp.json index 1ec44507b61..a4478187bbd 100644 --- a/Solutions/OneLoginIAM/Data Connectors/OneLogin_Webhooks_FunctionApp.json +++ b/Solutions/OneLoginIAM/Data Connectors/OneLogin_Webhooks_FunctionApp.json @@ -102,22 +102,42 @@ ] }, { - "title": "Option 1 - Azure Resource Manager (ARM) Template", - "description": "Use this method for automated deployment of the OneLogin data connector using an ARM Template.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-OneLogin-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n> **NOTE:** Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.\n3. Enter the **OneLoginBearerToken** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n6. After deploying open Function App page, select your app, go to the **Functions** and click **Get Function Url** copy it and follow p.7 from STEP 1." - }, - { - "title": "Option 2 - Manual Deployment of Azure Functions", - "description": "Use the following step-by-step instructions to deploy the OneLogin data connector manually with Azure Functions (Deployment via Visual Studio Code)." - }, - { - "title": "", - "description": "**1. Deploy a Function App**\n\n> **NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-OneLogin-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. OneLoginXXXXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration." - }, - { - "title": "", - "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select ** New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tOneLoginBearerToken\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n> - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`.\n4. Once all application settings have been entered, click **Save**." + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Option 1 - Azure Resource Manager (ARM) Template", + "description": "Use this method for automated deployment of the OneLogin data connector using an ARM Template.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-OneLogin-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n> **NOTE:** Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.\n3. Enter the **OneLoginBearerToken** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n6. After deploying open Function App page, select your app, go to the **Functions** and click **Get Function Url** copy it and follow p.7 from STEP 1." + }, + { + "title": "Option 2 - Manual Deployment of Azure Functions", + "description": "Use the following step-by-step instructions to deploy the OneLogin data connector manually with Azure Functions (Deployment via Visual Studio Code).", + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Step 1 - Deploy a Function App", + "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-OneLogin-functionapp) file. Extract archive to your local development computer.\n2. Follow the [function app manual deployment instructions](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AzureFunctionsManualDeployment.md#function-app-manual-deployment-instructions) to deploy the Azure Functions app using VSCode.\n3. After successful deployment of the function app, follow next steps for configuring it." + }, + { + "title": "Step 2 - Configure the Function App", + "description": "1. Go to Azure Portal for the Function App configuration.\n2. In the Function App, select the Function App Name and select **Configuration**.\n3. In the **Application settings** tab, select ** New application setting**.\n4. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tOneLoginBearerToken\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n> - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`.\n5. Once all application settings have been entered, click **Save**." + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] } - ], + ], "metadata": { "id": "28c8e10b-1e0a-4e44-89cb-2c746aa82bf2", "version": "1.0.0", diff --git a/Solutions/OneLoginIAM/Data/Solution_OneLoginIAM.json b/Solutions/OneLoginIAM/Data/Solution_OneLoginIAM.json index 1dee570fc9f..060220af06d 100644 --- a/Solutions/OneLoginIAM/Data/Solution_OneLoginIAM.json +++ b/Solutions/OneLoginIAM/Data/Solution_OneLoginIAM.json @@ -1,5 +1,5 @@ { - "Name": "OneLogin IAM", + "Name": "OneLoginIAM", "Author": "Microsoft - support@microsoft.com", "Logo": "", "Description": "The [OneLogin](https://www.onelogin.com/) solution for Microsoft Sentinel provides the capability to ingest common OneLogin IAM Platform events into Microsoft Sentinel through Webhooks.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\r\n\n", @@ -7,11 +7,11 @@ "Data Connectors/OneLogin_Webhooks_FunctionApp.json" ], "Parsers": [ - "Parsers/OneLogin.txt" + "Parsers/OneLogin.yaml" ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\OneLoginIAM", - "Version": "2.0.2", + "Version": "3.0.0", "TemplateSpec": true, "Is1PConnector": false } \ No newline at end of file diff --git a/Solutions/OneLoginIAM/Data/system_generated_metadata.json b/Solutions/OneLoginIAM/Data/system_generated_metadata.json new file mode 100644 index 00000000000..08e8e13d1ea --- /dev/null +++ b/Solutions/OneLoginIAM/Data/system_generated_metadata.json @@ -0,0 +1,30 @@ +{ + "Name": "OneLogin IAM", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "The [OneLogin](https://www.onelogin.com/) solution for Microsoft Sentinel provides the capability to ingest common OneLogin IAM Platform events into Microsoft Sentinel through Webhooks.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\r\n\n", + "Metadata": "SolutionMetadata.json", + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\OneLoginIAM", + "TemplateSpec": true, + "Is1PConnector": false, + "Version": "3.0.0", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-oneloginiam", + "providers": [ + "OneLogin" + ], + "categories": { + "domains": [ + "Identity" + ] + }, + "firstPublishDate": "2022-08-18", + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "Data Connectors": "[\n \"Data Connectors/OneLogin_Webhooks_FunctionApp.json\"\n]", + "Parsers": "[\n \"OneLogin.yaml\"\n]" +} diff --git a/Solutions/OneLoginIAM/Package/3.0.0.zip b/Solutions/OneLoginIAM/Package/3.0.0.zip new file mode 100644 index 00000000000..8407c6269b6 Binary files /dev/null and b/Solutions/OneLoginIAM/Package/3.0.0.zip differ diff --git a/Solutions/OneLoginIAM/Package/createUiDefinition.json b/Solutions/OneLoginIAM/Package/createUiDefinition.json index a70d431b207..2660e002cee 100644 --- a/Solutions/OneLoginIAM/Package/createUiDefinition.json +++ b/Solutions/OneLoginIAM/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [OneLogin](https://www.onelogin.com/) solution for Microsoft Sentinel provides the capability to ingest common OneLogin IAM Platform events into Microsoft Sentinel through Webhooks.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\r\n\n\n\n**Data Connectors:** 1, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/OneLoginIAM/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [OneLogin](https://www.onelogin.com/) solution for Microsoft Sentinel provides the capability to ingest common OneLogin IAM Platform events into Microsoft Sentinel through Webhooks.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\r\n\n\n\n**Data Connectors:** 1, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,7 +60,7 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This solution installs a data connector that helps ingest OneLogin logs into Microsoft Sentinel using Syslog. The connector provides ability to get events which helps to examine potential security risks, analyse your team's use of collaboration, diagnose configuration problems and more.After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This solution installs a data connector that helps ingest OneLogin logs into Microsoft Sentinel using Syslog. The connector provides ability to get events which helps to examine potential security risks, analyse your team's use of collaboration, diagnose configuration problems and more." } }, { diff --git a/Solutions/OneLoginIAM/Package/mainTemplate.json b/Solutions/OneLoginIAM/Package/mainTemplate.json index e3ddb588e9d..02afa0db162 100644 --- a/Solutions/OneLoginIAM/Package/mainTemplate.json +++ b/Solutions/OneLoginIAM/Package/mainTemplate.json @@ -3,7 +3,7 @@ "contentVersion": "1.0.0.0", "metadata": { "author": "Microsoft - support@microsoft.com", - "comments": "Solution template for OneLogin IAM" + "comments": "Solution template for OneLoginIAM" }, "parameters": { "location": { @@ -30,57 +30,43 @@ } }, "variables": { - "solutionId": "azuresentinel.azure-sentinel-solution-oneloginiam", - "_solutionId": "[variables('solutionId')]", "email": "support@microsoft.com", "_email": "[variables('email')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_solutionName": "OneLoginIAM", + "_solutionVersion": "3.0.0", + "solutionId": "azuresentinel.azure-sentinel-solution-oneloginiam", + "_solutionId": "[variables('solutionId')]", "uiConfigId1": "OneLogin", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "OneLogin", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", - "parserVersion1": "1.0.0", - "parserContentId1": "OneLogin-Parser", - "_parserContentId1": "[variables('parserContentId1')]", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", "parserName1": "OneLogin", "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1')))]" + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", + "parserVersion1": "1.0.1", + "parserContentId1": "OneLogin-Parser", + "_parserContentId1": "[variables('parserContentId1')]", + "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "OneLogin IAM data connector with template", - "displayName": "OneLogin IAM template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "OneLogin IAM data connector with template version 2.0.2", + "description": "OneLoginIAM data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -202,18 +188,40 @@ ] }, { - "description": "Use this method for automated deployment of the OneLogin data connector using an ARM Template.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-OneLogin-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n> **NOTE:** Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.\n3. Enter the **OneLoginBearerToken** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n6. After deploying open Function App page, select your app, go to the **Functions** and click **Get Function Url** copy it and follow p.7 from STEP 1.", - "title": "Option 1 - Azure Resource Manager (ARM) Template" - }, - { - "description": "Use the following step-by-step instructions to deploy the OneLogin data connector manually with Azure Functions (Deployment via Visual Studio Code).", - "title": "Option 2 - Manual Deployment of Azure Functions" - }, - { - "description": "**1. Deploy a Function App**\n\n> **NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-OneLogin-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. OneLoginXXXXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration." - }, - { - "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select ** New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tOneLoginBearerToken\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n> - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`.\n4. Once all application settings have been entered, click **Save**." + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Option 1 - Azure Resource Manager (ARM) Template", + "description": "Use this method for automated deployment of the OneLogin data connector using an ARM Template.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-OneLogin-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n> **NOTE:** Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.\n3. Enter the **OneLoginBearerToken** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n6. After deploying open Function App page, select your app, go to the **Functions** and click **Get Function Url** copy it and follow p.7 from STEP 1." + }, + { + "title": "Option 2 - Manual Deployment of Azure Functions", + "description": "Use the following step-by-step instructions to deploy the OneLogin data connector manually with Azure Functions (Deployment via Visual Studio Code).", + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Step 1 - Deploy a Function App", + "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-OneLogin-functionapp) file. Extract archive to your local development computer.\n2. Follow the [function app manual deployment instructions](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AzureFunctionsManualDeployment.md#function-app-manual-deployment-instructions) to deploy the Azure Functions app using VSCode.\n3. After successful deployment of the function app, follow next steps for configuring it." + }, + { + "title": "Step 2 - Configure the Function App", + "description": "1. Go to Azure Portal for the Function App configuration.\n2. In the Function App, select the Function App Name and select **Configuration**.\n3. In the **Application settings** tab, select ** New application setting**.\n4. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tOneLoginBearerToken\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n> - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`.\n5. Once all application settings have been entered, click **Save**." + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] } ], "metadata": { @@ -238,7 +246,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -247,7 +255,7 @@ "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", - "name": "OneLogin IAM", + "name": "OneLoginIAM", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -263,12 +271,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "OneLogin IAM Platform(using Azure Functions)", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -281,7 +300,7 @@ "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", - "name": "OneLogin IAM", + "name": "OneLoginIAM", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -409,18 +428,40 @@ ] }, { - "description": "Use this method for automated deployment of the OneLogin data connector using an ARM Template.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-OneLogin-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n> **NOTE:** Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.\n3. Enter the **OneLoginBearerToken** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n6. After deploying open Function App page, select your app, go to the **Functions** and click **Get Function Url** copy it and follow p.7 from STEP 1.", - "title": "Option 1 - Azure Resource Manager (ARM) Template" - }, - { - "description": "Use the following step-by-step instructions to deploy the OneLogin data connector manually with Azure Functions (Deployment via Visual Studio Code).", - "title": "Option 2 - Manual Deployment of Azure Functions" - }, - { - "description": "**1. Deploy a Function App**\n\n> **NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-OneLogin-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. OneLoginXXXXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration." - }, - { - "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select ** New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tOneLoginBearerToken\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n> - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`.\n4. Once all application settings have been entered, click **Save**." + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Option 1 - Azure Resource Manager (ARM) Template", + "description": "Use this method for automated deployment of the OneLogin data connector using an ARM Template.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-OneLogin-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n> **NOTE:** Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.\n3. Enter the **OneLoginBearerToken** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n6. After deploying open Function App page, select your app, go to the **Functions** and click **Get Function Url** copy it and follow p.7 from STEP 1." + }, + { + "title": "Option 2 - Manual Deployment of Azure Functions", + "description": "Use the following step-by-step instructions to deploy the OneLogin data connector manually with Azure Functions (Deployment via Visual Studio Code).", + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Step 1 - Deploy a Function App", + "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-OneLogin-functionapp) file. Extract archive to your local development computer.\n2. Follow the [function app manual deployment instructions](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AzureFunctionsManualDeployment.md#function-app-manual-deployment-instructions) to deploy the Azure Functions app using VSCode.\n3. After successful deployment of the function app, follow next steps for configuring it." + }, + { + "title": "Step 2 - Configure the Function App", + "description": "1. Go to Azure Portal for the Function App configuration.\n2. In the Function App, select the Function App Name and select **Configuration**.\n3. In the **Application settings** tab, select ** New application setting**.\n4. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tOneLoginBearerToken\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n> - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`.\n5. Once all application settings have been entered, click **Save**." + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] } ], "id": "[variables('_uiConfigId1')]", @@ -429,33 +470,15 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('parserTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, - "properties": { - "description": "OneLogin Data Parser with template", - "displayName": "OneLogin Data Parser template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('parserTemplateSpecName1'),'/',variables('parserVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('parserTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "OneLogin Data Parser with template version 2.0.2", + "description": "OneLogin Data Parser with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserVersion1')]", @@ -464,20 +487,21 @@ "resources": [ { "name": "[variables('_parserName1')]", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "OneLogin", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "OneLogin", - "query": "\nOneLogin_CL\r\n| project-rename TargetAppName = app_name_s,\r\n TargetAppId = app_id_d,\r\n RoleName = role_name_s,\r\n RoleId = role_id_d,\r\n PolicyName = policy_name_s,\r\n PolicyType = policy_type_s,\r\n PolicyId = policy_id_d,\r\n HttpUserAgent = user_agent_s,\r\n UserId = user_id_d,\r\n UserAttributesUsername_s = user_attributes_username_s,\r\n UserAttributesAccountId = user_attributes_account_id_d,\r\n UserAttributesDepartment = user_attributes_department_s,\r\n UserAttributesFirstname = user_attributes_firstname_s,\r\n UserAttributesEmail = user_attributes_email_s,\r\n UserAttributesOpenidName = user_attributes_openid_name_s,\r\n UserAttributesTitle = user_attributes_title_s,\r\n UserAttributesLastname = user_attributes_lastname_s,\r\n UserName = user_name_s,\r\n EventOriginalUid = create__id_g,\r\n UUID = uuid_g,\r\n ActorSystem = actor_system_s,\r\n CustomMessage = custom_message_s,\r\n AccountId = account_id_d,\r\n SrcIpAddr = ipaddr_s,\r\n ActorUserName = actor_user_name_s,\r\n ActorUserId = actor_user_id_d,\r\n Message = notes_s,\r\n EventTypeId = event_type_id_d,\r\n EventStartTime = event_timestamp_s\r\n| extend EventVendor = \"OneLogin\",\r\n EventProduct = \"OneLogin IAM\",\r\n EventType = case (\r\n EventTypeId == 1, \"APP_ADDED_TO_ROLE\",\r\n EventTypeId == 2, \"APP_REMOVED_FROM_ROLE\",\r\n EventTypeId == 3, \"USER_ASSUMED_USER\",\r\n EventTypeId == 4, \"USER_ASSIGNED_ROLE\",\r\n EventTypeId == 5, \"USER_LOGGED_INTO_ONELOGIN\",\r\n EventTypeId == 6, \"USER_FAILED_ONELOGIN_LOGIN\",\r\n EventTypeId == 7, \"USER_LOGGED_OUT_OF_ONELOGIN\",\r\n EventTypeId == 8, \"USER_LOGGED_INTO_APP\",\r\n EventTypeId == 9, \"USER_FAILED_APP_LOGIN\",\r\n EventTypeId == 10, \"USER_REQUESTED_NEW_PASSWORD\",\r\n EventTypeId == 11, \"USER_CHANGED_PASSWORD\",\r\n EventTypeId == 12, \"UNLOCKED_USER\",\r\n EventTypeId == 13, \"CREATED_USER\",\r\n EventTypeId == 14, \"UPDATED_USER\",\r\n EventTypeId == 15, \"DEACTIVATED_USER\",\r\n EventTypeId == 16, \"ACTIVATED_USER\",\r\n EventTypeId == 17, \"DELETED_USER\",\r\n EventTypeId == 18, \"ADMIN_APPROVED_PASSWORD_REQUEST\",\r\n EventTypeId == 19, \"USER_LOCKED\",\r\n EventTypeId == 20, \"REACHED_USERS_LIMIT\",\r\n EventTypeId == 21, \"SUSPENDED_USER\",\r\n EventTypeId == 22, \"USER_ADDED_OTP_DEVICE\",\r\n EventTypeId == 23, \"USER_BULK_OPERATION\",\r\n EventTypeId == 24, \"USER_REMOVED_OTP_DEVICE\",\r\n EventTypeId == 25, \"PROVISIONING_EXCEPTION\",\r\n EventTypeId == 26, \"PROVISIONING_EVENT\",\r\n EventTypeId == 27, \"USER_DOWNLOADED_CERT\",\r\n EventTypeId == 28, \"USER_RECENTLY_REMOVED\",\r\n EventTypeId == 29, \"USER_LOGGED_OUT_OF_APP\",\r\n EventTypeId == 30, \"UPDATED_PAYMENT_INFO\",\r\n EventTypeId == 31, \"FAILED_UPDATE_PAYMENT_INFO\",\r\n EventTypeId == 32, \"REACTIVATED_USER\",\r\n EventTypeId == 33, \"USERS_IMPORTED_FROM_DIRECTORY\",\r\n EventTypeId == 34, \"USER_REQUESTED_APP\",\r\n EventTypeId == 35, \"USER_LOCKED_OUT_OF_APP\",\r\n EventTypeId == 36, \"USER_LOST_OTP_DEVICE\",\r\n EventTypeId == 37, \"USER_JOIN_REQUEST\",\r\n EventTypeId == 38, \"APP_REACHED_USER_LIMIT\",\r\n EventTypeId == 39, \"CONNECTOR_BROKEN\",\r\n EventTypeId == 40, \"USER_UNLOCKED_OTP_DEVICE\",\r\n EventTypeId == 41, \"AD_CONNECTOR_STARTED\",\r\n EventTypeId == 42, \"AD_CONNECTOR_STOPPED\",\r\n EventTypeId == 43, \"AD_CONNECTOR_CONFIG_RELOAD\",\r\n EventTypeId == 44, \"AD_CONNECTOR_NOTIFICATION\",\r\n EventTypeId == 45, \"AD_CONNECTOR_EXCEPTION_OLD\",\r\n EventTypeId == 46, \"AD_CONNECTOR_FAIL_OVER\",\r\n EventTypeId == 47, \"AD_CONNECTOR_EXCEPTION\",\r\n EventTypeId == 48, \"IMPORTED_USER\",\r\n EventTypeId == 49, \"UPDATE_USER_FAILED\",\r\n EventTypeId == 50, \"REJECTED_USER\",\r\n EventTypeId == 51, \"USER_CREATED_IN_APP\",\r\n EventTypeId == 52, \"USER_UPDATED_IN_APP\",\r\n EventTypeId == 53, \"USER_SUSPENDED_IN_APP\",\r\n EventTypeId == 54, \"USER_REACTIVATED_IN_APP\",\r\n EventTypeId == 55, \"USER_DELETED_IN_APP\",\r\n EventTypeId == 56, \"UNMATCHED_USERS\",\r\n EventTypeId == 57, \"RABBIT_DOWN\",\r\n EventTypeId == 58, \"RABBIT_RESTARTED\",\r\n EventTypeId == 59, \"USER_LINKED_IN_APP\",\r\n EventTypeId == 60, \"PROVISIONING_DEPROVISIONING_MODE_DO_NOTHING_WARNING\",\r\n EventTypeId == 61, \"USER_FAILED_SUSPENDING_IN_APP\",\r\n EventTypeId == 62, \"USER_FAILED_REACTIVATING_IN_APP\",\r\n EventTypeId == 63, \"USER_FAILED_DELETING_IN_APP\",\r\n EventTypeId == 64, \"USER_FAILED_CREATING_IN_APP\",\r\n EventTypeId == 65, \"USER_FAILED_UPDATING_IN_APP\",\r\n EventTypeId == 66, \"NO_USERS_TO_IMPORT_FROM_DIRECTORY\",\r\n EventTypeId == 67, \"DIRECTORY_IMPORT_EXCEPTION\",\r\n EventTypeId == 68, \"USER_AUTHENTICATED_BY_RADIUS\",\r\n EventTypeId == 69, \"USER_REJECTED_BY_RADIUS\",\r\n EventTypeId == 70, \"PRIVILEGE_GRANTED_TO_ACCOUNT\",\r\n EventTypeId == 71, \"PRIVILEGE_REVOKED_FROM_ACCOUNT\",\r\n EventTypeId == 72, \"PRIVILEGE_GRANTED_TO_USER\",\r\n EventTypeId == 73, \"PRIVILEGE_REVOKED_FROM_USER\",\r\n EventTypeId == 74, \"TRUSTED_IDP_ADDED\",\r\n EventTypeId == 75, \"TRUSTED_IDP_REMOVED\",\r\n EventTypeId == 76, \"TRUSTED_IDP_MODIFIED\",\r\n EventTypeId == 77, \"USER_FAILED_PROXY_LOGIN\",\r\n EventTypeId == 78, \"USER_SUCCEEDED_PROXY_LOGIN\",\r\n EventTypeId == 79, \"AD_CONNECTOR_PROVISIONING_ERROR\",\r\n EventTypeId == 80, \"USER_CREATED_IN_DIRECTORY\",\r\n EventTypeId == 81, \"USER_UPDATED_IN_DIRECTORY\",\r\n EventTypeId == 82, \"USER_SUSPENDED_IN_DIRECTORY\",\r\n EventTypeId == 83, \"USER_REACTIVATED_IN_DIRECTORY\",\r\n EventTypeId == 84, \"USER_DELETED_IN_DIRECTORY\",\r\n EventTypeId == 85, \"APP_COULD_NOT_AUTHENTICATE\",\r\n EventTypeId == 86, \"USER_FAILED_REMOTE_AUTHENTICATION\",\r\n EventTypeId == 87, \"USER_VIEWED_NOTE\",\r\n EventTypeId == 88, \"USER_EDITED_NOTE\",\r\n EventTypeId == 89, \"USER_DELETED_NOTE\",\r\n EventTypeId == 90, \"USER_UNAUTHORIZED_APP_ACCESS\",\r\n EventTypeId == 91, \"USER_UNDETERMINED_BY_RADIUS\",\r\n EventTypeId == 92, \"USER_NTHASH_REQUESTED_BY_RADIUS\",\r\n EventTypeId == 95, \"DIRECTORY_GROUPS_WRITE_BACK_IMPORT_STARTED\",\r\n EventTypeId == 96, \"DIRECTORY_GROUPS_WRITE_BACK_IMPORT_FINISHED\",\r\n EventTypeId == 100, \"SELF_REGISTRATION_REQUEST\",\r\n EventTypeId == 101, \"SELF_REGISTRATION_APPROVED\",\r\n EventTypeId == 102, \"SELF_REGISTRATION_DENIED\",\r\n EventTypeId == 103, \"SELF_REGISTRATION_REQUEST_UNVERIFIED\",\r\n EventTypeId == 104, \"SELF_REGISTRATION_REQUEST_VERIFIED\",\r\n EventTypeId == 105, \"SMS_FAILURE\",\r\n EventTypeId == 106, \"USER_CHANGE_PASSWORD_FAILED\",\r\n EventTypeId == 110, \"APP_LOGINS_UPDATED\",\r\n EventTypeId == 111, \"APP_LOGINS_UPDATE_FAILED\",\r\n EventTypeId == 112, \"TRUSTED_IDP_MADE_DEFAULT\",\r\n EventTypeId == 113, \"DIRECTORY_IMPORT_STARTED\",\r\n EventTypeId == 114, \"DIRECTORY_IMPORT_FINISHED\",\r\n EventTypeId == 115, \"USER_INVITED\",\r\n EventTypeId == 116, \"CREATE_USER_FAILED\",\r\n EventTypeId == 117, \"DIRECTORY_SYNC_RUN_ID\",\r\n EventTypeId == 118, \"SAML_ACS_FAILED\",\r\n EventTypeId == 119, \"TRUSTED_IDP_REMOVED_AS_DEFAULT\",\r\n EventTypeId == 120, \"UNLOCKED_USER_IN_DIRECTORY\",\r\n EventTypeId == 121, \"SCRIPTLET_ERROR\",\r\n EventTypeId == 122, \"USER_AUTHENTICATED_BY_API\",\r\n EventTypeId == 123, \"USER_REJECTED_BY_API\",\r\n EventTypeId == 124, \"ENTITLEMENTS_CACHE_ACTION\",\r\n EventTypeId == 125, \"ENTITLEMENT_ACTION\",\r\n EventTypeId == 126, \"DIRECTORY_CONNECTOR_ENABLED\",\r\n EventTypeId == 127, \"DIRECTORY_CONNECTOR_DISABLED\",\r\n EventTypeId == 128, \"NO_ACTIVE_ACTIVE_DIRECTORY_CONNECTORS\",\r\n EventTypeId == 129, \"VLDAP_BIND_FAILURE\",\r\n EventTypeId == 130, \"VLDAP_BIND_SUCCESS\",\r\n EventTypeId == 131, \"DIRECTORY_EXPORT_STARTED\",\r\n EventTypeId == 132, \"DIRECTORY_EXPORT_FINISHED\",\r\n EventTypeId == 133, \"DIRECTORY_EXPORT_EXCEPTION\",\r\n EventTypeId == 134, \"DIRECTORY_REFRESH_SCHEMA_EXCEPTION\",\r\n EventTypeId == 135, \"CERTIFICATE_EXPIRES\",\r\n EventTypeId == 136, \"DIRECTORY_FIELDS_IMPORT_STARTED\",\r\n EventTypeId == 137, \"USER_APP_REQUEST_APPROVED\",\r\n EventTypeId == 138, \"USER_APP_REQUEST_DENIED\",\r\n EventTypeId == 139, \"DIRECTORY_FIELDS_IMPORT_FINISHED\",\r\n EventTypeId == 140, \"SOCIAL_SIGN_IN\",\r\n EventTypeId == 141, \"SOCIAL_SIGN_IN_FAILURE\",\r\n EventTypeId == 145, \"USER_SMART_PASSWORD_UPDATED\",\r\n EventTypeId == 146, \"USER_SMART_PASSWORD_UPDATE_FAILED\",\r\n EventTypeId == 147, \"USER_MANUALLY_ADDED_TO_ROLE\",\r\n EventTypeId == 148, \"USER_MANUALLY_REMOVED_FROM_ROLE\",\r\n EventTypeId == 149, \"USER_AUTO_ADDED_TO_ROLE\",\r\n EventTypeId == 150, \"USER_AUTO_REMOVED_FROM_ROLE\",\r\n EventTypeId == 151, \"USER_ROLE_MANAGEMENT_GRANTED\",\r\n EventTypeId == 152, \"USER_ROLE_MANAGEMENT_REVOKED\",\r\n EventTypeId == 153, \"MAC_LOGIN_SUCCESS\",\r\n EventTypeId == 154, \"MAC_LOGIN_FAILURE\",\r\n EventTypeId == 155, \"DIRECTORY_FIELDS_IMPORT_EXCEPTION\",\r\n EventTypeId == 156, \"POLICY_CREATED\",\r\n EventTypeId == 157, \"POLICY_UPDATED\",\r\n EventTypeId == 158, \"POLICY_DELETED\",\r\n EventTypeId == 159, \"PROXY_AGENT_CREATED\",\r\n EventTypeId == 160, \"PROXY_AGENT_DELETED\",\r\n EventTypeId == 161, \"RADIUS_CONFIG_CREATED\",\r\n EventTypeId == 162, \"RADIUS_CONFIG_UPDATED\",\r\n EventTypeId == 163, \"RADIUS_CONFIG_DELETED\",\r\n EventTypeId == 164, \"VPN_ENABLED\",\r\n EventTypeId == 165, \"VPN_SETTINGS_UPDATED\",\r\n EventTypeId == 166, \"VPN_DISABLED\",\r\n EventTypeId == 167, \"EMBEDDING_ENABLED\",\r\n EventTypeId == 168, \"EMBEDDING_SETTINGS_UPDATED\",\r\n EventTypeId == 169, \"EMBEDDING_DISABLED\",\r\n EventTypeId == 170, \"AUTHENTICATION_FACTOR_CREATED\",\r\n EventTypeId == 171, \"AUTHENTICATION_FACTOR_UPDATED\",\r\n EventTypeId == 172, \"AUTHENTICATION_FACTOR_DELETED\",\r\n EventTypeId == 173, \"SECURITY_QUESTIONS_UPDATED\",\r\n EventTypeId == 174, \"DESKTOP_SSO_SETTINGS_UPDATED\",\r\n EventTypeId == 175, \"DESKTOP_SSO_ENABLED\",\r\n EventTypeId == 176, \"DESKTOP_SSO_DISABLED\",\r\n EventTypeId == 177, \"CERTIFICATE_CREATED\",\r\n EventTypeId == 178, \"CERTIFICATE_DELETED\",\r\n EventTypeId == 179, \"API_CREDENTIAL_CREATED\",\r\n EventTypeId == 180, \"API_CREDENTIAL_DELETED\",\r\n EventTypeId == 181, \"API_CREDENTIAL_ENABLED\",\r\n EventTypeId == 182, \"API_CREDENTIAL_DISABLED\",\r\n EventTypeId == 183, \"VLDAP_ENABLED\",\r\n EventTypeId == 184, \"VLDAP_DISABLED\",\r\n EventTypeId == 185, \"VLDAP_SETTINGS_UPDATED\",\r\n EventTypeId == 186, \"BRANDING_ENABLED\",\r\n EventTypeId == 187, \"BRANDING_DISABLED\",\r\n EventTypeId == 188, \"BRANDING_UPDATED\",\r\n EventTypeId == 189, \"MAPPING_ADDED\",\r\n EventTypeId == 190, \"MAPPING_DELETED\",\r\n EventTypeId == 191, \"MAPPING_DISABLED\",\r\n EventTypeId == 192, \"MAPPING_ENABLED\",\r\n EventTypeId == 193, \"MAPPING_UPDATED\",\r\n EventTypeId == 194, \"USER_FIELD_ADDED\",\r\n EventTypeId == 195, \"USER_FIELD_DELETED\",\r\n EventTypeId == 196, \"COMPANY_INFO_UPDATED\",\r\n EventTypeId == 197, \"ACCOUNT_SETTINGS_UPDATED\",\r\n EventTypeId == 198, \"DIRECTORY_CREATED\",\r\n EventTypeId == 199, \"DIRECTORY_DESTROYED\",\r\n EventTypeId == 200, \"DIRECTORY_CONNECTOR_INSTANCE_ADDED\",\r\n EventTypeId == 201, \"DIRECTORY_CONNECTOR_INSTANCE_DELETED\",\r\n EventTypeId == 202, \"REAPPLIED_MAPPINGS\",\r\n EventTypeId == 203, \"SELF_REGISTRATION_PROFILE_CREATED\",\r\n EventTypeId == 204, \"SELF_REGISTRATION_PROFILE_UPDATED\",\r\n EventTypeId == 205, \"SELF_REGISTRATION_PROFILE_DESTROYED\",\r\n EventTypeId == 206, \"MANUALLY_ADDED_LOGIN\",\r\n EventTypeId == 207, \"MANUALLY_REMOVED_LOGIN\",\r\n EventTypeId == 208, \"RETRIED_PROVISIONING\",\r\n EventTypeId == 209, \"DIRECTORY_USER_IMPORT_WARNING\",\r\n EventTypeId == 210, \"LDAP_CONNECTOR_EXCEPTION\",\r\n EventTypeId == 211, \"ADMIN_CHANGED_USER_PASSWORD\",\r\n EventTypeId == 212, \"DIRECTORY_LOCKED\",\r\n EventTypeId == 213, \"PROFILE_PICTURE_UPLOADED\",\r\n EventTypeId == 214, \"PROFILE_PICTURE_DELETED\",\r\n EventTypeId == 215, \"ADMIN_CHANGED_ACCOUNT_SETTINGS\",\r\n EventTypeId == 216, \"JOB_IN_QUEUE\",\r\n EventTypeId == 217, \"DIRECTORY_IMPORT_LIMIT_REACHED\",\r\n EventTypeId == 218, \"REAPPLIED_MAPPINGS_FAILED\",\r\n EventTypeId == 219, \"WORKDAY_REAL_TIME_NOTIFICATION\",\r\n EventTypeId == 220, \"ADMIN_CREATED_PAYMENT_RECORD\",\r\n EventTypeId == 221, \"ADMIN_UPDATED_PAYMENT_RECORD\",\r\n EventTypeId == 222, \"ADMIN_DELETED_PAYMENT_RECORD\",\r\n EventTypeId == 223, \"USER_UNLICENSED\",\r\n EventTypeId == 224, \"USER_LICENSED_MANUALLY\",\r\n EventTypeId == 225, \"USER_UNLICENSED_MANUALLY\",\r\n EventTypeId == 226, \"USER_UNLICENSED_AUTOMATICALLY\",\r\n EventTypeId == 227, \"USER_LICENSE_FAILED\",\r\n EventTypeId == 228, \"USERS_LICENSED_BULK\",\r\n EventTypeId == 229, \"ACCOUNT_NEAR_LIMIT\",\r\n EventTypeId == 230, \"ACCOUNT_IN_LIMIT\",\r\n EventTypeId == 231, \"USERS_IN_UNLICENSED_STATE\",\r\n EventTypeId == 232, \"USER_AGREED_TERMS\",\r\n EventTypeId == 233, \"USER_DENIED_TERMS\",\r\n EventTypeId == 234, \"ADMIN_ENABLED_TERMS\",\r\n EventTypeId == 235, \"ADMIN_UPDATED_TERMS\",\r\n EventTypeId == 236, \"ADMIN_DISABLED_TERMS\",\r\n EventTypeId == 237, \"DELETE_USER_FAILED\",\r\n EventTypeId == 238, \"USER_REDIRECTED_FOR_PASSWORD_CHANGE\",\r\n EventTypeId == 239, \"IMPORT_USER_FAILED\",\r\n EventTypeId == 240, \"USER_REVEALED_PASSWORD\",\r\n EventTypeId == 241, \"CSV_IMPORT_FAILED\",\r\n EventTypeId == 242, \"JOB_START_FAILED\",\r\n EventTypeId == 243, \"JOB_TERMINATED\",\r\n EventTypeId == 244, \"REPORT_GENERATED\",\r\n EventTypeId == 245, \"REPORT_GENERATION_FAILED\",\r\n EventTypeId == 246, \"REPORT_GENERATION_TERMINATED\",\r\n EventTypeId == 247, \"USER_MAPPINGS_FAILED\",\r\n EventTypeId == 248, \"USER_MAPPINGS_SUCCEEDED\",\r\n EventTypeId == 249, \"USER_BULK_OPERATION_FAILED\",\r\n EventTypeId == 250, \"PROVISIONING_APP_CONFIG_ERROR\",\r\n EventTypeId == 251, \"PROVISIONING_APP_THROTTLED\",\r\n EventTypeId == 252, \"USER_REMOVELOGINS_FAILED\",\r\n EventTypeId == 253, \"ENTITLEMENT_MAPPINGS_FAILED\",\r\n EventTypeId == 254, \"ENTITLEMENT_MAPPINGS_REAPPLIED\",\r\n EventTypeId == 255, \"MANUALLY_UPDATED_LOGIN\",\r\n EventTypeId == 291, \"USER_CREATED_BY_TIDP\",\r\n EventTypeId == 300, \"LDAP_CONNECTOR_STARTED\",\r\n EventTypeId == 301, \"LDAP_CONNECTOR_NOTIFICATION\",\r\n EventTypeId == 303, \"LDAP_CONNECTOR_CONFIG_RELOAD\",\r\n EventTypeId == 304, \"LDAP_CONNECTOR_STOPPED\",\r\n EventTypeId == 305, \"LDAP_CONNECTOR_FAIL_OVER\",\r\n EventTypeId == 306, \"MANUALLY_ADDED_LOGIN_FAILURE\",\r\n EventTypeId == 307, \"LDAP_CONNECTOR_PROVISIONING_ERROR\",\r\n EventTypeId == 330, \"USER_DISASSOCIATED_FROM_DIRECTORY\",\r\n EventTypeId == 331, \"USER_ASSOCIATED_TO_DIRECTORY\",\r\n EventTypeId == 332, \"USER_DIRECTORY_EXTERNAL_ID_UPDATED\",\r\n EventTypeId == 333, \"USER_DIRECTORY_EXTERNAL_ID_DELETED\",\r\n EventTypeId == 334, \"USER_NOT_UPDATED_IN_APP\",\r\n EventTypeId == 400, \"API_BAD_REQUEST\",\r\n EventTypeId == 401, \"API_UNAUTHORIZED\",\r\n EventTypeId == 402, \"MAPPING_SKIPPED\",\r\n EventTypeId == 410, \"BROADCASTER_CREATED\",\r\n EventTypeId == 411, \"BROADCASTER_UPDATED\",\r\n EventTypeId == 412, \"BROADCASTER_DELETED\",\r\n EventTypeId == 501, \"API_INDEX_ACTION\",\r\n EventTypeId == 502, \"API_SHOW_ACTION\",\r\n EventTypeId == 503, \"API_RES_ACTION\",\r\n EventTypeId == 510, \"API_SET_PWD_SALT\",\r\n EventTypeId == 511, \"API_SET_PWD_CLEAR_TEXT\",\r\n EventTypeId == 512, \"API_SET_CUSTOM_ATTRS\",\r\n EventTypeId == 513, \"API_ADD_ROLES\",\r\n EventTypeId == 514, \"API_REMOVE_ROLES\",\r\n EventTypeId == 515, \"API_AUTH_ISSUE_TOKEN\",\r\n EventTypeId == 516, \"API_LOGOUT\",\r\n EventTypeId == 517, \"API_SET_PWD_SALT_FAILED\",\r\n EventTypeId == 518, \"API_SET_PWD_CLEAR_TEXT_FAILED\",\r\n EventTypeId == 519, \"API_SET_CUSTOM_ATTRS_FAILED\",\r\n EventTypeId == 520, \"API_ADD_ROLES_FAILED\",\r\n EventTypeId == 521, \"API_REMOVE_ROLES_FAILED\",\r\n EventTypeId == 522, \"API_AUTH_ISSUE_TOKEN_FAILED\",\r\n EventTypeId == 523, \"API_LOGOUT_FAILED\",\r\n EventTypeId == 524, \"API_DESTROY_USER_FAILED\",\r\n EventTypeId == 525, \"API_GET_INVITE_LINK_FAILED\",\r\n EventTypeId == 526, \"API_LOCK_USER_FAILED\",\r\n EventTypeId == 527, \"API_VERIFY_FACTOR_FAILED\",\r\n EventTypeId == 528, \"API_VERIFY_FACTOR\",\r\n EventTypeId == 529, \"API_UPDATE_USER\",\r\n EventTypeId == 530, \"API_DESTROY_USER\",\r\n EventTypeId == 531, \"API_LOCK_USER\",\r\n EventTypeId == 532, \"API_UPDATE_USER_FAILED\",\r\n EventTypeId == 533, \"API_CREATE_USER\",\r\n EventTypeId == 534, \"API_CREATE_USER_FAILED\",\r\n EventTypeId == 535, \"API_GET_INVITE_LINK\",\r\n EventTypeId == 536, \"API_USER_OTPS_RETRIEVED\",\r\n EventTypeId == 537, \"API_CONFIRM_FACTOR\",\r\n EventTypeId == 538, \"API_CONFIRM_FACTOR_FAILED\",\r\n EventTypeId == 539, \"API_TRIGGER_FACTOR\",\r\n EventTypeId == 540, \"API_ADDED_OTP_DEVICE\",\r\n EventTypeId == 541, \"DIRECTORY_UPDATED\",\r\n EventTypeId == 542, \"DIRECTORY_OUS_CHANGED\",\r\n EventTypeId == 545, \"API_SEND_INVITE_LINK_FAILED\",\r\n EventTypeId == 546, \"API_SEND_INVITE_LINK\",\r\n EventTypeId == 550, \"FORCE_LOGOUT_USER\",\r\n EventTypeId == 551, \"SUSPENDED_USER_VIA_API\",\r\n EventTypeId == 552, \"REACTIVATED_USER_VIA_API\",\r\n EventTypeId == 553, \"USER_LOCKED_VIA_API\",\r\n EventTypeId == 554, \"UNLOCKED_USER_VIA_API\",\r\n EventTypeId == 555, \"EXTERNAL_ASSUME_USER\",\r\n EventTypeId == 600, \"APP_CREATED_BY_USER\",\r\n EventTypeId == 601, \"APP_UPDATED_BY_USER\",\r\n EventTypeId == 602, \"APP_DELETED_BY_USER\",\r\n EventTypeId == 700, \"CONNECTOR_CREATED\",\r\n EventTypeId == 701, \"CONNECTOR_CREATE_FAILED\",\r\n EventTypeId == 702, \"CONNECTOR_UPDATED\",\r\n EventTypeId == 703, \"CONNECTOR_UPDATE_FAILED\",\r\n EventTypeId == 704, \"CONNECTOR_DELETED\",\r\n EventTypeId == 705, \"CONNECTOR_DELETE_FAILED\",\r\n EventTypeId == 706, \"CONNECTOR_STATS_UPDATE\",\r\n EventTypeId == 800, \"PARAMETER_CREATED\",\r\n EventTypeId == 801, \"PARAMETER_CREATE_FAILED\",\r\n EventTypeId == 802, \"PARAMETER_UPDATED\",\r\n EventTypeId == 803, \"PARAMETER_UPDATE_FAILED\",\r\n EventTypeId == 804, \"PARAMETER_DELETED\",\r\n EventTypeId == 805, \"PARAMETER_DELETE_FAILED\",\r\n EventTypeId == 900, \"ONELOGIN_DESKTOP_MAC_LOGIN_SUCCESS\",\r\n EventTypeId == 901, \"ONELOGIN_DESKTOP_MAC_LOGIN_FAILURE\",\r\n EventTypeId == 902, \"ONELOGIN_DESKTOP_DEVICE_DELETED\",\r\n EventTypeId == 903, \"ONELOGIN_DESKTOP_DEVICE_UNBIND\",\r\n EventTypeId == 904, \"ONELOGIN_DESKTOP_LOGIN_SUCCESS\",\r\n EventTypeId == 905, \"ONELOGIN_DESKTOP_LOGIN_FAILURE\",\r\n EventTypeId == 906, \"ONELOGIN_DESKTOP_USER_FAILED_ONELOGIN_LOGIN\",\r\n EventTypeId == 907, \"DIRECTORY_EXPORT_SUCCESS\",\r\n EventTypeId == 911, \"ONELOGIN_DESKTOP_REVOKE_CERT_FOR_USER\",\r\n EventTypeId == 912, \"ONELOGIN_DESKTOP_REVOKE_CERT_FOR_DEVICE\",\r\n EventTypeId == 931, \"ADAPTIVE_LOGIN_ENABLED\",\r\n EventTypeId == 932, \"ADAPTIVE_LOGIN_DISABLED\",\r\n EventTypeId == 950, \"OL_OTP_PUSH_REJECT\",\r\n EventTypeId == 1001, \"USER_LOGIN_CHALLENGE\",\r\n EventTypeId == 1002, \"USER_LOGIN_CHALLENGE_FAILED\",\r\n EventTypeId == 1010, \"USER_REAUTH_SUCCESS\",\r\n EventTypeId == 1100, \"TEMP_OTP_TOKEN_GENERATED\",\r\n EventTypeId == 1101, \"TEMP_OTP_TOKEN_REVOKED\",\r\n EventTypeId == 1200, \"DELEGATED_APP_PRIVILEGE_DENIED\",\r\n EventTypeId == 1201, \"DELEGATED_USER_PRIVILEGE_DENIED\",\r\n EventTypeId == 1244, \"USER_ADDED_PHONE_NUMBER\",\r\n EventTypeId == 1245, \"USER_UPDATED_PHONE_NUMBER\",\r\n EventTypeId == 1300, \"API_APP_CREATED\",\r\n EventTypeId == 1301, \"API_APP_CREATE_FAILED\",\r\n EventTypeId == 1302, \"API_APP_UPDATED\",\r\n EventTypeId == 1303, \"API_APP_UPDATE_FAILED\",\r\n EventTypeId == 1304, \"API_APP_DESTROYED\",\r\n EventTypeId == 1305, \"API_APP_DESTROY_FAILED\",\r\n EventTypeId == 1400, \"USER_VERIFIED_OTP_DEVICE\",\r\n EventTypeId == 1401, \"API_AUTH_APP_CREATE_FAILED\",\r\n EventTypeId == 1402, \"API_AUTH_APP_UPDATED\",\r\n EventTypeId == 1403, \"API_AUTH_APP_UPDATE_FAILED\",\r\n EventTypeId == 1404, \"API_AUTH_APP_DESTROYED\",\r\n EventTypeId == 1405, \"API_AUTH_APP_DESTROY_FAILED\",\r\n EventTypeId == 1406, \"API_AUTH_SCOPE_CREATED\",\r\n EventTypeId == 1407, \"API_AUTH_SCOPE_CREATE_FAILED\",\r\n EventTypeId == 1408, \"API_AUTH_SCOPE_UPDATED\",\r\n EventTypeId == 1409, \"API_AUTH_SCOPE_UPDATE_FAILED\",\r\n EventTypeId == 1410, \"API_AUTH_SCOPE_DESTROYED\",\r\n EventTypeId == 1411, \"API_AUTH_SCOPE_DESTROY_FAILED\",\r\n EventTypeId == 1412, \"API_AUTH_CLAIM_CREATED\",\r\n EventTypeId == 1413, \"API_AUTH_CLAIM_CREATE_FAILED\",\r\n EventTypeId == 1414, \"API_AUTH_CLAIM_UPDATED\",\r\n EventTypeId == 1415, \"API_AUTH_CLAIM_UPDATE_FAILED\",\r\n EventTypeId == 1416, \"API_AUTH_CLAIM_DESTROYED\",\r\n EventTypeId == 1417, \"API_AUTH_CLAIM_DESTROY_FAILED\",\r\n EventTypeId == 1418, \"API_AUTH_CLIENT_CREATED\",\r\n EventTypeId == 1419, \"API_AUTH_CLIENT_CREATE_FAILED\",\r\n EventTypeId == 1420, \"API_AUTH_CLIENT_UPDATED\",\r\n EventTypeId == 1421, \"API_AUTH_CLIENT_UPDATE_FAILED\",\r\n EventTypeId == 1422, \"API_AUTH_CLIENT_DESTROYED\",\r\n EventTypeId == 1423, \"API_AUTH_CLIENT_DESTROY_FAILED\",\r\n EventTypeId == 1424, \"API_AUTH_APP_CREATED\",\r\n EventTypeId == 1500, \"SANDBOX_SYNC_STARTED\",\r\n EventTypeId == 1501, \"SANDBOX_SYNC_FAILED\",\r\n EventTypeId == 1502, \"SANDBOX_SYNCED\",\r\n EventTypeId == 1503, \"SANDBOX_DELETED\",\r\n EventTypeId == 1504, \"SANDBOX_DELETE_FAILED\",\r\n EventTypeId == 1505, \"SANDBOX_CREATED\",\r\n EventTypeId == 1506, \"SANDBOX_CREATION_FAILED\",\r\n EventTypeId == 1507, \"SANDBOX_UPDATED\",\r\n EventTypeId == 1508, \"SANDBOX_UPDATE_FAILED\",\r\n EventTypeId == 1509, \"SANDBOX_DELETED_BY_API\",\r\n EventTypeId == 1510, \"SANDBOX_DELETE_FAILED_BY_API\",\r\n EventTypeId == 1511, \"SANDBOX_CREATED_BY_API\",\r\n EventTypeId == 1512, \"SANDBOX_CREATION_FAILED_BY_API\",\r\n EventTypeId == 1513, \"SANDBOX_UPDATED_BY_API\",\r\n EventTypeId == 1514, \"SANDBOX_UPDATE_FAILED_BY_API\",\r\n EventTypeId == 1600, \"PROFILE_DEVICES_DELETE_DEVICE\",\r\n EventTypeId == 1601, \"PROFILE_DEVICES_RENAME_DEVICE\",\r\n EventTypeId == 1602, \"PROFILE_DEVICES_UPDATE_DEFAULT\",\r\n EventTypeId == 1603, \"PROFILE_SETTINGS_UPDATE_LOCALE\",\r\n EventTypeId == 1604, \"PROFILE_SETTINGS_UPDATE_PHONE\",\r\n EventTypeId == 1605, \"PROFILE_SETTINGS_UPDATE_DEFAULT_TAB\",\r\n EventTypeId == 1606, \"PROFILE_SETTINGS_UPDATE_PROFILE_PHOTO\",\r\n EventTypeId == 1607, \"PROFILE_SETTINGS_UPDATE_APP_AUTO_DETECT\",\r\n EventTypeId == 1608, \"PROFILE_CHANGE_PASSWORD\",\r\n EventTypeId == 1609, \"PROFILE_SETTINGS_UPDATE_SHOW_TABS\",\r\n EventTypeId == 1700, \"RADIUS_ATTRIBUTE_CREATED\",\r\n EventTypeId == 1701, \"RADIUS_ATTRIBUTE_UPDATED\",\r\n EventTypeId == 1702, \"RADIUS_ATTRIBUTE_DELETED\",\r\n EventTypeId == 1801, \"ROLE_CREATED\",\r\n EventTypeId == 1802, \"ROLE_DELETED\",\r\n EventTypeId == 1900, \"API_BRAND_CREATED\",\r\n EventTypeId == 1901, \"API_BRAND_CREATE_FAILED\",\r\n EventTypeId == 1902, \"API_BRAND_UPDATED\",\r\n EventTypeId == 1903, \"API_BRAND_UPDATE_FAILED\",\r\n EventTypeId == 1904, \"API_BRAND_DESTROYED\",\r\n EventTypeId == 1905, \"API_BRAND_DESTROY_FAILED\",\r\n EventTypeId == 2000, \"HOOKS_LIST_FUNCTION\",\r\n EventTypeId == 2001, \"CUSTOM_SMTP_ERROR\",\r\n EventTypeId == 2002, \"SMTP_SETTINGS_UPDATED\",\r\n EventTypeId == 2003, \"HOOKS_CREATE_FUNCTION\",\r\n EventTypeId == 2004, \"HOOKS_CREATE_FUNCTION_FAILED\",\r\n EventTypeId == 2005, \"HOOKS_GET_FUNCTION\",\r\n EventTypeId == 2006, \"HOOKS_GET_FUNCTION_LOGS\",\r\n EventTypeId == 2007, \"HOOKS_UPDATE_FUNCTION\",\r\n EventTypeId == 2008, \"HOOKS_UPDATE_FUNCTION_FAILED\",\r\n EventTypeId == 2009, \"HOOKS_DELETE_FUNCTION\",\r\n EventTypeId == 2010, \"HOOKS_DELETE_FUNCTION_FAILED\",\r\n EventTypeId == 2011, \"HOOKS_LIST_ENVVAR\",\r\n EventTypeId == 2012, \"HOOKS_CREATE_ENVVAR\",\r\n EventTypeId == 2013, \"HOOKS_CREATE_ENVVAR_FAILED\",\r\n EventTypeId == 2014, \"HOOKS_GET_ENVVAR\",\r\n EventTypeId == 2015, \"HOOKS_UPDATE_ENVVAR\",\r\n EventTypeId == 2016, \"HOOKS_UPDATE_ENVVAR_FAILED\",\r\n EventTypeId == 2017, \"HOOKS_DELETE_ENVVAR\",\r\n EventTypeId == 2018, \"HOOKS_DELETE_ENVVAR_FAILED\",\r\n EventTypeId == 2100, \"DELEGATED_PRIVILEGE_CREATED_VIA_API\",\r\n EventTypeId == 2101, \"DELEGATED_PRIVILEGE_CREATED_BY_USER\",\r\n EventTypeId == 2102, \"DELEGATED_PRIVILEGE_UPDATED_VIA_API\",\r\n EventTypeId == 2103, \"DELEGATED_PRIVILEGE_UPDATED_BY_USER\",\r\n EventTypeId == 2104, \"DELEGATED_PRIVILEGE_DELETED_VIA_API\",\r\n EventTypeId == 2105, \"DELEGATED_PRIVILEGE_DELETED_BY_USER\",\r\n EventTypeId == 2106, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_VIA_API\",\r\n EventTypeId == 2107, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_BY_USER\",\r\n EventTypeId == 2108, \"DELEGATED_PRIVILEGE_REMOVED_FROM_USER_VIA_API\",\r\n EventTypeId == 2109, \"DELEGATED_PRIVILEGE_REMOVED_FROM_USER_BY_USER\",\r\n EventTypeId == 2110, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_VIA_API\",\r\n EventTypeId == 2111, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_BY_USER\",\r\n EventTypeId == 2112, \"DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_VIA_API\",\r\n EventTypeId == 2113, \"DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_BY_USER\",\r\n EventTypeId == 2114, \"DELEGATED_ROLE_PRIVILEGE_DENIED\",\r\n EventTypeId == 2201, \"REPORT_CREATED_BY_USER\",\r\n EventTypeId == 2202, \"REPORT_UPDATED_BY_USER\",\r\n EventTypeId == 2203, \"REPORT_CLONED_BY_USER\",\r\n EventTypeId == 2204, \"REPORT_DESTROYED_BY_USER\",\r\n EventTypeId == 3000, \"OIDC_GENERAL_FAIL\",\r\n EventTypeId == 3001, \"OIDC_IMPLICIT_FLOW_SUCCESS\",\r\n EventTypeId == 3002, \"OIDC_IMPLICIT_FLOW_FAILED\",\r\n EventTypeId == 3003, \"OIDC_GET_CODE_SUCCESS\",\r\n EventTypeId == 3004, \"OIDC_GET_CODE_FAILED\",\r\n EventTypeId == 3005, \"OIDC_AUTHORIZATION_CODE_SUCCESS\",\r\n EventTypeId == 3006, \"OIDC_AUTHORIZATION_CODE_FAILED\",\r\n EventTypeId == 3007, \"OIDC_CLIENT_CREDENTIALS_SUCCESS\",\r\n EventTypeId == 3008, \"OIDC_CLIENT_CREDENTIALS_FAILED\",\r\n EventTypeId == 3009, \"OIDC_PASSWORD_SUCCESS\",\r\n EventTypeId == 3010, \"OIDC_PASSWORD_FAILED\",\r\n EventTypeId == 3011, \"OIDC_REFRESH_TOKEN_SUCCESS\",\r\n EventTypeId == 3012, \"OIDC_REFRESH_TOKEN_FAILED\",\r\n EventTypeId == 3013, \"OIDC_VALIDATE_TOKEN_SUCCESS\",\r\n EventTypeId == 3014, \"OIDC_VALIDATE_TOKEN_FAILED\",\r\n EventTypeId == 3015, \"OIDC_REVOKE_TOKEN_SUCCESS\",\r\n EventTypeId == 3016, \"OIDC_REVOKE_TOKEN_FAILED\",\r\n EventTypeId == 3017, \"OIDC_USER_INFO_SUCCESS\",\r\n EventTypeId == 3018, \"OIDC_USER_INFO_FAILED\",\r\n EventTypeId == 3019, \"NOTIFICATION_WAS_SENT\",\r\n EventTypeId == 3020, \"GROUP_CREATED\",\r\n EventTypeId == 3021, \"GROUP_UPDATED\",\r\n EventTypeId == 3022, \"GROUP_DESTROYED\",\r\n EventTypeId == 3023, \"USER_CREATED_NOTE\",\r\n EventTypeId == 3024, \"DELEGATED_GROUP_PRIVILEGE_DENIED\",\r\n EventTypeId == 3025, \"DELEGATED_POLICY_PRIVILEGE_DENIED\",\r\n EventTypeId == 3026, \"PROFILE_DEVICES_UNSET_DEFAULT\",\r\n EventTypeId == 3027, \"DELEGATED_REPORT_PRIVILEGE_DENIED\",\r\n EventTypeId == 9000, \"USER_ENABLED_WORKFLOW\",\r\n EventTypeId == 9001, \"USER_DISABLED_WORKFLOW\",\r\n EventTypeId == 9002, \"USER_INITIATED_WORKFLOW\",\r\n EventTypeId == 9003, \"USER_COMPLETED_TASK\",\r\n EventTypeId == 9004, \"USER_MARKED_TASK_COMPLETE\",\r\n EventTypeId == 9005, \"USER_MARKED_WORKFLOW_COMPLETE\",\r\n EventTypeId == 9006, \"USER_MARKED_TASK_INCOMPLETE\",\r\n EventTypeId == 9007, \"USER_ENABLED_ONBOARDING\",\r\n EventTypeId == 9008, \"USER_DISABLED_ONBOARDING\",\r\n EventTypeId == 9009, \"USER_ENABLED_OFFBOARDING\",\r\n EventTypeId == 9010, \"USER_DISABLED_OFFBOARDING\",\r\n EventTypeId == 9011, \"USER_INITIATED_OFFBOARDING\",\r\n EventTypeId == 9012, \"USER_INITIATED_ONBOARDING\",\r\n EventTypeId == 9013, \"USER_COMPLETED_WORKFLOW\",\r\n EventTypeId == 9014, \"APP_RULES_LIST_SUCCESS\",\r\n EventTypeId == 9015, \"APP_RULES_LIST_FAILED\",\r\n EventTypeId == 9016, \"APP_RULES_CREATE_SUCCESS\",\r\n EventTypeId == 9017, \"APP_RULES_CREATE_FAILED\",\r\n EventTypeId == 9018, \"APP_RULES_UPDATE_SUCCESS\",\r\n EventTypeId == 9019, \"APP_RULES_UPDATE_FAILED\",\r\n EventTypeId == 9020, \"APP_RULES_GET_SUCCESS\",\r\n EventTypeId == 9021, \"APP_RULES_GET_FAILED\",\r\n EventTypeId == 9022, \"APP_RULES_DRYRUN_SUCCESS\",\r\n EventTypeId == 9023, \"APP_RULES_DRYRUN_FAILED\",\r\n EventTypeId == 9024, \"APP_RULES_DELETE_SUCCESS\",\r\n EventTypeId == 9025, \"APP_RULES_DELETE_FAILED\",\r\n EventTypeId == 9026, \"APP_RULES_SORT_SUCCESS\",\r\n EventTypeId == 9027, \"APP_RULES_SORT_FAILED\",\r\n EventTypeId == 9028, \"APP_RULES_APPLY_SUCCESS\",\r\n EventTypeId == 9029, \"APP_RULES_APPLY_FAILED\",\r\n EventTypeId == 9030, \"APP_RULES_REFRESH_ENTITLEMENTS_SUCCESS\",\r\n EventTypeId == 9031, \"APP_RULES_REFRESH_ENTITLEMENTS_FAILED\",\r\n EventTypeId == 9032, \"APP_RULES_LIST_CONDITIONS_SUCCESS\",\r\n EventTypeId == 9033, \"APP_RULES_LIST_CONDITIONS_FAILED\",\r\n EventTypeId == 9034, \"APP_RULES_LIST_CONDITION_OPERATORS_SUCCESS\",\r\n EventTypeId == 9035, \"APP_RULES_LIST_CONDITION_OPERATORS_FAILED\",\r\n EventTypeId == 9036, \"APP_RULES_LIST_ACTIONS_SUCCESS\",\r\n EventTypeId == 9037, \"APP_RULES_LIST_ACTIONS_FAILED\",\r\n EventTypeId == 9038, \"APP_RULES_LIST_ACTION_VALUES_SUCCESS\",\r\n EventTypeId == 9039, \"APP_RULES_LIST_ACTION_VALUES_FAILED\",\r\n EventTypeId == 9040, \"USER_ROLE_MANAGEMENT_GRANTED_FAILED\",\r\n EventTypeId == 9041, \"USER_ROLE_MANAGEMENT_REVOKED_FAILED\",\r\n EventTypeId == 9042, \"APP_ADDED_TO_ROLE_FAILED\",\r\n EventTypeId == 9043, \"APP_REMOVED_FROM_ROLE_FAILED\",\r\n EventTypeId == 9044, \"USER_MANUALLY_ADDED_TO_ROLE_FAILED\",\r\n EventTypeId == 9045, \"USER_MANUALLY_REMOVED_FROM_ROLE_FAILED\",\r\n EventTypeId == 9046, \"ROLE_CREATE_FAILED\",\r\n EventTypeId == 9047, \"ROLE_DELETE_FAILED\",\r\n EventTypeId == 9048, \"ROLE_LIST_SUCCESS\",\r\n EventTypeId == 9049, \"ROLE_LIST_FAILED\",\r\n EventTypeId == 9050, \"ROLE_GET_SUCCESS\",\r\n EventTypeId == 9051, \"ROLE_GET_FAILED\",\r\n EventTypeId == 9052, \"ROLE_UPDATE_SUCCESS\",\r\n EventTypeId == 9053, \"ROLE_UPDATE_FAILED\",\r\n EventTypeId == 9054, \"ROLE_LIST_APPS_SUCCESS\",\r\n EventTypeId == 9055, \"ROLE_LIST_APPS_FAILED\",\r\n EventTypeId == 9056, \"ROLE_LIST_USERS_SUCCESS\",\r\n EventTypeId == 9057, \"ROLE_LIST_USERS_FAILED\",\r\n EventTypeId == 9058, \"ROLE_LIST_ADMINISTRATORS_SUCCESS\",\r\n EventTypeId == 9059, \"ROLE_LIST_ADMINISTRATORS_FAILED\",\r\n \"\"\r\n )\r\n\r\n", - "version": 1, + "query": "OneLogin_CL\n| extend app_name_s = column_ifexists(\"app_name_s\", ''),\n app_id_d = column_ifexists(\"app_id_d\", ''),\n role_name_s = column_ifexists(\"role_name_s\", ''),\n role_id_d = column_ifexists(\"role_id_d\", ''),\n user_attributes_username_s = column_ifexists(\"user_attributes_username_s\", ''),\n user_attributes_department_s = column_ifexists(\"user_attributes_department_s\", ''),\n user_attributes_title_s = column_ifexists(\"user_attributes_title_s\", '')\n| project-rename TargetAppName = app_name_s,\n TargetAppId = app_id_d,\n RoleName = role_name_s,\n RoleId = role_id_d,\n PolicyName = policy_name_s,\n PolicyType = policy_type_s,\n PolicyId = policy_id_d,\n HttpUserAgent = user_agent_s,\n UserId = user_id_d,\n UserAttributesUsername_s = user_attributes_username_s,\n UserAttributesAccountId = user_attributes_account_id_d,\n UserAttributesDepartment = user_attributes_department_s,\n UserAttributesFirstname = user_attributes_firstname_s,\n UserAttributesEmail = user_attributes_email_s,\n UserAttributesOpenidName = user_attributes_openid_name_s,\n UserAttributesTitle = user_attributes_title_s,\n UserAttributesLastname = user_attributes_lastname_s,\n UserName = user_name_s,\n EventOriginalUid = create__id_g,\n UUID = uuid_g,\n ActorSystem = actor_system_s,\n CustomMessage = custom_message_s,\n AccountId = account_id_d,\n SrcIpAddr = ipaddr_s,\n ActorUserName = actor_user_name_s,\n ActorUserId = actor_user_id_d,\n Message = notes_s,\n EventTypeId = event_type_id_d,\n EventStartTime = event_timestamp_s\n| extend EventVendor = \"OneLogin\",\n EventProduct = \"OneLogin IAM\",\n EventType = case (\n EventTypeId == 1, \"APP_ADDED_TO_ROLE\",\n EventTypeId == 2, \"APP_REMOVED_FROM_ROLE\",\n EventTypeId == 3, \"USER_ASSUMED_USER\",\n EventTypeId == 4, \"USER_ASSIGNED_ROLE\",\n EventTypeId == 5, \"USER_LOGGED_INTO_ONELOGIN\",\n EventTypeId == 6, \"USER_FAILED_ONELOGIN_LOGIN\",\n EventTypeId == 7, \"USER_LOGGED_OUT_OF_ONELOGIN\",\n EventTypeId == 8, \"USER_LOGGED_INTO_APP\",\n EventTypeId == 9, \"USER_FAILED_APP_LOGIN\",\n EventTypeId == 10, \"USER_REQUESTED_NEW_PASSWORD\",\n EventTypeId == 11, \"USER_CHANGED_PASSWORD\",\n EventTypeId == 12, \"UNLOCKED_USER\",\n EventTypeId == 13, \"CREATED_USER\",\n EventTypeId == 14, \"UPDATED_USER\",\n EventTypeId == 15, \"DEACTIVATED_USER\",\n EventTypeId == 16, \"ACTIVATED_USER\",\n EventTypeId == 17, \"DELETED_USER\",\n EventTypeId == 18, \"ADMIN_APPROVED_PASSWORD_REQUEST\",\n EventTypeId == 19, \"USER_LOCKED\",\n EventTypeId == 20, \"REACHED_USERS_LIMIT\",\n EventTypeId == 21, \"SUSPENDED_USER\",\n EventTypeId == 22, \"USER_ADDED_OTP_DEVICE\",\n EventTypeId == 23, \"USER_BULK_OPERATION\",\n EventTypeId == 24, \"USER_REMOVED_OTP_DEVICE\",\n EventTypeId == 25, \"PROVISIONING_EXCEPTION\",\n EventTypeId == 26, \"PROVISIONING_EVENT\",\n EventTypeId == 27, \"USER_DOWNLOADED_CERT\",\n EventTypeId == 28, \"USER_RECENTLY_REMOVED\",\n EventTypeId == 29, \"USER_LOGGED_OUT_OF_APP\",\n EventTypeId == 30, \"UPDATED_PAYMENT_INFO\",\n EventTypeId == 31, \"FAILED_UPDATE_PAYMENT_INFO\",\n EventTypeId == 32, \"REACTIVATED_USER\",\n EventTypeId == 33, \"USERS_IMPORTED_FROM_DIRECTORY\",\n EventTypeId == 34, \"USER_REQUESTED_APP\",\n EventTypeId == 35, \"USER_LOCKED_OUT_OF_APP\",\n EventTypeId == 36, \"USER_LOST_OTP_DEVICE\",\n EventTypeId == 37, \"USER_JOIN_REQUEST\",\n EventTypeId == 38, \"APP_REACHED_USER_LIMIT\",\n EventTypeId == 39, \"CONNECTOR_BROKEN\",\n EventTypeId == 40, \"USER_UNLOCKED_OTP_DEVICE\",\n EventTypeId == 41, \"AD_CONNECTOR_STARTED\",\n EventTypeId == 42, \"AD_CONNECTOR_STOPPED\",\n EventTypeId == 43, \"AD_CONNECTOR_CONFIG_RELOAD\",\n EventTypeId == 44, \"AD_CONNECTOR_NOTIFICATION\",\n EventTypeId == 45, \"AD_CONNECTOR_EXCEPTION_OLD\",\n EventTypeId == 46, \"AD_CONNECTOR_FAIL_OVER\",\n EventTypeId == 47, \"AD_CONNECTOR_EXCEPTION\",\n EventTypeId == 48, \"IMPORTED_USER\",\n EventTypeId == 49, \"UPDATE_USER_FAILED\",\n EventTypeId == 50, \"REJECTED_USER\",\n EventTypeId == 51, \"USER_CREATED_IN_APP\",\n EventTypeId == 52, \"USER_UPDATED_IN_APP\",\n EventTypeId == 53, \"USER_SUSPENDED_IN_APP\",\n EventTypeId == 54, \"USER_REACTIVATED_IN_APP\",\n EventTypeId == 55, \"USER_DELETED_IN_APP\",\n EventTypeId == 56, \"UNMATCHED_USERS\",\n EventTypeId == 57, \"RABBIT_DOWN\",\n EventTypeId == 58, \"RABBIT_RESTARTED\",\n EventTypeId == 59, \"USER_LINKED_IN_APP\",\n EventTypeId == 60, \"PROVISIONING_DEPROVISIONING_MODE_DO_NOTHING_WARNING\",\n EventTypeId == 61, \"USER_FAILED_SUSPENDING_IN_APP\",\n EventTypeId == 62, \"USER_FAILED_REACTIVATING_IN_APP\",\n EventTypeId == 63, \"USER_FAILED_DELETING_IN_APP\",\n EventTypeId == 64, \"USER_FAILED_CREATING_IN_APP\",\n EventTypeId == 65, \"USER_FAILED_UPDATING_IN_APP\",\n EventTypeId == 66, \"NO_USERS_TO_IMPORT_FROM_DIRECTORY\",\n EventTypeId == 67, \"DIRECTORY_IMPORT_EXCEPTION\",\n EventTypeId == 68, \"USER_AUTHENTICATED_BY_RADIUS\",\n EventTypeId == 69, \"USER_REJECTED_BY_RADIUS\",\n EventTypeId == 70, \"PRIVILEGE_GRANTED_TO_ACCOUNT\",\n EventTypeId == 71, \"PRIVILEGE_REVOKED_FROM_ACCOUNT\",\n EventTypeId == 72, \"PRIVILEGE_GRANTED_TO_USER\",\n EventTypeId == 73, \"PRIVILEGE_REVOKED_FROM_USER\",\n EventTypeId == 74, \"TRUSTED_IDP_ADDED\",\n EventTypeId == 75, \"TRUSTED_IDP_REMOVED\",\n EventTypeId == 76, \"TRUSTED_IDP_MODIFIED\",\n EventTypeId == 77, \"USER_FAILED_PROXY_LOGIN\",\n EventTypeId == 78, \"USER_SUCCEEDED_PROXY_LOGIN\",\n EventTypeId == 79, \"AD_CONNECTOR_PROVISIONING_ERROR\",\n EventTypeId == 80, \"USER_CREATED_IN_DIRECTORY\",\n EventTypeId == 81, \"USER_UPDATED_IN_DIRECTORY\",\n EventTypeId == 82, \"USER_SUSPENDED_IN_DIRECTORY\",\n EventTypeId == 83, \"USER_REACTIVATED_IN_DIRECTORY\",\n EventTypeId == 84, \"USER_DELETED_IN_DIRECTORY\",\n EventTypeId == 85, \"APP_COULD_NOT_AUTHENTICATE\",\n EventTypeId == 86, \"USER_FAILED_REMOTE_AUTHENTICATION\",\n EventTypeId == 87, \"USER_VIEWED_NOTE\",\n EventTypeId == 88, \"USER_EDITED_NOTE\",\n EventTypeId == 89, \"USER_DELETED_NOTE\",\n EventTypeId == 90, \"USER_UNAUTHORIZED_APP_ACCESS\",\n EventTypeId == 91, \"USER_UNDETERMINED_BY_RADIUS\",\n EventTypeId == 92, \"USER_NTHASH_REQUESTED_BY_RADIUS\",\n EventTypeId == 95, \"DIRECTORY_GROUPS_WRITE_BACK_IMPORT_STARTED\",\n EventTypeId == 96, \"DIRECTORY_GROUPS_WRITE_BACK_IMPORT_FINISHED\",\n EventTypeId == 100, \"SELF_REGISTRATION_REQUEST\",\n EventTypeId == 101, \"SELF_REGISTRATION_APPROVED\",\n EventTypeId == 102, \"SELF_REGISTRATION_DENIED\",\n EventTypeId == 103, \"SELF_REGISTRATION_REQUEST_UNVERIFIED\",\n EventTypeId == 104, \"SELF_REGISTRATION_REQUEST_VERIFIED\",\n EventTypeId == 105, \"SMS_FAILURE\",\n EventTypeId == 106, \"USER_CHANGE_PASSWORD_FAILED\",\n EventTypeId == 110, \"APP_LOGINS_UPDATED\",\n EventTypeId == 111, \"APP_LOGINS_UPDATE_FAILED\",\n EventTypeId == 112, \"TRUSTED_IDP_MADE_DEFAULT\",\n EventTypeId == 113, \"DIRECTORY_IMPORT_STARTED\",\n EventTypeId == 114, \"DIRECTORY_IMPORT_FINISHED\",\n EventTypeId == 115, \"USER_INVITED\",\n EventTypeId == 116, \"CREATE_USER_FAILED\",\n EventTypeId == 117, \"DIRECTORY_SYNC_RUN_ID\",\n EventTypeId == 118, \"SAML_ACS_FAILED\",\n EventTypeId == 119, \"TRUSTED_IDP_REMOVED_AS_DEFAULT\",\n EventTypeId == 120, \"UNLOCKED_USER_IN_DIRECTORY\",\n EventTypeId == 121, \"SCRIPTLET_ERROR\",\n EventTypeId == 122, \"USER_AUTHENTICATED_BY_API\",\n EventTypeId == 123, \"USER_REJECTED_BY_API\",\n EventTypeId == 124, \"ENTITLEMENTS_CACHE_ACTION\",\n EventTypeId == 125, \"ENTITLEMENT_ACTION\",\n EventTypeId == 126, \"DIRECTORY_CONNECTOR_ENABLED\",\n EventTypeId == 127, \"DIRECTORY_CONNECTOR_DISABLED\",\n EventTypeId == 128, \"NO_ACTIVE_ACTIVE_DIRECTORY_CONNECTORS\",\n EventTypeId == 129, \"VLDAP_BIND_FAILURE\",\n EventTypeId == 130, \"VLDAP_BIND_SUCCESS\",\n EventTypeId == 131, \"DIRECTORY_EXPORT_STARTED\",\n EventTypeId == 132, \"DIRECTORY_EXPORT_FINISHED\",\n EventTypeId == 133, \"DIRECTORY_EXPORT_EXCEPTION\",\n EventTypeId == 134, \"DIRECTORY_REFRESH_SCHEMA_EXCEPTION\",\n EventTypeId == 135, \"CERTIFICATE_EXPIRES\",\n EventTypeId == 136, \"DIRECTORY_FIELDS_IMPORT_STARTED\",\n EventTypeId == 137, \"USER_APP_REQUEST_APPROVED\",\n EventTypeId == 138, \"USER_APP_REQUEST_DENIED\",\n EventTypeId == 139, \"DIRECTORY_FIELDS_IMPORT_FINISHED\",\n EventTypeId == 140, \"SOCIAL_SIGN_IN\",\n EventTypeId == 141, \"SOCIAL_SIGN_IN_FAILURE\",\n EventTypeId == 145, \"USER_SMART_PASSWORD_UPDATED\",\n EventTypeId == 146, \"USER_SMART_PASSWORD_UPDATE_FAILED\",\n EventTypeId == 147, \"USER_MANUALLY_ADDED_TO_ROLE\",\n EventTypeId == 148, \"USER_MANUALLY_REMOVED_FROM_ROLE\",\n EventTypeId == 149, \"USER_AUTO_ADDED_TO_ROLE\",\n EventTypeId == 150, \"USER_AUTO_REMOVED_FROM_ROLE\",\n EventTypeId == 151, \"USER_ROLE_MANAGEMENT_GRANTED\",\n EventTypeId == 152, \"USER_ROLE_MANAGEMENT_REVOKED\",\n EventTypeId == 153, \"MAC_LOGIN_SUCCESS\",\n EventTypeId == 154, \"MAC_LOGIN_FAILURE\",\n EventTypeId == 155, \"DIRECTORY_FIELDS_IMPORT_EXCEPTION\",\n EventTypeId == 156, \"POLICY_CREATED\",\n EventTypeId == 157, \"POLICY_UPDATED\",\n EventTypeId == 158, \"POLICY_DELETED\",\n EventTypeId == 159, \"PROXY_AGENT_CREATED\",\n EventTypeId == 160, \"PROXY_AGENT_DELETED\",\n EventTypeId == 161, \"RADIUS_CONFIG_CREATED\",\n EventTypeId == 162, \"RADIUS_CONFIG_UPDATED\",\n EventTypeId == 163, \"RADIUS_CONFIG_DELETED\",\n EventTypeId == 164, \"VPN_ENABLED\",\n EventTypeId == 165, \"VPN_SETTINGS_UPDATED\",\n EventTypeId == 166, \"VPN_DISABLED\",\n EventTypeId == 167, \"EMBEDDING_ENABLED\",\n EventTypeId == 168, \"EMBEDDING_SETTINGS_UPDATED\",\n EventTypeId == 169, \"EMBEDDING_DISABLED\",\n EventTypeId == 170, \"AUTHENTICATION_FACTOR_CREATED\",\n EventTypeId == 171, \"AUTHENTICATION_FACTOR_UPDATED\",\n EventTypeId == 172, \"AUTHENTICATION_FACTOR_DELETED\",\n EventTypeId == 173, \"SECURITY_QUESTIONS_UPDATED\",\n EventTypeId == 174, \"DESKTOP_SSO_SETTINGS_UPDATED\",\n EventTypeId == 175, \"DESKTOP_SSO_ENABLED\",\n EventTypeId == 176, \"DESKTOP_SSO_DISABLED\",\n EventTypeId == 177, \"CERTIFICATE_CREATED\",\n EventTypeId == 178, \"CERTIFICATE_DELETED\",\n EventTypeId == 179, \"API_CREDENTIAL_CREATED\",\n EventTypeId == 180, \"API_CREDENTIAL_DELETED\",\n EventTypeId == 181, \"API_CREDENTIAL_ENABLED\",\n EventTypeId == 182, \"API_CREDENTIAL_DISABLED\",\n EventTypeId == 183, \"VLDAP_ENABLED\",\n EventTypeId == 184, \"VLDAP_DISABLED\",\n EventTypeId == 185, \"VLDAP_SETTINGS_UPDATED\",\n EventTypeId == 186, \"BRANDING_ENABLED\",\n EventTypeId == 187, \"BRANDING_DISABLED\",\n EventTypeId == 188, \"BRANDING_UPDATED\",\n EventTypeId == 189, \"MAPPING_ADDED\",\n EventTypeId == 190, \"MAPPING_DELETED\",\n EventTypeId == 191, \"MAPPING_DISABLED\",\n EventTypeId == 192, \"MAPPING_ENABLED\",\n EventTypeId == 193, \"MAPPING_UPDATED\",\n EventTypeId == 194, \"USER_FIELD_ADDED\",\n EventTypeId == 195, \"USER_FIELD_DELETED\",\n EventTypeId == 196, \"COMPANY_INFO_UPDATED\",\n EventTypeId == 197, \"ACCOUNT_SETTINGS_UPDATED\",\n EventTypeId == 198, \"DIRECTORY_CREATED\",\n EventTypeId == 199, \"DIRECTORY_DESTROYED\",\n EventTypeId == 200, \"DIRECTORY_CONNECTOR_INSTANCE_ADDED\",\n EventTypeId == 201, \"DIRECTORY_CONNECTOR_INSTANCE_DELETED\",\n EventTypeId == 202, \"REAPPLIED_MAPPINGS\",\n EventTypeId == 203, \"SELF_REGISTRATION_PROFILE_CREATED\",\n EventTypeId == 204, \"SELF_REGISTRATION_PROFILE_UPDATED\",\n EventTypeId == 205, \"SELF_REGISTRATION_PROFILE_DESTROYED\",\n EventTypeId == 206, \"MANUALLY_ADDED_LOGIN\",\n EventTypeId == 207, \"MANUALLY_REMOVED_LOGIN\",\n EventTypeId == 208, \"RETRIED_PROVISIONING\",\n EventTypeId == 209, \"DIRECTORY_USER_IMPORT_WARNING\",\n EventTypeId == 210, \"LDAP_CONNECTOR_EXCEPTION\",\n EventTypeId == 211, \"ADMIN_CHANGED_USER_PASSWORD\",\n EventTypeId == 212, \"DIRECTORY_LOCKED\",\n EventTypeId == 213, \"PROFILE_PICTURE_UPLOADED\",\n EventTypeId == 214, \"PROFILE_PICTURE_DELETED\",\n EventTypeId == 215, \"ADMIN_CHANGED_ACCOUNT_SETTINGS\",\n EventTypeId == 216, \"JOB_IN_QUEUE\",\n EventTypeId == 217, \"DIRECTORY_IMPORT_LIMIT_REACHED\",\n EventTypeId == 218, \"REAPPLIED_MAPPINGS_FAILED\",\n EventTypeId == 219, \"WORKDAY_REAL_TIME_NOTIFICATION\",\n EventTypeId == 220, \"ADMIN_CREATED_PAYMENT_RECORD\",\n EventTypeId == 221, \"ADMIN_UPDATED_PAYMENT_RECORD\",\n EventTypeId == 222, \"ADMIN_DELETED_PAYMENT_RECORD\",\n EventTypeId == 223, \"USER_UNLICENSED\",\n EventTypeId == 224, \"USER_LICENSED_MANUALLY\",\n EventTypeId == 225, \"USER_UNLICENSED_MANUALLY\",\n EventTypeId == 226, \"USER_UNLICENSED_AUTOMATICALLY\",\n EventTypeId == 227, \"USER_LICENSE_FAILED\",\n EventTypeId == 228, \"USERS_LICENSED_BULK\",\n EventTypeId == 229, \"ACCOUNT_NEAR_LIMIT\",\n EventTypeId == 230, \"ACCOUNT_IN_LIMIT\",\n EventTypeId == 231, \"USERS_IN_UNLICENSED_STATE\",\n EventTypeId == 232, \"USER_AGREED_TERMS\",\n EventTypeId == 233, \"USER_DENIED_TERMS\",\n EventTypeId == 234, \"ADMIN_ENABLED_TERMS\",\n EventTypeId == 235, \"ADMIN_UPDATED_TERMS\",\n EventTypeId == 236, \"ADMIN_DISABLED_TERMS\",\n EventTypeId == 237, \"DELETE_USER_FAILED\",\n EventTypeId == 238, \"USER_REDIRECTED_FOR_PASSWORD_CHANGE\",\n EventTypeId == 239, \"IMPORT_USER_FAILED\",\n EventTypeId == 240, \"USER_REVEALED_PASSWORD\",\n EventTypeId == 241, \"CSV_IMPORT_FAILED\",\n EventTypeId == 242, \"JOB_START_FAILED\",\n EventTypeId == 243, \"JOB_TERMINATED\",\n EventTypeId == 244, \"REPORT_GENERATED\",\n EventTypeId == 245, \"REPORT_GENERATION_FAILED\",\n EventTypeId == 246, \"REPORT_GENERATION_TERMINATED\",\n EventTypeId == 247, \"USER_MAPPINGS_FAILED\",\n EventTypeId == 248, \"USER_MAPPINGS_SUCCEEDED\",\n EventTypeId == 249, \"USER_BULK_OPERATION_FAILED\",\n EventTypeId == 250, \"PROVISIONING_APP_CONFIG_ERROR\",\n EventTypeId == 251, \"PROVISIONING_APP_THROTTLED\",\n EventTypeId == 252, \"USER_REMOVELOGINS_FAILED\",\n EventTypeId == 253, \"ENTITLEMENT_MAPPINGS_FAILED\",\n EventTypeId == 254, \"ENTITLEMENT_MAPPINGS_REAPPLIED\",\n EventTypeId == 255, \"MANUALLY_UPDATED_LOGIN\",\n EventTypeId == 291, \"USER_CREATED_BY_TIDP\",\n EventTypeId == 300, \"LDAP_CONNECTOR_STARTED\",\n EventTypeId == 301, \"LDAP_CONNECTOR_NOTIFICATION\",\n EventTypeId == 303, \"LDAP_CONNECTOR_CONFIG_RELOAD\",\n EventTypeId == 304, \"LDAP_CONNECTOR_STOPPED\",\n EventTypeId == 305, \"LDAP_CONNECTOR_FAIL_OVER\",\n EventTypeId == 306, \"MANUALLY_ADDED_LOGIN_FAILURE\",\n EventTypeId == 307, \"LDAP_CONNECTOR_PROVISIONING_ERROR\",\n EventTypeId == 330, \"USER_DISASSOCIATED_FROM_DIRECTORY\",\n EventTypeId == 331, \"USER_ASSOCIATED_TO_DIRECTORY\",\n EventTypeId == 332, \"USER_DIRECTORY_EXTERNAL_ID_UPDATED\",\n EventTypeId == 333, \"USER_DIRECTORY_EXTERNAL_ID_DELETED\",\n EventTypeId == 334, \"USER_NOT_UPDATED_IN_APP\",\n EventTypeId == 400, \"API_BAD_REQUEST\",\n EventTypeId == 401, \"API_UNAUTHORIZED\",\n EventTypeId == 402, \"MAPPING_SKIPPED\",\n EventTypeId == 410, \"BROADCASTER_CREATED\",\n EventTypeId == 411, \"BROADCASTER_UPDATED\",\n EventTypeId == 412, \"BROADCASTER_DELETED\",\n EventTypeId == 501, \"API_INDEX_ACTION\",\n EventTypeId == 502, \"API_SHOW_ACTION\",\n EventTypeId == 503, \"API_RES_ACTION\",\n EventTypeId == 510, \"API_SET_PWD_SALT\",\n EventTypeId == 511, \"API_SET_PWD_CLEAR_TEXT\",\n EventTypeId == 512, \"API_SET_CUSTOM_ATTRS\",\n EventTypeId == 513, \"API_ADD_ROLES\",\n EventTypeId == 514, \"API_REMOVE_ROLES\",\n EventTypeId == 515, \"API_AUTH_ISSUE_TOKEN\",\n EventTypeId == 516, \"API_LOGOUT\",\n EventTypeId == 517, \"API_SET_PWD_SALT_FAILED\",\n EventTypeId == 518, \"API_SET_PWD_CLEAR_TEXT_FAILED\",\n EventTypeId == 519, \"API_SET_CUSTOM_ATTRS_FAILED\",\n EventTypeId == 520, \"API_ADD_ROLES_FAILED\",\n EventTypeId == 521, \"API_REMOVE_ROLES_FAILED\",\n EventTypeId == 522, \"API_AUTH_ISSUE_TOKEN_FAILED\",\n EventTypeId == 523, \"API_LOGOUT_FAILED\",\n EventTypeId == 524, \"API_DESTROY_USER_FAILED\",\n EventTypeId == 525, \"API_GET_INVITE_LINK_FAILED\",\n EventTypeId == 526, \"API_LOCK_USER_FAILED\",\n EventTypeId == 527, \"API_VERIFY_FACTOR_FAILED\",\n EventTypeId == 528, \"API_VERIFY_FACTOR\",\n EventTypeId == 529, \"API_UPDATE_USER\",\n EventTypeId == 530, \"API_DESTROY_USER\",\n EventTypeId == 531, \"API_LOCK_USER\",\n EventTypeId == 532, \"API_UPDATE_USER_FAILED\",\n EventTypeId == 533, \"API_CREATE_USER\",\n EventTypeId == 534, \"API_CREATE_USER_FAILED\",\n EventTypeId == 535, \"API_GET_INVITE_LINK\",\n EventTypeId == 536, \"API_USER_OTPS_RETRIEVED\",\n EventTypeId == 537, \"API_CONFIRM_FACTOR\",\n EventTypeId == 538, \"API_CONFIRM_FACTOR_FAILED\",\n EventTypeId == 539, \"API_TRIGGER_FACTOR\",\n EventTypeId == 540, \"API_ADDED_OTP_DEVICE\",\n EventTypeId == 541, \"DIRECTORY_UPDATED\",\n EventTypeId == 542, \"DIRECTORY_OUS_CHANGED\",\n EventTypeId == 545, \"API_SEND_INVITE_LINK_FAILED\",\n EventTypeId == 546, \"API_SEND_INVITE_LINK\",\n EventTypeId == 550, \"FORCE_LOGOUT_USER\",\n EventTypeId == 551, \"SUSPENDED_USER_VIA_API\",\n EventTypeId == 552, \"REACTIVATED_USER_VIA_API\",\n EventTypeId == 553, \"USER_LOCKED_VIA_API\",\n EventTypeId == 554, \"UNLOCKED_USER_VIA_API\",\n EventTypeId == 555, \"EXTERNAL_ASSUME_USER\",\n EventTypeId == 600, \"APP_CREATED_BY_USER\",\n EventTypeId == 601, \"APP_UPDATED_BY_USER\",\n EventTypeId == 602, \"APP_DELETED_BY_USER\",\n EventTypeId == 700, \"CONNECTOR_CREATED\",\n EventTypeId == 701, \"CONNECTOR_CREATE_FAILED\",\n EventTypeId == 702, \"CONNECTOR_UPDATED\",\n EventTypeId == 703, \"CONNECTOR_UPDATE_FAILED\",\n EventTypeId == 704, \"CONNECTOR_DELETED\",\n EventTypeId == 705, \"CONNECTOR_DELETE_FAILED\",\n EventTypeId == 706, \"CONNECTOR_STATS_UPDATE\",\n EventTypeId == 800, \"PARAMETER_CREATED\",\n EventTypeId == 801, \"PARAMETER_CREATE_FAILED\",\n EventTypeId == 802, \"PARAMETER_UPDATED\",\n EventTypeId == 803, \"PARAMETER_UPDATE_FAILED\",\n EventTypeId == 804, \"PARAMETER_DELETED\",\n EventTypeId == 805, \"PARAMETER_DELETE_FAILED\",\n EventTypeId == 900, \"ONELOGIN_DESKTOP_MAC_LOGIN_SUCCESS\",\n EventTypeId == 901, \"ONELOGIN_DESKTOP_MAC_LOGIN_FAILURE\",\n EventTypeId == 902, \"ONELOGIN_DESKTOP_DEVICE_DELETED\",\n EventTypeId == 903, \"ONELOGIN_DESKTOP_DEVICE_UNBIND\",\n EventTypeId == 904, \"ONELOGIN_DESKTOP_LOGIN_SUCCESS\",\n EventTypeId == 905, \"ONELOGIN_DESKTOP_LOGIN_FAILURE\",\n EventTypeId == 906, \"ONELOGIN_DESKTOP_USER_FAILED_ONELOGIN_LOGIN\",\n EventTypeId == 907, \"DIRECTORY_EXPORT_SUCCESS\",\n EventTypeId == 911, \"ONELOGIN_DESKTOP_REVOKE_CERT_FOR_USER\",\n EventTypeId == 912, \"ONELOGIN_DESKTOP_REVOKE_CERT_FOR_DEVICE\",\n EventTypeId == 931, \"ADAPTIVE_LOGIN_ENABLED\",\n EventTypeId == 932, \"ADAPTIVE_LOGIN_DISABLED\",\n EventTypeId == 950, \"OL_OTP_PUSH_REJECT\",\n EventTypeId == 1001, \"USER_LOGIN_CHALLENGE\",\n EventTypeId == 1002, \"USER_LOGIN_CHALLENGE_FAILED\",\n EventTypeId == 1010, \"USER_REAUTH_SUCCESS\",\n EventTypeId == 1100, \"TEMP_OTP_TOKEN_GENERATED\",\n EventTypeId == 1101, \"TEMP_OTP_TOKEN_REVOKED\",\n EventTypeId == 1200, \"DELEGATED_APP_PRIVILEGE_DENIED\",\n EventTypeId == 1201, \"DELEGATED_USER_PRIVILEGE_DENIED\",\n EventTypeId == 1244, \"USER_ADDED_PHONE_NUMBER\",\n EventTypeId == 1245, \"USER_UPDATED_PHONE_NUMBER\",\n EventTypeId == 1300, \"API_APP_CREATED\",\n EventTypeId == 1301, \"API_APP_CREATE_FAILED\",\n EventTypeId == 1302, \"API_APP_UPDATED\",\n EventTypeId == 1303, \"API_APP_UPDATE_FAILED\",\n EventTypeId == 1304, \"API_APP_DESTROYED\",\n EventTypeId == 1305, \"API_APP_DESTROY_FAILED\",\n EventTypeId == 1400, \"USER_VERIFIED_OTP_DEVICE\",\n EventTypeId == 1401, \"API_AUTH_APP_CREATE_FAILED\",\n EventTypeId == 1402, \"API_AUTH_APP_UPDATED\",\n EventTypeId == 1403, \"API_AUTH_APP_UPDATE_FAILED\",\n EventTypeId == 1404, \"API_AUTH_APP_DESTROYED\",\n EventTypeId == 1405, \"API_AUTH_APP_DESTROY_FAILED\",\n EventTypeId == 1406, \"API_AUTH_SCOPE_CREATED\",\n EventTypeId == 1407, \"API_AUTH_SCOPE_CREATE_FAILED\",\n EventTypeId == 1408, \"API_AUTH_SCOPE_UPDATED\",\n EventTypeId == 1409, \"API_AUTH_SCOPE_UPDATE_FAILED\",\n EventTypeId == 1410, \"API_AUTH_SCOPE_DESTROYED\",\n EventTypeId == 1411, \"API_AUTH_SCOPE_DESTROY_FAILED\",\n EventTypeId == 1412, \"API_AUTH_CLAIM_CREATED\",\n EventTypeId == 1413, \"API_AUTH_CLAIM_CREATE_FAILED\",\n EventTypeId == 1414, \"API_AUTH_CLAIM_UPDATED\",\n EventTypeId == 1415, \"API_AUTH_CLAIM_UPDATE_FAILED\",\n EventTypeId == 1416, \"API_AUTH_CLAIM_DESTROYED\",\n EventTypeId == 1417, \"API_AUTH_CLAIM_DESTROY_FAILED\",\n EventTypeId == 1418, \"API_AUTH_CLIENT_CREATED\",\n EventTypeId == 1419, \"API_AUTH_CLIENT_CREATE_FAILED\",\n EventTypeId == 1420, \"API_AUTH_CLIENT_UPDATED\",\n EventTypeId == 1421, \"API_AUTH_CLIENT_UPDATE_FAILED\",\n EventTypeId == 1422, \"API_AUTH_CLIENT_DESTROYED\",\n EventTypeId == 1423, \"API_AUTH_CLIENT_DESTROY_FAILED\",\n EventTypeId == 1424, \"API_AUTH_APP_CREATED\",\n EventTypeId == 1500, \"SANDBOX_SYNC_STARTED\",\n EventTypeId == 1501, \"SANDBOX_SYNC_FAILED\",\n EventTypeId == 1502, \"SANDBOX_SYNCED\",\n EventTypeId == 1503, \"SANDBOX_DELETED\",\n EventTypeId == 1504, \"SANDBOX_DELETE_FAILED\",\n EventTypeId == 1505, \"SANDBOX_CREATED\",\n EventTypeId == 1506, \"SANDBOX_CREATION_FAILED\",\n EventTypeId == 1507, \"SANDBOX_UPDATED\",\n EventTypeId == 1508, \"SANDBOX_UPDATE_FAILED\",\n EventTypeId == 1509, \"SANDBOX_DELETED_BY_API\",\n EventTypeId == 1510, \"SANDBOX_DELETE_FAILED_BY_API\",\n EventTypeId == 1511, \"SANDBOX_CREATED_BY_API\",\n EventTypeId == 1512, \"SANDBOX_CREATION_FAILED_BY_API\",\n EventTypeId == 1513, \"SANDBOX_UPDATED_BY_API\",\n EventTypeId == 1514, \"SANDBOX_UPDATE_FAILED_BY_API\",\n EventTypeId == 1600, \"PROFILE_DEVICES_DELETE_DEVICE\",\n EventTypeId == 1601, \"PROFILE_DEVICES_RENAME_DEVICE\",\n EventTypeId == 1602, \"PROFILE_DEVICES_UPDATE_DEFAULT\",\n EventTypeId == 1603, \"PROFILE_SETTINGS_UPDATE_LOCALE\",\n EventTypeId == 1604, \"PROFILE_SETTINGS_UPDATE_PHONE\",\n EventTypeId == 1605, \"PROFILE_SETTINGS_UPDATE_DEFAULT_TAB\",\n EventTypeId == 1606, \"PROFILE_SETTINGS_UPDATE_PROFILE_PHOTO\",\n EventTypeId == 1607, \"PROFILE_SETTINGS_UPDATE_APP_AUTO_DETECT\",\n EventTypeId == 1608, \"PROFILE_CHANGE_PASSWORD\",\n EventTypeId == 1609, \"PROFILE_SETTINGS_UPDATE_SHOW_TABS\",\n EventTypeId == 1700, \"RADIUS_ATTRIBUTE_CREATED\",\n EventTypeId == 1701, \"RADIUS_ATTRIBUTE_UPDATED\",\n EventTypeId == 1702, \"RADIUS_ATTRIBUTE_DELETED\",\n EventTypeId == 1801, \"ROLE_CREATED\",\n EventTypeId == 1802, \"ROLE_DELETED\",\n EventTypeId == 1900, \"API_BRAND_CREATED\",\n EventTypeId == 1901, \"API_BRAND_CREATE_FAILED\",\n EventTypeId == 1902, \"API_BRAND_UPDATED\",\n EventTypeId == 1903, \"API_BRAND_UPDATE_FAILED\",\n EventTypeId == 1904, \"API_BRAND_DESTROYED\",\n EventTypeId == 1905, \"API_BRAND_DESTROY_FAILED\",\n EventTypeId == 2000, \"HOOKS_LIST_FUNCTION\",\n EventTypeId == 2001, \"CUSTOM_SMTP_ERROR\",\n EventTypeId == 2002, \"SMTP_SETTINGS_UPDATED\",\n EventTypeId == 2003, \"HOOKS_CREATE_FUNCTION\",\n EventTypeId == 2004, \"HOOKS_CREATE_FUNCTION_FAILED\",\n EventTypeId == 2005, \"HOOKS_GET_FUNCTION\",\n EventTypeId == 2006, \"HOOKS_GET_FUNCTION_LOGS\",\n EventTypeId == 2007, \"HOOKS_UPDATE_FUNCTION\",\n EventTypeId == 2008, \"HOOKS_UPDATE_FUNCTION_FAILED\",\n EventTypeId == 2009, \"HOOKS_DELETE_FUNCTION\",\n EventTypeId == 2010, \"HOOKS_DELETE_FUNCTION_FAILED\",\n EventTypeId == 2011, \"HOOKS_LIST_ENVVAR\",\n EventTypeId == 2012, \"HOOKS_CREATE_ENVVAR\",\n EventTypeId == 2013, \"HOOKS_CREATE_ENVVAR_FAILED\",\n EventTypeId == 2014, \"HOOKS_GET_ENVVAR\",\n EventTypeId == 2015, \"HOOKS_UPDATE_ENVVAR\",\n EventTypeId == 2016, \"HOOKS_UPDATE_ENVVAR_FAILED\",\n EventTypeId == 2017, \"HOOKS_DELETE_ENVVAR\",\n EventTypeId == 2018, \"HOOKS_DELETE_ENVVAR_FAILED\",\n EventTypeId == 2100, \"DELEGATED_PRIVILEGE_CREATED_VIA_API\",\n EventTypeId == 2101, \"DELEGATED_PRIVILEGE_CREATED_BY_USER\",\n EventTypeId == 2102, \"DELEGATED_PRIVILEGE_UPDATED_VIA_API\",\n EventTypeId == 2103, \"DELEGATED_PRIVILEGE_UPDATED_BY_USER\",\n EventTypeId == 2104, \"DELEGATED_PRIVILEGE_DELETED_VIA_API\",\n EventTypeId == 2105, \"DELEGATED_PRIVILEGE_DELETED_BY_USER\",\n EventTypeId == 2106, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_VIA_API\",\n EventTypeId == 2107, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_BY_USER\",\n EventTypeId == 2108, \"DELEGATED_PRIVILEGE_REMOVED_FROM_USER_VIA_API\",\n EventTypeId == 2109, \"DELEGATED_PRIVILEGE_REMOVED_FROM_USER_BY_USER\",\n EventTypeId == 2110, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_VIA_API\",\n EventTypeId == 2111, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_BY_USER\",\n EventTypeId == 2112, \"DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_VIA_API\",\n EventTypeId == 2113, \"DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_BY_USER\",\n EventTypeId == 2114, \"DELEGATED_ROLE_PRIVILEGE_DENIED\",\n EventTypeId == 2201, \"REPORT_CREATED_BY_USER\",\n EventTypeId == 2202, \"REPORT_UPDATED_BY_USER\",\n EventTypeId == 2203, \"REPORT_CLONED_BY_USER\",\n EventTypeId == 2204, \"REPORT_DESTROYED_BY_USER\",\n EventTypeId == 3000, \"OIDC_GENERAL_FAIL\",\n EventTypeId == 3001, \"OIDC_IMPLICIT_FLOW_SUCCESS\",\n EventTypeId == 3002, \"OIDC_IMPLICIT_FLOW_FAILED\",\n EventTypeId == 3003, \"OIDC_GET_CODE_SUCCESS\",\n EventTypeId == 3004, \"OIDC_GET_CODE_FAILED\",\n EventTypeId == 3005, \"OIDC_AUTHORIZATION_CODE_SUCCESS\",\n EventTypeId == 3006, \"OIDC_AUTHORIZATION_CODE_FAILED\",\n EventTypeId == 3007, \"OIDC_CLIENT_CREDENTIALS_SUCCESS\",\n EventTypeId == 3008, \"OIDC_CLIENT_CREDENTIALS_FAILED\",\n EventTypeId == 3009, \"OIDC_PASSWORD_SUCCESS\",\n EventTypeId == 3010, \"OIDC_PASSWORD_FAILED\",\n EventTypeId == 3011, \"OIDC_REFRESH_TOKEN_SUCCESS\",\n EventTypeId == 3012, \"OIDC_REFRESH_TOKEN_FAILED\",\n EventTypeId == 3013, \"OIDC_VALIDATE_TOKEN_SUCCESS\",\n EventTypeId == 3014, \"OIDC_VALIDATE_TOKEN_FAILED\",\n EventTypeId == 3015, \"OIDC_REVOKE_TOKEN_SUCCESS\",\n EventTypeId == 3016, \"OIDC_REVOKE_TOKEN_FAILED\",\n EventTypeId == 3017, \"OIDC_USER_INFO_SUCCESS\",\n EventTypeId == 3018, \"OIDC_USER_INFO_FAILED\",\n EventTypeId == 3019, \"NOTIFICATION_WAS_SENT\",\n EventTypeId == 3020, \"GROUP_CREATED\",\n EventTypeId == 3021, \"GROUP_UPDATED\",\n EventTypeId == 3022, \"GROUP_DESTROYED\",\n EventTypeId == 3023, \"USER_CREATED_NOTE\",\n EventTypeId == 3024, \"DELEGATED_GROUP_PRIVILEGE_DENIED\",\n EventTypeId == 3025, \"DELEGATED_POLICY_PRIVILEGE_DENIED\",\n EventTypeId == 3026, \"PROFILE_DEVICES_UNSET_DEFAULT\",\n EventTypeId == 3027, \"DELEGATED_REPORT_PRIVILEGE_DENIED\",\n EventTypeId == 9000, \"USER_ENABLED_WORKFLOW\",\n EventTypeId == 9001, \"USER_DISABLED_WORKFLOW\",\n EventTypeId == 9002, \"USER_INITIATED_WORKFLOW\",\n EventTypeId == 9003, \"USER_COMPLETED_TASK\",\n EventTypeId == 9004, \"USER_MARKED_TASK_COMPLETE\",\n EventTypeId == 9005, \"USER_MARKED_WORKFLOW_COMPLETE\",\n EventTypeId == 9006, \"USER_MARKED_TASK_INCOMPLETE\",\n EventTypeId == 9007, \"USER_ENABLED_ONBOARDING\",\n EventTypeId == 9008, \"USER_DISABLED_ONBOARDING\",\n EventTypeId == 9009, \"USER_ENABLED_OFFBOARDING\",\n EventTypeId == 9010, \"USER_DISABLED_OFFBOARDING\",\n EventTypeId == 9011, \"USER_INITIATED_OFFBOARDING\",\n EventTypeId == 9012, \"USER_INITIATED_ONBOARDING\",\n EventTypeId == 9013, \"USER_COMPLETED_WORKFLOW\",\n EventTypeId == 9014, \"APP_RULES_LIST_SUCCESS\",\n EventTypeId == 9015, \"APP_RULES_LIST_FAILED\",\n EventTypeId == 9016, \"APP_RULES_CREATE_SUCCESS\",\n EventTypeId == 9017, \"APP_RULES_CREATE_FAILED\",\n EventTypeId == 9018, \"APP_RULES_UPDATE_SUCCESS\",\n EventTypeId == 9019, \"APP_RULES_UPDATE_FAILED\",\n EventTypeId == 9020, \"APP_RULES_GET_SUCCESS\",\n EventTypeId == 9021, \"APP_RULES_GET_FAILED\",\n EventTypeId == 9022, \"APP_RULES_DRYRUN_SUCCESS\",\n EventTypeId == 9023, \"APP_RULES_DRYRUN_FAILED\",\n EventTypeId == 9024, \"APP_RULES_DELETE_SUCCESS\",\n EventTypeId == 9025, \"APP_RULES_DELETE_FAILED\",\n EventTypeId == 9026, \"APP_RULES_SORT_SUCCESS\",\n EventTypeId == 9027, \"APP_RULES_SORT_FAILED\",\n EventTypeId == 9028, \"APP_RULES_APPLY_SUCCESS\",\n EventTypeId == 9029, \"APP_RULES_APPLY_FAILED\",\n EventTypeId == 9030, \"APP_RULES_REFRESH_ENTITLEMENTS_SUCCESS\",\n EventTypeId == 9031, \"APP_RULES_REFRESH_ENTITLEMENTS_FAILED\",\n EventTypeId == 9032, \"APP_RULES_LIST_CONDITIONS_SUCCESS\",\n EventTypeId == 9033, \"APP_RULES_LIST_CONDITIONS_FAILED\",\n EventTypeId == 9034, \"APP_RULES_LIST_CONDITION_OPERATORS_SUCCESS\",\n EventTypeId == 9035, \"APP_RULES_LIST_CONDITION_OPERATORS_FAILED\",\n EventTypeId == 9036, \"APP_RULES_LIST_ACTIONS_SUCCESS\",\n EventTypeId == 9037, \"APP_RULES_LIST_ACTIONS_FAILED\",\n EventTypeId == 9038, \"APP_RULES_LIST_ACTION_VALUES_SUCCESS\",\n EventTypeId == 9039, \"APP_RULES_LIST_ACTION_VALUES_FAILED\",\n EventTypeId == 9040, \"USER_ROLE_MANAGEMENT_GRANTED_FAILED\",\n EventTypeId == 9041, \"USER_ROLE_MANAGEMENT_REVOKED_FAILED\",\n EventTypeId == 9042, \"APP_ADDED_TO_ROLE_FAILED\",\n EventTypeId == 9043, \"APP_REMOVED_FROM_ROLE_FAILED\",\n EventTypeId == 9044, \"USER_MANUALLY_ADDED_TO_ROLE_FAILED\",\n EventTypeId == 9045, \"USER_MANUALLY_REMOVED_FROM_ROLE_FAILED\",\n EventTypeId == 9046, \"ROLE_CREATE_FAILED\",\n EventTypeId == 9047, \"ROLE_DELETE_FAILED\",\n EventTypeId == 9048, \"ROLE_LIST_SUCCESS\",\n EventTypeId == 9049, \"ROLE_LIST_FAILED\",\n EventTypeId == 9050, \"ROLE_GET_SUCCESS\",\n EventTypeId == 9051, \"ROLE_GET_FAILED\",\n EventTypeId == 9052, \"ROLE_UPDATE_SUCCESS\",\n EventTypeId == 9053, \"ROLE_UPDATE_FAILED\",\n EventTypeId == 9054, \"ROLE_LIST_APPS_SUCCESS\",\n EventTypeId == 9055, \"ROLE_LIST_APPS_FAILED\",\n EventTypeId == 9056, \"ROLE_LIST_USERS_SUCCESS\",\n EventTypeId == 9057, \"ROLE_LIST_USERS_FAILED\",\n EventTypeId == 9058, \"ROLE_LIST_ADMINISTRATORS_SUCCESS\",\n EventTypeId == 9059, \"ROLE_LIST_ADMINISTRATORS_FAILED\",\n \"\"\n )\n", + "functionParameters": "", + "version": 2, "tags": [ { "name": "description", - "value": "OneLogin" + "value": "" } ] } @@ -487,7 +511,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", "dependsOn": [ - "[variables('_parserName1')]" + "[variables('_parserId1')]" ], "properties": { "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", @@ -495,7 +519,7 @@ "kind": "Parser", "version": "[variables('parserVersion1')]", "source": { - "name": "OneLogin IAM", + "name": "OneLoginIAM", "kind": "Solution", "sourceId": "[variables('_solutionId')]" }, @@ -512,7 +536,18 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_parserContentId1')]", + "contentKind": "Parser", + "displayName": "OneLogin", + "contentProductId": "[variables('_parsercontentProductId1')]", + "id": "[variables('_parsercontentProductId1')]", + "version": "[variables('parserVersion1')]" } }, { @@ -523,10 +558,17 @@ "properties": { "eTag": "*", "displayName": "OneLogin", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "OneLogin", - "query": "\nOneLogin_CL\r\n| project-rename TargetAppName = app_name_s,\r\n TargetAppId = app_id_d,\r\n RoleName = role_name_s,\r\n RoleId = role_id_d,\r\n PolicyName = policy_name_s,\r\n PolicyType = policy_type_s,\r\n PolicyId = policy_id_d,\r\n HttpUserAgent = user_agent_s,\r\n UserId = user_id_d,\r\n UserAttributesUsername_s = user_attributes_username_s,\r\n UserAttributesAccountId = user_attributes_account_id_d,\r\n UserAttributesDepartment = user_attributes_department_s,\r\n UserAttributesFirstname = user_attributes_firstname_s,\r\n UserAttributesEmail = user_attributes_email_s,\r\n UserAttributesOpenidName = user_attributes_openid_name_s,\r\n UserAttributesTitle = user_attributes_title_s,\r\n UserAttributesLastname = user_attributes_lastname_s,\r\n UserName = user_name_s,\r\n EventOriginalUid = create__id_g,\r\n UUID = uuid_g,\r\n ActorSystem = actor_system_s,\r\n CustomMessage = custom_message_s,\r\n AccountId = account_id_d,\r\n SrcIpAddr = ipaddr_s,\r\n ActorUserName = actor_user_name_s,\r\n ActorUserId = actor_user_id_d,\r\n Message = notes_s,\r\n EventTypeId = event_type_id_d,\r\n EventStartTime = event_timestamp_s\r\n| extend EventVendor = \"OneLogin\",\r\n EventProduct = \"OneLogin IAM\",\r\n EventType = case (\r\n EventTypeId == 1, \"APP_ADDED_TO_ROLE\",\r\n EventTypeId == 2, \"APP_REMOVED_FROM_ROLE\",\r\n EventTypeId == 3, \"USER_ASSUMED_USER\",\r\n EventTypeId == 4, \"USER_ASSIGNED_ROLE\",\r\n EventTypeId == 5, \"USER_LOGGED_INTO_ONELOGIN\",\r\n EventTypeId == 6, \"USER_FAILED_ONELOGIN_LOGIN\",\r\n EventTypeId == 7, \"USER_LOGGED_OUT_OF_ONELOGIN\",\r\n EventTypeId == 8, \"USER_LOGGED_INTO_APP\",\r\n EventTypeId == 9, \"USER_FAILED_APP_LOGIN\",\r\n EventTypeId == 10, \"USER_REQUESTED_NEW_PASSWORD\",\r\n EventTypeId == 11, \"USER_CHANGED_PASSWORD\",\r\n EventTypeId == 12, \"UNLOCKED_USER\",\r\n EventTypeId == 13, \"CREATED_USER\",\r\n EventTypeId == 14, \"UPDATED_USER\",\r\n EventTypeId == 15, \"DEACTIVATED_USER\",\r\n EventTypeId == 16, \"ACTIVATED_USER\",\r\n EventTypeId == 17, \"DELETED_USER\",\r\n EventTypeId == 18, \"ADMIN_APPROVED_PASSWORD_REQUEST\",\r\n EventTypeId == 19, \"USER_LOCKED\",\r\n EventTypeId == 20, \"REACHED_USERS_LIMIT\",\r\n EventTypeId == 21, \"SUSPENDED_USER\",\r\n EventTypeId == 22, \"USER_ADDED_OTP_DEVICE\",\r\n EventTypeId == 23, \"USER_BULK_OPERATION\",\r\n EventTypeId == 24, \"USER_REMOVED_OTP_DEVICE\",\r\n EventTypeId == 25, \"PROVISIONING_EXCEPTION\",\r\n EventTypeId == 26, \"PROVISIONING_EVENT\",\r\n EventTypeId == 27, \"USER_DOWNLOADED_CERT\",\r\n EventTypeId == 28, \"USER_RECENTLY_REMOVED\",\r\n EventTypeId == 29, \"USER_LOGGED_OUT_OF_APP\",\r\n EventTypeId == 30, \"UPDATED_PAYMENT_INFO\",\r\n EventTypeId == 31, \"FAILED_UPDATE_PAYMENT_INFO\",\r\n EventTypeId == 32, \"REACTIVATED_USER\",\r\n EventTypeId == 33, \"USERS_IMPORTED_FROM_DIRECTORY\",\r\n EventTypeId == 34, \"USER_REQUESTED_APP\",\r\n EventTypeId == 35, \"USER_LOCKED_OUT_OF_APP\",\r\n EventTypeId == 36, \"USER_LOST_OTP_DEVICE\",\r\n EventTypeId == 37, \"USER_JOIN_REQUEST\",\r\n EventTypeId == 38, \"APP_REACHED_USER_LIMIT\",\r\n EventTypeId == 39, \"CONNECTOR_BROKEN\",\r\n EventTypeId == 40, \"USER_UNLOCKED_OTP_DEVICE\",\r\n EventTypeId == 41, \"AD_CONNECTOR_STARTED\",\r\n EventTypeId == 42, \"AD_CONNECTOR_STOPPED\",\r\n EventTypeId == 43, \"AD_CONNECTOR_CONFIG_RELOAD\",\r\n EventTypeId == 44, \"AD_CONNECTOR_NOTIFICATION\",\r\n EventTypeId == 45, \"AD_CONNECTOR_EXCEPTION_OLD\",\r\n EventTypeId == 46, \"AD_CONNECTOR_FAIL_OVER\",\r\n EventTypeId == 47, \"AD_CONNECTOR_EXCEPTION\",\r\n EventTypeId == 48, \"IMPORTED_USER\",\r\n EventTypeId == 49, \"UPDATE_USER_FAILED\",\r\n EventTypeId == 50, \"REJECTED_USER\",\r\n EventTypeId == 51, \"USER_CREATED_IN_APP\",\r\n EventTypeId == 52, \"USER_UPDATED_IN_APP\",\r\n EventTypeId == 53, \"USER_SUSPENDED_IN_APP\",\r\n EventTypeId == 54, \"USER_REACTIVATED_IN_APP\",\r\n EventTypeId == 55, \"USER_DELETED_IN_APP\",\r\n EventTypeId == 56, \"UNMATCHED_USERS\",\r\n EventTypeId == 57, \"RABBIT_DOWN\",\r\n EventTypeId == 58, \"RABBIT_RESTARTED\",\r\n EventTypeId == 59, \"USER_LINKED_IN_APP\",\r\n EventTypeId == 60, \"PROVISIONING_DEPROVISIONING_MODE_DO_NOTHING_WARNING\",\r\n EventTypeId == 61, \"USER_FAILED_SUSPENDING_IN_APP\",\r\n EventTypeId == 62, \"USER_FAILED_REACTIVATING_IN_APP\",\r\n EventTypeId == 63, \"USER_FAILED_DELETING_IN_APP\",\r\n EventTypeId == 64, \"USER_FAILED_CREATING_IN_APP\",\r\n EventTypeId == 65, \"USER_FAILED_UPDATING_IN_APP\",\r\n EventTypeId == 66, \"NO_USERS_TO_IMPORT_FROM_DIRECTORY\",\r\n EventTypeId == 67, \"DIRECTORY_IMPORT_EXCEPTION\",\r\n EventTypeId == 68, \"USER_AUTHENTICATED_BY_RADIUS\",\r\n EventTypeId == 69, \"USER_REJECTED_BY_RADIUS\",\r\n EventTypeId == 70, \"PRIVILEGE_GRANTED_TO_ACCOUNT\",\r\n EventTypeId == 71, \"PRIVILEGE_REVOKED_FROM_ACCOUNT\",\r\n EventTypeId == 72, \"PRIVILEGE_GRANTED_TO_USER\",\r\n EventTypeId == 73, \"PRIVILEGE_REVOKED_FROM_USER\",\r\n EventTypeId == 74, \"TRUSTED_IDP_ADDED\",\r\n EventTypeId == 75, \"TRUSTED_IDP_REMOVED\",\r\n EventTypeId == 76, \"TRUSTED_IDP_MODIFIED\",\r\n EventTypeId == 77, \"USER_FAILED_PROXY_LOGIN\",\r\n EventTypeId == 78, \"USER_SUCCEEDED_PROXY_LOGIN\",\r\n EventTypeId == 79, \"AD_CONNECTOR_PROVISIONING_ERROR\",\r\n EventTypeId == 80, \"USER_CREATED_IN_DIRECTORY\",\r\n EventTypeId == 81, \"USER_UPDATED_IN_DIRECTORY\",\r\n EventTypeId == 82, \"USER_SUSPENDED_IN_DIRECTORY\",\r\n EventTypeId == 83, \"USER_REACTIVATED_IN_DIRECTORY\",\r\n EventTypeId == 84, \"USER_DELETED_IN_DIRECTORY\",\r\n EventTypeId == 85, \"APP_COULD_NOT_AUTHENTICATE\",\r\n EventTypeId == 86, \"USER_FAILED_REMOTE_AUTHENTICATION\",\r\n EventTypeId == 87, \"USER_VIEWED_NOTE\",\r\n EventTypeId == 88, \"USER_EDITED_NOTE\",\r\n EventTypeId == 89, \"USER_DELETED_NOTE\",\r\n EventTypeId == 90, \"USER_UNAUTHORIZED_APP_ACCESS\",\r\n EventTypeId == 91, \"USER_UNDETERMINED_BY_RADIUS\",\r\n EventTypeId == 92, \"USER_NTHASH_REQUESTED_BY_RADIUS\",\r\n EventTypeId == 95, \"DIRECTORY_GROUPS_WRITE_BACK_IMPORT_STARTED\",\r\n EventTypeId == 96, \"DIRECTORY_GROUPS_WRITE_BACK_IMPORT_FINISHED\",\r\n EventTypeId == 100, \"SELF_REGISTRATION_REQUEST\",\r\n EventTypeId == 101, \"SELF_REGISTRATION_APPROVED\",\r\n EventTypeId == 102, \"SELF_REGISTRATION_DENIED\",\r\n EventTypeId == 103, \"SELF_REGISTRATION_REQUEST_UNVERIFIED\",\r\n EventTypeId == 104, \"SELF_REGISTRATION_REQUEST_VERIFIED\",\r\n EventTypeId == 105, \"SMS_FAILURE\",\r\n EventTypeId == 106, \"USER_CHANGE_PASSWORD_FAILED\",\r\n EventTypeId == 110, \"APP_LOGINS_UPDATED\",\r\n EventTypeId == 111, \"APP_LOGINS_UPDATE_FAILED\",\r\n EventTypeId == 112, \"TRUSTED_IDP_MADE_DEFAULT\",\r\n EventTypeId == 113, \"DIRECTORY_IMPORT_STARTED\",\r\n EventTypeId == 114, \"DIRECTORY_IMPORT_FINISHED\",\r\n EventTypeId == 115, \"USER_INVITED\",\r\n EventTypeId == 116, \"CREATE_USER_FAILED\",\r\n EventTypeId == 117, \"DIRECTORY_SYNC_RUN_ID\",\r\n EventTypeId == 118, \"SAML_ACS_FAILED\",\r\n EventTypeId == 119, \"TRUSTED_IDP_REMOVED_AS_DEFAULT\",\r\n EventTypeId == 120, \"UNLOCKED_USER_IN_DIRECTORY\",\r\n EventTypeId == 121, \"SCRIPTLET_ERROR\",\r\n EventTypeId == 122, \"USER_AUTHENTICATED_BY_API\",\r\n EventTypeId == 123, \"USER_REJECTED_BY_API\",\r\n EventTypeId == 124, \"ENTITLEMENTS_CACHE_ACTION\",\r\n EventTypeId == 125, \"ENTITLEMENT_ACTION\",\r\n EventTypeId == 126, \"DIRECTORY_CONNECTOR_ENABLED\",\r\n EventTypeId == 127, \"DIRECTORY_CONNECTOR_DISABLED\",\r\n EventTypeId == 128, \"NO_ACTIVE_ACTIVE_DIRECTORY_CONNECTORS\",\r\n EventTypeId == 129, \"VLDAP_BIND_FAILURE\",\r\n EventTypeId == 130, \"VLDAP_BIND_SUCCESS\",\r\n EventTypeId == 131, \"DIRECTORY_EXPORT_STARTED\",\r\n EventTypeId == 132, \"DIRECTORY_EXPORT_FINISHED\",\r\n EventTypeId == 133, \"DIRECTORY_EXPORT_EXCEPTION\",\r\n EventTypeId == 134, \"DIRECTORY_REFRESH_SCHEMA_EXCEPTION\",\r\n EventTypeId == 135, \"CERTIFICATE_EXPIRES\",\r\n EventTypeId == 136, \"DIRECTORY_FIELDS_IMPORT_STARTED\",\r\n EventTypeId == 137, \"USER_APP_REQUEST_APPROVED\",\r\n EventTypeId == 138, \"USER_APP_REQUEST_DENIED\",\r\n EventTypeId == 139, \"DIRECTORY_FIELDS_IMPORT_FINISHED\",\r\n EventTypeId == 140, \"SOCIAL_SIGN_IN\",\r\n EventTypeId == 141, \"SOCIAL_SIGN_IN_FAILURE\",\r\n EventTypeId == 145, \"USER_SMART_PASSWORD_UPDATED\",\r\n EventTypeId == 146, \"USER_SMART_PASSWORD_UPDATE_FAILED\",\r\n EventTypeId == 147, \"USER_MANUALLY_ADDED_TO_ROLE\",\r\n EventTypeId == 148, \"USER_MANUALLY_REMOVED_FROM_ROLE\",\r\n EventTypeId == 149, \"USER_AUTO_ADDED_TO_ROLE\",\r\n EventTypeId == 150, \"USER_AUTO_REMOVED_FROM_ROLE\",\r\n EventTypeId == 151, \"USER_ROLE_MANAGEMENT_GRANTED\",\r\n EventTypeId == 152, \"USER_ROLE_MANAGEMENT_REVOKED\",\r\n EventTypeId == 153, \"MAC_LOGIN_SUCCESS\",\r\n EventTypeId == 154, \"MAC_LOGIN_FAILURE\",\r\n EventTypeId == 155, \"DIRECTORY_FIELDS_IMPORT_EXCEPTION\",\r\n EventTypeId == 156, \"POLICY_CREATED\",\r\n EventTypeId == 157, \"POLICY_UPDATED\",\r\n EventTypeId == 158, \"POLICY_DELETED\",\r\n EventTypeId == 159, \"PROXY_AGENT_CREATED\",\r\n EventTypeId == 160, \"PROXY_AGENT_DELETED\",\r\n EventTypeId == 161, \"RADIUS_CONFIG_CREATED\",\r\n EventTypeId == 162, \"RADIUS_CONFIG_UPDATED\",\r\n EventTypeId == 163, \"RADIUS_CONFIG_DELETED\",\r\n EventTypeId == 164, \"VPN_ENABLED\",\r\n EventTypeId == 165, \"VPN_SETTINGS_UPDATED\",\r\n EventTypeId == 166, \"VPN_DISABLED\",\r\n EventTypeId == 167, \"EMBEDDING_ENABLED\",\r\n EventTypeId == 168, \"EMBEDDING_SETTINGS_UPDATED\",\r\n EventTypeId == 169, \"EMBEDDING_DISABLED\",\r\n EventTypeId == 170, \"AUTHENTICATION_FACTOR_CREATED\",\r\n EventTypeId == 171, \"AUTHENTICATION_FACTOR_UPDATED\",\r\n EventTypeId == 172, \"AUTHENTICATION_FACTOR_DELETED\",\r\n EventTypeId == 173, \"SECURITY_QUESTIONS_UPDATED\",\r\n EventTypeId == 174, \"DESKTOP_SSO_SETTINGS_UPDATED\",\r\n EventTypeId == 175, \"DESKTOP_SSO_ENABLED\",\r\n EventTypeId == 176, \"DESKTOP_SSO_DISABLED\",\r\n EventTypeId == 177, \"CERTIFICATE_CREATED\",\r\n EventTypeId == 178, \"CERTIFICATE_DELETED\",\r\n EventTypeId == 179, \"API_CREDENTIAL_CREATED\",\r\n EventTypeId == 180, \"API_CREDENTIAL_DELETED\",\r\n EventTypeId == 181, \"API_CREDENTIAL_ENABLED\",\r\n EventTypeId == 182, \"API_CREDENTIAL_DISABLED\",\r\n EventTypeId == 183, \"VLDAP_ENABLED\",\r\n EventTypeId == 184, \"VLDAP_DISABLED\",\r\n EventTypeId == 185, \"VLDAP_SETTINGS_UPDATED\",\r\n EventTypeId == 186, \"BRANDING_ENABLED\",\r\n EventTypeId == 187, \"BRANDING_DISABLED\",\r\n EventTypeId == 188, \"BRANDING_UPDATED\",\r\n EventTypeId == 189, \"MAPPING_ADDED\",\r\n EventTypeId == 190, \"MAPPING_DELETED\",\r\n EventTypeId == 191, \"MAPPING_DISABLED\",\r\n EventTypeId == 192, \"MAPPING_ENABLED\",\r\n EventTypeId == 193, \"MAPPING_UPDATED\",\r\n EventTypeId == 194, \"USER_FIELD_ADDED\",\r\n EventTypeId == 195, \"USER_FIELD_DELETED\",\r\n EventTypeId == 196, \"COMPANY_INFO_UPDATED\",\r\n EventTypeId == 197, \"ACCOUNT_SETTINGS_UPDATED\",\r\n EventTypeId == 198, \"DIRECTORY_CREATED\",\r\n EventTypeId == 199, \"DIRECTORY_DESTROYED\",\r\n EventTypeId == 200, \"DIRECTORY_CONNECTOR_INSTANCE_ADDED\",\r\n EventTypeId == 201, \"DIRECTORY_CONNECTOR_INSTANCE_DELETED\",\r\n EventTypeId == 202, \"REAPPLIED_MAPPINGS\",\r\n EventTypeId == 203, \"SELF_REGISTRATION_PROFILE_CREATED\",\r\n EventTypeId == 204, \"SELF_REGISTRATION_PROFILE_UPDATED\",\r\n EventTypeId == 205, \"SELF_REGISTRATION_PROFILE_DESTROYED\",\r\n EventTypeId == 206, \"MANUALLY_ADDED_LOGIN\",\r\n EventTypeId == 207, \"MANUALLY_REMOVED_LOGIN\",\r\n EventTypeId == 208, \"RETRIED_PROVISIONING\",\r\n EventTypeId == 209, \"DIRECTORY_USER_IMPORT_WARNING\",\r\n EventTypeId == 210, \"LDAP_CONNECTOR_EXCEPTION\",\r\n EventTypeId == 211, \"ADMIN_CHANGED_USER_PASSWORD\",\r\n EventTypeId == 212, \"DIRECTORY_LOCKED\",\r\n EventTypeId == 213, \"PROFILE_PICTURE_UPLOADED\",\r\n EventTypeId == 214, \"PROFILE_PICTURE_DELETED\",\r\n EventTypeId == 215, \"ADMIN_CHANGED_ACCOUNT_SETTINGS\",\r\n EventTypeId == 216, \"JOB_IN_QUEUE\",\r\n EventTypeId == 217, \"DIRECTORY_IMPORT_LIMIT_REACHED\",\r\n EventTypeId == 218, \"REAPPLIED_MAPPINGS_FAILED\",\r\n EventTypeId == 219, \"WORKDAY_REAL_TIME_NOTIFICATION\",\r\n EventTypeId == 220, \"ADMIN_CREATED_PAYMENT_RECORD\",\r\n EventTypeId == 221, \"ADMIN_UPDATED_PAYMENT_RECORD\",\r\n EventTypeId == 222, \"ADMIN_DELETED_PAYMENT_RECORD\",\r\n EventTypeId == 223, \"USER_UNLICENSED\",\r\n EventTypeId == 224, \"USER_LICENSED_MANUALLY\",\r\n EventTypeId == 225, \"USER_UNLICENSED_MANUALLY\",\r\n EventTypeId == 226, \"USER_UNLICENSED_AUTOMATICALLY\",\r\n EventTypeId == 227, \"USER_LICENSE_FAILED\",\r\n EventTypeId == 228, \"USERS_LICENSED_BULK\",\r\n EventTypeId == 229, \"ACCOUNT_NEAR_LIMIT\",\r\n EventTypeId == 230, \"ACCOUNT_IN_LIMIT\",\r\n EventTypeId == 231, \"USERS_IN_UNLICENSED_STATE\",\r\n EventTypeId == 232, \"USER_AGREED_TERMS\",\r\n EventTypeId == 233, \"USER_DENIED_TERMS\",\r\n EventTypeId == 234, \"ADMIN_ENABLED_TERMS\",\r\n EventTypeId == 235, \"ADMIN_UPDATED_TERMS\",\r\n EventTypeId == 236, \"ADMIN_DISABLED_TERMS\",\r\n EventTypeId == 237, \"DELETE_USER_FAILED\",\r\n EventTypeId == 238, \"USER_REDIRECTED_FOR_PASSWORD_CHANGE\",\r\n EventTypeId == 239, \"IMPORT_USER_FAILED\",\r\n EventTypeId == 240, \"USER_REVEALED_PASSWORD\",\r\n EventTypeId == 241, \"CSV_IMPORT_FAILED\",\r\n EventTypeId == 242, \"JOB_START_FAILED\",\r\n EventTypeId == 243, \"JOB_TERMINATED\",\r\n EventTypeId == 244, \"REPORT_GENERATED\",\r\n EventTypeId == 245, \"REPORT_GENERATION_FAILED\",\r\n EventTypeId == 246, \"REPORT_GENERATION_TERMINATED\",\r\n EventTypeId == 247, \"USER_MAPPINGS_FAILED\",\r\n EventTypeId == 248, \"USER_MAPPINGS_SUCCEEDED\",\r\n EventTypeId == 249, \"USER_BULK_OPERATION_FAILED\",\r\n EventTypeId == 250, \"PROVISIONING_APP_CONFIG_ERROR\",\r\n EventTypeId == 251, \"PROVISIONING_APP_THROTTLED\",\r\n EventTypeId == 252, \"USER_REMOVELOGINS_FAILED\",\r\n EventTypeId == 253, \"ENTITLEMENT_MAPPINGS_FAILED\",\r\n EventTypeId == 254, \"ENTITLEMENT_MAPPINGS_REAPPLIED\",\r\n EventTypeId == 255, \"MANUALLY_UPDATED_LOGIN\",\r\n EventTypeId == 291, \"USER_CREATED_BY_TIDP\",\r\n EventTypeId == 300, \"LDAP_CONNECTOR_STARTED\",\r\n EventTypeId == 301, \"LDAP_CONNECTOR_NOTIFICATION\",\r\n EventTypeId == 303, \"LDAP_CONNECTOR_CONFIG_RELOAD\",\r\n EventTypeId == 304, \"LDAP_CONNECTOR_STOPPED\",\r\n EventTypeId == 305, \"LDAP_CONNECTOR_FAIL_OVER\",\r\n EventTypeId == 306, \"MANUALLY_ADDED_LOGIN_FAILURE\",\r\n EventTypeId == 307, \"LDAP_CONNECTOR_PROVISIONING_ERROR\",\r\n EventTypeId == 330, \"USER_DISASSOCIATED_FROM_DIRECTORY\",\r\n EventTypeId == 331, \"USER_ASSOCIATED_TO_DIRECTORY\",\r\n EventTypeId == 332, \"USER_DIRECTORY_EXTERNAL_ID_UPDATED\",\r\n EventTypeId == 333, \"USER_DIRECTORY_EXTERNAL_ID_DELETED\",\r\n EventTypeId == 334, \"USER_NOT_UPDATED_IN_APP\",\r\n EventTypeId == 400, \"API_BAD_REQUEST\",\r\n EventTypeId == 401, \"API_UNAUTHORIZED\",\r\n EventTypeId == 402, \"MAPPING_SKIPPED\",\r\n EventTypeId == 410, \"BROADCASTER_CREATED\",\r\n EventTypeId == 411, \"BROADCASTER_UPDATED\",\r\n EventTypeId == 412, \"BROADCASTER_DELETED\",\r\n EventTypeId == 501, \"API_INDEX_ACTION\",\r\n EventTypeId == 502, \"API_SHOW_ACTION\",\r\n EventTypeId == 503, \"API_RES_ACTION\",\r\n EventTypeId == 510, \"API_SET_PWD_SALT\",\r\n EventTypeId == 511, \"API_SET_PWD_CLEAR_TEXT\",\r\n EventTypeId == 512, \"API_SET_CUSTOM_ATTRS\",\r\n EventTypeId == 513, \"API_ADD_ROLES\",\r\n EventTypeId == 514, \"API_REMOVE_ROLES\",\r\n EventTypeId == 515, \"API_AUTH_ISSUE_TOKEN\",\r\n EventTypeId == 516, \"API_LOGOUT\",\r\n EventTypeId == 517, \"API_SET_PWD_SALT_FAILED\",\r\n EventTypeId == 518, \"API_SET_PWD_CLEAR_TEXT_FAILED\",\r\n EventTypeId == 519, \"API_SET_CUSTOM_ATTRS_FAILED\",\r\n EventTypeId == 520, \"API_ADD_ROLES_FAILED\",\r\n EventTypeId == 521, \"API_REMOVE_ROLES_FAILED\",\r\n EventTypeId == 522, \"API_AUTH_ISSUE_TOKEN_FAILED\",\r\n EventTypeId == 523, \"API_LOGOUT_FAILED\",\r\n EventTypeId == 524, \"API_DESTROY_USER_FAILED\",\r\n EventTypeId == 525, \"API_GET_INVITE_LINK_FAILED\",\r\n EventTypeId == 526, \"API_LOCK_USER_FAILED\",\r\n EventTypeId == 527, \"API_VERIFY_FACTOR_FAILED\",\r\n EventTypeId == 528, \"API_VERIFY_FACTOR\",\r\n EventTypeId == 529, \"API_UPDATE_USER\",\r\n EventTypeId == 530, \"API_DESTROY_USER\",\r\n EventTypeId == 531, \"API_LOCK_USER\",\r\n EventTypeId == 532, \"API_UPDATE_USER_FAILED\",\r\n EventTypeId == 533, \"API_CREATE_USER\",\r\n EventTypeId == 534, \"API_CREATE_USER_FAILED\",\r\n EventTypeId == 535, \"API_GET_INVITE_LINK\",\r\n EventTypeId == 536, \"API_USER_OTPS_RETRIEVED\",\r\n EventTypeId == 537, \"API_CONFIRM_FACTOR\",\r\n EventTypeId == 538, \"API_CONFIRM_FACTOR_FAILED\",\r\n EventTypeId == 539, \"API_TRIGGER_FACTOR\",\r\n EventTypeId == 540, \"API_ADDED_OTP_DEVICE\",\r\n EventTypeId == 541, \"DIRECTORY_UPDATED\",\r\n EventTypeId == 542, \"DIRECTORY_OUS_CHANGED\",\r\n EventTypeId == 545, \"API_SEND_INVITE_LINK_FAILED\",\r\n EventTypeId == 546, \"API_SEND_INVITE_LINK\",\r\n EventTypeId == 550, \"FORCE_LOGOUT_USER\",\r\n EventTypeId == 551, \"SUSPENDED_USER_VIA_API\",\r\n EventTypeId == 552, \"REACTIVATED_USER_VIA_API\",\r\n EventTypeId == 553, \"USER_LOCKED_VIA_API\",\r\n EventTypeId == 554, \"UNLOCKED_USER_VIA_API\",\r\n EventTypeId == 555, \"EXTERNAL_ASSUME_USER\",\r\n EventTypeId == 600, \"APP_CREATED_BY_USER\",\r\n EventTypeId == 601, \"APP_UPDATED_BY_USER\",\r\n EventTypeId == 602, \"APP_DELETED_BY_USER\",\r\n EventTypeId == 700, \"CONNECTOR_CREATED\",\r\n EventTypeId == 701, \"CONNECTOR_CREATE_FAILED\",\r\n EventTypeId == 702, \"CONNECTOR_UPDATED\",\r\n EventTypeId == 703, \"CONNECTOR_UPDATE_FAILED\",\r\n EventTypeId == 704, \"CONNECTOR_DELETED\",\r\n EventTypeId == 705, \"CONNECTOR_DELETE_FAILED\",\r\n EventTypeId == 706, \"CONNECTOR_STATS_UPDATE\",\r\n EventTypeId == 800, \"PARAMETER_CREATED\",\r\n EventTypeId == 801, \"PARAMETER_CREATE_FAILED\",\r\n EventTypeId == 802, \"PARAMETER_UPDATED\",\r\n EventTypeId == 803, \"PARAMETER_UPDATE_FAILED\",\r\n EventTypeId == 804, \"PARAMETER_DELETED\",\r\n EventTypeId == 805, \"PARAMETER_DELETE_FAILED\",\r\n EventTypeId == 900, \"ONELOGIN_DESKTOP_MAC_LOGIN_SUCCESS\",\r\n EventTypeId == 901, \"ONELOGIN_DESKTOP_MAC_LOGIN_FAILURE\",\r\n EventTypeId == 902, \"ONELOGIN_DESKTOP_DEVICE_DELETED\",\r\n EventTypeId == 903, \"ONELOGIN_DESKTOP_DEVICE_UNBIND\",\r\n EventTypeId == 904, \"ONELOGIN_DESKTOP_LOGIN_SUCCESS\",\r\n EventTypeId == 905, \"ONELOGIN_DESKTOP_LOGIN_FAILURE\",\r\n EventTypeId == 906, \"ONELOGIN_DESKTOP_USER_FAILED_ONELOGIN_LOGIN\",\r\n EventTypeId == 907, \"DIRECTORY_EXPORT_SUCCESS\",\r\n EventTypeId == 911, \"ONELOGIN_DESKTOP_REVOKE_CERT_FOR_USER\",\r\n EventTypeId == 912, \"ONELOGIN_DESKTOP_REVOKE_CERT_FOR_DEVICE\",\r\n EventTypeId == 931, \"ADAPTIVE_LOGIN_ENABLED\",\r\n EventTypeId == 932, \"ADAPTIVE_LOGIN_DISABLED\",\r\n EventTypeId == 950, \"OL_OTP_PUSH_REJECT\",\r\n EventTypeId == 1001, \"USER_LOGIN_CHALLENGE\",\r\n EventTypeId == 1002, \"USER_LOGIN_CHALLENGE_FAILED\",\r\n EventTypeId == 1010, \"USER_REAUTH_SUCCESS\",\r\n EventTypeId == 1100, \"TEMP_OTP_TOKEN_GENERATED\",\r\n EventTypeId == 1101, \"TEMP_OTP_TOKEN_REVOKED\",\r\n EventTypeId == 1200, \"DELEGATED_APP_PRIVILEGE_DENIED\",\r\n EventTypeId == 1201, \"DELEGATED_USER_PRIVILEGE_DENIED\",\r\n EventTypeId == 1244, \"USER_ADDED_PHONE_NUMBER\",\r\n EventTypeId == 1245, \"USER_UPDATED_PHONE_NUMBER\",\r\n EventTypeId == 1300, \"API_APP_CREATED\",\r\n EventTypeId == 1301, \"API_APP_CREATE_FAILED\",\r\n EventTypeId == 1302, \"API_APP_UPDATED\",\r\n EventTypeId == 1303, \"API_APP_UPDATE_FAILED\",\r\n EventTypeId == 1304, \"API_APP_DESTROYED\",\r\n EventTypeId == 1305, \"API_APP_DESTROY_FAILED\",\r\n EventTypeId == 1400, \"USER_VERIFIED_OTP_DEVICE\",\r\n EventTypeId == 1401, \"API_AUTH_APP_CREATE_FAILED\",\r\n EventTypeId == 1402, \"API_AUTH_APP_UPDATED\",\r\n EventTypeId == 1403, \"API_AUTH_APP_UPDATE_FAILED\",\r\n EventTypeId == 1404, \"API_AUTH_APP_DESTROYED\",\r\n EventTypeId == 1405, \"API_AUTH_APP_DESTROY_FAILED\",\r\n EventTypeId == 1406, \"API_AUTH_SCOPE_CREATED\",\r\n EventTypeId == 1407, \"API_AUTH_SCOPE_CREATE_FAILED\",\r\n EventTypeId == 1408, \"API_AUTH_SCOPE_UPDATED\",\r\n EventTypeId == 1409, \"API_AUTH_SCOPE_UPDATE_FAILED\",\r\n EventTypeId == 1410, \"API_AUTH_SCOPE_DESTROYED\",\r\n EventTypeId == 1411, \"API_AUTH_SCOPE_DESTROY_FAILED\",\r\n EventTypeId == 1412, \"API_AUTH_CLAIM_CREATED\",\r\n EventTypeId == 1413, \"API_AUTH_CLAIM_CREATE_FAILED\",\r\n EventTypeId == 1414, \"API_AUTH_CLAIM_UPDATED\",\r\n EventTypeId == 1415, \"API_AUTH_CLAIM_UPDATE_FAILED\",\r\n EventTypeId == 1416, \"API_AUTH_CLAIM_DESTROYED\",\r\n EventTypeId == 1417, \"API_AUTH_CLAIM_DESTROY_FAILED\",\r\n EventTypeId == 1418, \"API_AUTH_CLIENT_CREATED\",\r\n EventTypeId == 1419, \"API_AUTH_CLIENT_CREATE_FAILED\",\r\n EventTypeId == 1420, \"API_AUTH_CLIENT_UPDATED\",\r\n EventTypeId == 1421, \"API_AUTH_CLIENT_UPDATE_FAILED\",\r\n EventTypeId == 1422, \"API_AUTH_CLIENT_DESTROYED\",\r\n EventTypeId == 1423, \"API_AUTH_CLIENT_DESTROY_FAILED\",\r\n EventTypeId == 1424, \"API_AUTH_APP_CREATED\",\r\n EventTypeId == 1500, \"SANDBOX_SYNC_STARTED\",\r\n EventTypeId == 1501, \"SANDBOX_SYNC_FAILED\",\r\n EventTypeId == 1502, \"SANDBOX_SYNCED\",\r\n EventTypeId == 1503, \"SANDBOX_DELETED\",\r\n EventTypeId == 1504, \"SANDBOX_DELETE_FAILED\",\r\n EventTypeId == 1505, \"SANDBOX_CREATED\",\r\n EventTypeId == 1506, \"SANDBOX_CREATION_FAILED\",\r\n EventTypeId == 1507, \"SANDBOX_UPDATED\",\r\n EventTypeId == 1508, \"SANDBOX_UPDATE_FAILED\",\r\n EventTypeId == 1509, \"SANDBOX_DELETED_BY_API\",\r\n EventTypeId == 1510, \"SANDBOX_DELETE_FAILED_BY_API\",\r\n EventTypeId == 1511, \"SANDBOX_CREATED_BY_API\",\r\n EventTypeId == 1512, \"SANDBOX_CREATION_FAILED_BY_API\",\r\n EventTypeId == 1513, \"SANDBOX_UPDATED_BY_API\",\r\n EventTypeId == 1514, \"SANDBOX_UPDATE_FAILED_BY_API\",\r\n EventTypeId == 1600, \"PROFILE_DEVICES_DELETE_DEVICE\",\r\n EventTypeId == 1601, \"PROFILE_DEVICES_RENAME_DEVICE\",\r\n EventTypeId == 1602, \"PROFILE_DEVICES_UPDATE_DEFAULT\",\r\n EventTypeId == 1603, \"PROFILE_SETTINGS_UPDATE_LOCALE\",\r\n EventTypeId == 1604, \"PROFILE_SETTINGS_UPDATE_PHONE\",\r\n EventTypeId == 1605, \"PROFILE_SETTINGS_UPDATE_DEFAULT_TAB\",\r\n EventTypeId == 1606, \"PROFILE_SETTINGS_UPDATE_PROFILE_PHOTO\",\r\n EventTypeId == 1607, \"PROFILE_SETTINGS_UPDATE_APP_AUTO_DETECT\",\r\n EventTypeId == 1608, \"PROFILE_CHANGE_PASSWORD\",\r\n EventTypeId == 1609, \"PROFILE_SETTINGS_UPDATE_SHOW_TABS\",\r\n EventTypeId == 1700, \"RADIUS_ATTRIBUTE_CREATED\",\r\n EventTypeId == 1701, \"RADIUS_ATTRIBUTE_UPDATED\",\r\n EventTypeId == 1702, \"RADIUS_ATTRIBUTE_DELETED\",\r\n EventTypeId == 1801, \"ROLE_CREATED\",\r\n EventTypeId == 1802, \"ROLE_DELETED\",\r\n EventTypeId == 1900, \"API_BRAND_CREATED\",\r\n EventTypeId == 1901, \"API_BRAND_CREATE_FAILED\",\r\n EventTypeId == 1902, \"API_BRAND_UPDATED\",\r\n EventTypeId == 1903, \"API_BRAND_UPDATE_FAILED\",\r\n EventTypeId == 1904, \"API_BRAND_DESTROYED\",\r\n EventTypeId == 1905, \"API_BRAND_DESTROY_FAILED\",\r\n EventTypeId == 2000, \"HOOKS_LIST_FUNCTION\",\r\n EventTypeId == 2001, \"CUSTOM_SMTP_ERROR\",\r\n EventTypeId == 2002, \"SMTP_SETTINGS_UPDATED\",\r\n EventTypeId == 2003, \"HOOKS_CREATE_FUNCTION\",\r\n EventTypeId == 2004, \"HOOKS_CREATE_FUNCTION_FAILED\",\r\n EventTypeId == 2005, \"HOOKS_GET_FUNCTION\",\r\n EventTypeId == 2006, \"HOOKS_GET_FUNCTION_LOGS\",\r\n EventTypeId == 2007, \"HOOKS_UPDATE_FUNCTION\",\r\n EventTypeId == 2008, \"HOOKS_UPDATE_FUNCTION_FAILED\",\r\n EventTypeId == 2009, \"HOOKS_DELETE_FUNCTION\",\r\n EventTypeId == 2010, \"HOOKS_DELETE_FUNCTION_FAILED\",\r\n EventTypeId == 2011, \"HOOKS_LIST_ENVVAR\",\r\n EventTypeId == 2012, \"HOOKS_CREATE_ENVVAR\",\r\n EventTypeId == 2013, \"HOOKS_CREATE_ENVVAR_FAILED\",\r\n EventTypeId == 2014, \"HOOKS_GET_ENVVAR\",\r\n EventTypeId == 2015, \"HOOKS_UPDATE_ENVVAR\",\r\n EventTypeId == 2016, \"HOOKS_UPDATE_ENVVAR_FAILED\",\r\n EventTypeId == 2017, \"HOOKS_DELETE_ENVVAR\",\r\n EventTypeId == 2018, \"HOOKS_DELETE_ENVVAR_FAILED\",\r\n EventTypeId == 2100, \"DELEGATED_PRIVILEGE_CREATED_VIA_API\",\r\n EventTypeId == 2101, \"DELEGATED_PRIVILEGE_CREATED_BY_USER\",\r\n EventTypeId == 2102, \"DELEGATED_PRIVILEGE_UPDATED_VIA_API\",\r\n EventTypeId == 2103, \"DELEGATED_PRIVILEGE_UPDATED_BY_USER\",\r\n EventTypeId == 2104, \"DELEGATED_PRIVILEGE_DELETED_VIA_API\",\r\n EventTypeId == 2105, \"DELEGATED_PRIVILEGE_DELETED_BY_USER\",\r\n EventTypeId == 2106, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_VIA_API\",\r\n EventTypeId == 2107, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_BY_USER\",\r\n EventTypeId == 2108, \"DELEGATED_PRIVILEGE_REMOVED_FROM_USER_VIA_API\",\r\n EventTypeId == 2109, \"DELEGATED_PRIVILEGE_REMOVED_FROM_USER_BY_USER\",\r\n EventTypeId == 2110, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_VIA_API\",\r\n EventTypeId == 2111, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_BY_USER\",\r\n EventTypeId == 2112, \"DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_VIA_API\",\r\n EventTypeId == 2113, \"DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_BY_USER\",\r\n EventTypeId == 2114, \"DELEGATED_ROLE_PRIVILEGE_DENIED\",\r\n EventTypeId == 2201, \"REPORT_CREATED_BY_USER\",\r\n EventTypeId == 2202, \"REPORT_UPDATED_BY_USER\",\r\n EventTypeId == 2203, \"REPORT_CLONED_BY_USER\",\r\n EventTypeId == 2204, \"REPORT_DESTROYED_BY_USER\",\r\n EventTypeId == 3000, \"OIDC_GENERAL_FAIL\",\r\n EventTypeId == 3001, \"OIDC_IMPLICIT_FLOW_SUCCESS\",\r\n EventTypeId == 3002, \"OIDC_IMPLICIT_FLOW_FAILED\",\r\n EventTypeId == 3003, \"OIDC_GET_CODE_SUCCESS\",\r\n EventTypeId == 3004, \"OIDC_GET_CODE_FAILED\",\r\n EventTypeId == 3005, \"OIDC_AUTHORIZATION_CODE_SUCCESS\",\r\n EventTypeId == 3006, \"OIDC_AUTHORIZATION_CODE_FAILED\",\r\n EventTypeId == 3007, \"OIDC_CLIENT_CREDENTIALS_SUCCESS\",\r\n EventTypeId == 3008, \"OIDC_CLIENT_CREDENTIALS_FAILED\",\r\n EventTypeId == 3009, \"OIDC_PASSWORD_SUCCESS\",\r\n EventTypeId == 3010, \"OIDC_PASSWORD_FAILED\",\r\n EventTypeId == 3011, \"OIDC_REFRESH_TOKEN_SUCCESS\",\r\n EventTypeId == 3012, \"OIDC_REFRESH_TOKEN_FAILED\",\r\n EventTypeId == 3013, \"OIDC_VALIDATE_TOKEN_SUCCESS\",\r\n EventTypeId == 3014, \"OIDC_VALIDATE_TOKEN_FAILED\",\r\n EventTypeId == 3015, \"OIDC_REVOKE_TOKEN_SUCCESS\",\r\n EventTypeId == 3016, \"OIDC_REVOKE_TOKEN_FAILED\",\r\n EventTypeId == 3017, \"OIDC_USER_INFO_SUCCESS\",\r\n EventTypeId == 3018, \"OIDC_USER_INFO_FAILED\",\r\n EventTypeId == 3019, \"NOTIFICATION_WAS_SENT\",\r\n EventTypeId == 3020, \"GROUP_CREATED\",\r\n EventTypeId == 3021, \"GROUP_UPDATED\",\r\n EventTypeId == 3022, \"GROUP_DESTROYED\",\r\n EventTypeId == 3023, \"USER_CREATED_NOTE\",\r\n EventTypeId == 3024, \"DELEGATED_GROUP_PRIVILEGE_DENIED\",\r\n EventTypeId == 3025, \"DELEGATED_POLICY_PRIVILEGE_DENIED\",\r\n EventTypeId == 3026, \"PROFILE_DEVICES_UNSET_DEFAULT\",\r\n EventTypeId == 3027, \"DELEGATED_REPORT_PRIVILEGE_DENIED\",\r\n EventTypeId == 9000, \"USER_ENABLED_WORKFLOW\",\r\n EventTypeId == 9001, \"USER_DISABLED_WORKFLOW\",\r\n EventTypeId == 9002, \"USER_INITIATED_WORKFLOW\",\r\n EventTypeId == 9003, \"USER_COMPLETED_TASK\",\r\n EventTypeId == 9004, \"USER_MARKED_TASK_COMPLETE\",\r\n EventTypeId == 9005, \"USER_MARKED_WORKFLOW_COMPLETE\",\r\n EventTypeId == 9006, \"USER_MARKED_TASK_INCOMPLETE\",\r\n EventTypeId == 9007, \"USER_ENABLED_ONBOARDING\",\r\n EventTypeId == 9008, \"USER_DISABLED_ONBOARDING\",\r\n EventTypeId == 9009, \"USER_ENABLED_OFFBOARDING\",\r\n EventTypeId == 9010, \"USER_DISABLED_OFFBOARDING\",\r\n EventTypeId == 9011, \"USER_INITIATED_OFFBOARDING\",\r\n EventTypeId == 9012, \"USER_INITIATED_ONBOARDING\",\r\n EventTypeId == 9013, \"USER_COMPLETED_WORKFLOW\",\r\n EventTypeId == 9014, \"APP_RULES_LIST_SUCCESS\",\r\n EventTypeId == 9015, \"APP_RULES_LIST_FAILED\",\r\n EventTypeId == 9016, \"APP_RULES_CREATE_SUCCESS\",\r\n EventTypeId == 9017, \"APP_RULES_CREATE_FAILED\",\r\n EventTypeId == 9018, \"APP_RULES_UPDATE_SUCCESS\",\r\n EventTypeId == 9019, \"APP_RULES_UPDATE_FAILED\",\r\n EventTypeId == 9020, \"APP_RULES_GET_SUCCESS\",\r\n EventTypeId == 9021, \"APP_RULES_GET_FAILED\",\r\n EventTypeId == 9022, \"APP_RULES_DRYRUN_SUCCESS\",\r\n EventTypeId == 9023, \"APP_RULES_DRYRUN_FAILED\",\r\n EventTypeId == 9024, \"APP_RULES_DELETE_SUCCESS\",\r\n EventTypeId == 9025, \"APP_RULES_DELETE_FAILED\",\r\n EventTypeId == 9026, \"APP_RULES_SORT_SUCCESS\",\r\n EventTypeId == 9027, \"APP_RULES_SORT_FAILED\",\r\n EventTypeId == 9028, \"APP_RULES_APPLY_SUCCESS\",\r\n EventTypeId == 9029, \"APP_RULES_APPLY_FAILED\",\r\n EventTypeId == 9030, \"APP_RULES_REFRESH_ENTITLEMENTS_SUCCESS\",\r\n EventTypeId == 9031, \"APP_RULES_REFRESH_ENTITLEMENTS_FAILED\",\r\n EventTypeId == 9032, \"APP_RULES_LIST_CONDITIONS_SUCCESS\",\r\n EventTypeId == 9033, \"APP_RULES_LIST_CONDITIONS_FAILED\",\r\n EventTypeId == 9034, \"APP_RULES_LIST_CONDITION_OPERATORS_SUCCESS\",\r\n EventTypeId == 9035, \"APP_RULES_LIST_CONDITION_OPERATORS_FAILED\",\r\n EventTypeId == 9036, \"APP_RULES_LIST_ACTIONS_SUCCESS\",\r\n EventTypeId == 9037, \"APP_RULES_LIST_ACTIONS_FAILED\",\r\n EventTypeId == 9038, \"APP_RULES_LIST_ACTION_VALUES_SUCCESS\",\r\n EventTypeId == 9039, \"APP_RULES_LIST_ACTION_VALUES_FAILED\",\r\n EventTypeId == 9040, \"USER_ROLE_MANAGEMENT_GRANTED_FAILED\",\r\n EventTypeId == 9041, \"USER_ROLE_MANAGEMENT_REVOKED_FAILED\",\r\n EventTypeId == 9042, \"APP_ADDED_TO_ROLE_FAILED\",\r\n EventTypeId == 9043, \"APP_REMOVED_FROM_ROLE_FAILED\",\r\n EventTypeId == 9044, \"USER_MANUALLY_ADDED_TO_ROLE_FAILED\",\r\n EventTypeId == 9045, \"USER_MANUALLY_REMOVED_FROM_ROLE_FAILED\",\r\n EventTypeId == 9046, \"ROLE_CREATE_FAILED\",\r\n EventTypeId == 9047, \"ROLE_DELETE_FAILED\",\r\n EventTypeId == 9048, \"ROLE_LIST_SUCCESS\",\r\n EventTypeId == 9049, \"ROLE_LIST_FAILED\",\r\n EventTypeId == 9050, \"ROLE_GET_SUCCESS\",\r\n EventTypeId == 9051, \"ROLE_GET_FAILED\",\r\n EventTypeId == 9052, \"ROLE_UPDATE_SUCCESS\",\r\n EventTypeId == 9053, \"ROLE_UPDATE_FAILED\",\r\n EventTypeId == 9054, \"ROLE_LIST_APPS_SUCCESS\",\r\n EventTypeId == 9055, \"ROLE_LIST_APPS_FAILED\",\r\n EventTypeId == 9056, \"ROLE_LIST_USERS_SUCCESS\",\r\n EventTypeId == 9057, \"ROLE_LIST_USERS_FAILED\",\r\n EventTypeId == 9058, \"ROLE_LIST_ADMINISTRATORS_SUCCESS\",\r\n EventTypeId == 9059, \"ROLE_LIST_ADMINISTRATORS_FAILED\",\r\n \"\"\r\n )\r\n\r\n", - "version": 1 + "query": "OneLogin_CL\n| extend app_name_s = column_ifexists(\"app_name_s\", ''),\n app_id_d = column_ifexists(\"app_id_d\", ''),\n role_name_s = column_ifexists(\"role_name_s\", ''),\n role_id_d = column_ifexists(\"role_id_d\", ''),\n user_attributes_username_s = column_ifexists(\"user_attributes_username_s\", ''),\n user_attributes_department_s = column_ifexists(\"user_attributes_department_s\", ''),\n user_attributes_title_s = column_ifexists(\"user_attributes_title_s\", '')\n| project-rename TargetAppName = app_name_s,\n TargetAppId = app_id_d,\n RoleName = role_name_s,\n RoleId = role_id_d,\n PolicyName = policy_name_s,\n PolicyType = policy_type_s,\n PolicyId = policy_id_d,\n HttpUserAgent = user_agent_s,\n UserId = user_id_d,\n UserAttributesUsername_s = user_attributes_username_s,\n UserAttributesAccountId = user_attributes_account_id_d,\n UserAttributesDepartment = user_attributes_department_s,\n UserAttributesFirstname = user_attributes_firstname_s,\n UserAttributesEmail = user_attributes_email_s,\n UserAttributesOpenidName = user_attributes_openid_name_s,\n UserAttributesTitle = user_attributes_title_s,\n UserAttributesLastname = user_attributes_lastname_s,\n UserName = user_name_s,\n EventOriginalUid = create__id_g,\n UUID = uuid_g,\n ActorSystem = actor_system_s,\n CustomMessage = custom_message_s,\n AccountId = account_id_d,\n SrcIpAddr = ipaddr_s,\n ActorUserName = actor_user_name_s,\n ActorUserId = actor_user_id_d,\n Message = notes_s,\n EventTypeId = event_type_id_d,\n EventStartTime = event_timestamp_s\n| extend EventVendor = \"OneLogin\",\n EventProduct = \"OneLogin IAM\",\n EventType = case (\n EventTypeId == 1, \"APP_ADDED_TO_ROLE\",\n EventTypeId == 2, \"APP_REMOVED_FROM_ROLE\",\n EventTypeId == 3, \"USER_ASSUMED_USER\",\n EventTypeId == 4, \"USER_ASSIGNED_ROLE\",\n EventTypeId == 5, \"USER_LOGGED_INTO_ONELOGIN\",\n EventTypeId == 6, \"USER_FAILED_ONELOGIN_LOGIN\",\n EventTypeId == 7, \"USER_LOGGED_OUT_OF_ONELOGIN\",\n EventTypeId == 8, \"USER_LOGGED_INTO_APP\",\n EventTypeId == 9, \"USER_FAILED_APP_LOGIN\",\n EventTypeId == 10, \"USER_REQUESTED_NEW_PASSWORD\",\n EventTypeId == 11, \"USER_CHANGED_PASSWORD\",\n EventTypeId == 12, \"UNLOCKED_USER\",\n EventTypeId == 13, \"CREATED_USER\",\n EventTypeId == 14, \"UPDATED_USER\",\n EventTypeId == 15, \"DEACTIVATED_USER\",\n EventTypeId == 16, \"ACTIVATED_USER\",\n EventTypeId == 17, \"DELETED_USER\",\n EventTypeId == 18, \"ADMIN_APPROVED_PASSWORD_REQUEST\",\n EventTypeId == 19, \"USER_LOCKED\",\n EventTypeId == 20, \"REACHED_USERS_LIMIT\",\n EventTypeId == 21, \"SUSPENDED_USER\",\n EventTypeId == 22, \"USER_ADDED_OTP_DEVICE\",\n EventTypeId == 23, \"USER_BULK_OPERATION\",\n EventTypeId == 24, \"USER_REMOVED_OTP_DEVICE\",\n EventTypeId == 25, \"PROVISIONING_EXCEPTION\",\n EventTypeId == 26, \"PROVISIONING_EVENT\",\n EventTypeId == 27, \"USER_DOWNLOADED_CERT\",\n EventTypeId == 28, \"USER_RECENTLY_REMOVED\",\n EventTypeId == 29, \"USER_LOGGED_OUT_OF_APP\",\n EventTypeId == 30, \"UPDATED_PAYMENT_INFO\",\n EventTypeId == 31, \"FAILED_UPDATE_PAYMENT_INFO\",\n EventTypeId == 32, \"REACTIVATED_USER\",\n EventTypeId == 33, \"USERS_IMPORTED_FROM_DIRECTORY\",\n EventTypeId == 34, \"USER_REQUESTED_APP\",\n EventTypeId == 35, \"USER_LOCKED_OUT_OF_APP\",\n EventTypeId == 36, \"USER_LOST_OTP_DEVICE\",\n EventTypeId == 37, \"USER_JOIN_REQUEST\",\n EventTypeId == 38, \"APP_REACHED_USER_LIMIT\",\n EventTypeId == 39, \"CONNECTOR_BROKEN\",\n EventTypeId == 40, \"USER_UNLOCKED_OTP_DEVICE\",\n EventTypeId == 41, \"AD_CONNECTOR_STARTED\",\n EventTypeId == 42, \"AD_CONNECTOR_STOPPED\",\n EventTypeId == 43, \"AD_CONNECTOR_CONFIG_RELOAD\",\n EventTypeId == 44, \"AD_CONNECTOR_NOTIFICATION\",\n EventTypeId == 45, \"AD_CONNECTOR_EXCEPTION_OLD\",\n EventTypeId == 46, \"AD_CONNECTOR_FAIL_OVER\",\n EventTypeId == 47, \"AD_CONNECTOR_EXCEPTION\",\n EventTypeId == 48, \"IMPORTED_USER\",\n EventTypeId == 49, \"UPDATE_USER_FAILED\",\n EventTypeId == 50, \"REJECTED_USER\",\n EventTypeId == 51, \"USER_CREATED_IN_APP\",\n EventTypeId == 52, \"USER_UPDATED_IN_APP\",\n EventTypeId == 53, \"USER_SUSPENDED_IN_APP\",\n EventTypeId == 54, \"USER_REACTIVATED_IN_APP\",\n EventTypeId == 55, \"USER_DELETED_IN_APP\",\n EventTypeId == 56, \"UNMATCHED_USERS\",\n EventTypeId == 57, \"RABBIT_DOWN\",\n EventTypeId == 58, \"RABBIT_RESTARTED\",\n EventTypeId == 59, \"USER_LINKED_IN_APP\",\n EventTypeId == 60, \"PROVISIONING_DEPROVISIONING_MODE_DO_NOTHING_WARNING\",\n EventTypeId == 61, \"USER_FAILED_SUSPENDING_IN_APP\",\n EventTypeId == 62, \"USER_FAILED_REACTIVATING_IN_APP\",\n EventTypeId == 63, \"USER_FAILED_DELETING_IN_APP\",\n EventTypeId == 64, \"USER_FAILED_CREATING_IN_APP\",\n EventTypeId == 65, \"USER_FAILED_UPDATING_IN_APP\",\n EventTypeId == 66, \"NO_USERS_TO_IMPORT_FROM_DIRECTORY\",\n EventTypeId == 67, \"DIRECTORY_IMPORT_EXCEPTION\",\n EventTypeId == 68, \"USER_AUTHENTICATED_BY_RADIUS\",\n EventTypeId == 69, \"USER_REJECTED_BY_RADIUS\",\n EventTypeId == 70, \"PRIVILEGE_GRANTED_TO_ACCOUNT\",\n EventTypeId == 71, \"PRIVILEGE_REVOKED_FROM_ACCOUNT\",\n EventTypeId == 72, \"PRIVILEGE_GRANTED_TO_USER\",\n EventTypeId == 73, \"PRIVILEGE_REVOKED_FROM_USER\",\n EventTypeId == 74, \"TRUSTED_IDP_ADDED\",\n EventTypeId == 75, \"TRUSTED_IDP_REMOVED\",\n EventTypeId == 76, \"TRUSTED_IDP_MODIFIED\",\n EventTypeId == 77, \"USER_FAILED_PROXY_LOGIN\",\n EventTypeId == 78, \"USER_SUCCEEDED_PROXY_LOGIN\",\n EventTypeId == 79, \"AD_CONNECTOR_PROVISIONING_ERROR\",\n EventTypeId == 80, \"USER_CREATED_IN_DIRECTORY\",\n EventTypeId == 81, \"USER_UPDATED_IN_DIRECTORY\",\n EventTypeId == 82, \"USER_SUSPENDED_IN_DIRECTORY\",\n EventTypeId == 83, \"USER_REACTIVATED_IN_DIRECTORY\",\n EventTypeId == 84, \"USER_DELETED_IN_DIRECTORY\",\n EventTypeId == 85, \"APP_COULD_NOT_AUTHENTICATE\",\n EventTypeId == 86, \"USER_FAILED_REMOTE_AUTHENTICATION\",\n EventTypeId == 87, \"USER_VIEWED_NOTE\",\n EventTypeId == 88, \"USER_EDITED_NOTE\",\n EventTypeId == 89, \"USER_DELETED_NOTE\",\n EventTypeId == 90, \"USER_UNAUTHORIZED_APP_ACCESS\",\n EventTypeId == 91, \"USER_UNDETERMINED_BY_RADIUS\",\n EventTypeId == 92, \"USER_NTHASH_REQUESTED_BY_RADIUS\",\n EventTypeId == 95, \"DIRECTORY_GROUPS_WRITE_BACK_IMPORT_STARTED\",\n EventTypeId == 96, \"DIRECTORY_GROUPS_WRITE_BACK_IMPORT_FINISHED\",\n EventTypeId == 100, \"SELF_REGISTRATION_REQUEST\",\n EventTypeId == 101, \"SELF_REGISTRATION_APPROVED\",\n EventTypeId == 102, \"SELF_REGISTRATION_DENIED\",\n EventTypeId == 103, \"SELF_REGISTRATION_REQUEST_UNVERIFIED\",\n EventTypeId == 104, \"SELF_REGISTRATION_REQUEST_VERIFIED\",\n EventTypeId == 105, \"SMS_FAILURE\",\n EventTypeId == 106, \"USER_CHANGE_PASSWORD_FAILED\",\n EventTypeId == 110, \"APP_LOGINS_UPDATED\",\n EventTypeId == 111, \"APP_LOGINS_UPDATE_FAILED\",\n EventTypeId == 112, \"TRUSTED_IDP_MADE_DEFAULT\",\n EventTypeId == 113, \"DIRECTORY_IMPORT_STARTED\",\n EventTypeId == 114, \"DIRECTORY_IMPORT_FINISHED\",\n EventTypeId == 115, \"USER_INVITED\",\n EventTypeId == 116, \"CREATE_USER_FAILED\",\n EventTypeId == 117, \"DIRECTORY_SYNC_RUN_ID\",\n EventTypeId == 118, \"SAML_ACS_FAILED\",\n EventTypeId == 119, \"TRUSTED_IDP_REMOVED_AS_DEFAULT\",\n EventTypeId == 120, \"UNLOCKED_USER_IN_DIRECTORY\",\n EventTypeId == 121, \"SCRIPTLET_ERROR\",\n EventTypeId == 122, \"USER_AUTHENTICATED_BY_API\",\n EventTypeId == 123, \"USER_REJECTED_BY_API\",\n EventTypeId == 124, \"ENTITLEMENTS_CACHE_ACTION\",\n EventTypeId == 125, \"ENTITLEMENT_ACTION\",\n EventTypeId == 126, \"DIRECTORY_CONNECTOR_ENABLED\",\n EventTypeId == 127, \"DIRECTORY_CONNECTOR_DISABLED\",\n EventTypeId == 128, \"NO_ACTIVE_ACTIVE_DIRECTORY_CONNECTORS\",\n EventTypeId == 129, \"VLDAP_BIND_FAILURE\",\n EventTypeId == 130, \"VLDAP_BIND_SUCCESS\",\n EventTypeId == 131, \"DIRECTORY_EXPORT_STARTED\",\n EventTypeId == 132, \"DIRECTORY_EXPORT_FINISHED\",\n EventTypeId == 133, \"DIRECTORY_EXPORT_EXCEPTION\",\n EventTypeId == 134, \"DIRECTORY_REFRESH_SCHEMA_EXCEPTION\",\n EventTypeId == 135, \"CERTIFICATE_EXPIRES\",\n EventTypeId == 136, \"DIRECTORY_FIELDS_IMPORT_STARTED\",\n EventTypeId == 137, \"USER_APP_REQUEST_APPROVED\",\n EventTypeId == 138, \"USER_APP_REQUEST_DENIED\",\n EventTypeId == 139, \"DIRECTORY_FIELDS_IMPORT_FINISHED\",\n EventTypeId == 140, \"SOCIAL_SIGN_IN\",\n EventTypeId == 141, \"SOCIAL_SIGN_IN_FAILURE\",\n EventTypeId == 145, \"USER_SMART_PASSWORD_UPDATED\",\n EventTypeId == 146, \"USER_SMART_PASSWORD_UPDATE_FAILED\",\n EventTypeId == 147, \"USER_MANUALLY_ADDED_TO_ROLE\",\n EventTypeId == 148, \"USER_MANUALLY_REMOVED_FROM_ROLE\",\n EventTypeId == 149, \"USER_AUTO_ADDED_TO_ROLE\",\n EventTypeId == 150, \"USER_AUTO_REMOVED_FROM_ROLE\",\n EventTypeId == 151, \"USER_ROLE_MANAGEMENT_GRANTED\",\n EventTypeId == 152, \"USER_ROLE_MANAGEMENT_REVOKED\",\n EventTypeId == 153, \"MAC_LOGIN_SUCCESS\",\n EventTypeId == 154, \"MAC_LOGIN_FAILURE\",\n EventTypeId == 155, \"DIRECTORY_FIELDS_IMPORT_EXCEPTION\",\n EventTypeId == 156, \"POLICY_CREATED\",\n EventTypeId == 157, \"POLICY_UPDATED\",\n EventTypeId == 158, \"POLICY_DELETED\",\n EventTypeId == 159, \"PROXY_AGENT_CREATED\",\n EventTypeId == 160, \"PROXY_AGENT_DELETED\",\n EventTypeId == 161, \"RADIUS_CONFIG_CREATED\",\n EventTypeId == 162, \"RADIUS_CONFIG_UPDATED\",\n EventTypeId == 163, \"RADIUS_CONFIG_DELETED\",\n EventTypeId == 164, \"VPN_ENABLED\",\n EventTypeId == 165, \"VPN_SETTINGS_UPDATED\",\n EventTypeId == 166, \"VPN_DISABLED\",\n EventTypeId == 167, \"EMBEDDING_ENABLED\",\n EventTypeId == 168, \"EMBEDDING_SETTINGS_UPDATED\",\n EventTypeId == 169, \"EMBEDDING_DISABLED\",\n EventTypeId == 170, \"AUTHENTICATION_FACTOR_CREATED\",\n EventTypeId == 171, \"AUTHENTICATION_FACTOR_UPDATED\",\n EventTypeId == 172, \"AUTHENTICATION_FACTOR_DELETED\",\n EventTypeId == 173, \"SECURITY_QUESTIONS_UPDATED\",\n EventTypeId == 174, \"DESKTOP_SSO_SETTINGS_UPDATED\",\n EventTypeId == 175, \"DESKTOP_SSO_ENABLED\",\n EventTypeId == 176, \"DESKTOP_SSO_DISABLED\",\n EventTypeId == 177, \"CERTIFICATE_CREATED\",\n EventTypeId == 178, \"CERTIFICATE_DELETED\",\n EventTypeId == 179, \"API_CREDENTIAL_CREATED\",\n EventTypeId == 180, \"API_CREDENTIAL_DELETED\",\n EventTypeId == 181, \"API_CREDENTIAL_ENABLED\",\n EventTypeId == 182, \"API_CREDENTIAL_DISABLED\",\n EventTypeId == 183, \"VLDAP_ENABLED\",\n EventTypeId == 184, \"VLDAP_DISABLED\",\n EventTypeId == 185, \"VLDAP_SETTINGS_UPDATED\",\n EventTypeId == 186, \"BRANDING_ENABLED\",\n EventTypeId == 187, \"BRANDING_DISABLED\",\n EventTypeId == 188, \"BRANDING_UPDATED\",\n EventTypeId == 189, \"MAPPING_ADDED\",\n EventTypeId == 190, \"MAPPING_DELETED\",\n EventTypeId == 191, \"MAPPING_DISABLED\",\n EventTypeId == 192, \"MAPPING_ENABLED\",\n EventTypeId == 193, \"MAPPING_UPDATED\",\n EventTypeId == 194, \"USER_FIELD_ADDED\",\n EventTypeId == 195, \"USER_FIELD_DELETED\",\n EventTypeId == 196, \"COMPANY_INFO_UPDATED\",\n EventTypeId == 197, \"ACCOUNT_SETTINGS_UPDATED\",\n EventTypeId == 198, \"DIRECTORY_CREATED\",\n EventTypeId == 199, \"DIRECTORY_DESTROYED\",\n EventTypeId == 200, \"DIRECTORY_CONNECTOR_INSTANCE_ADDED\",\n EventTypeId == 201, \"DIRECTORY_CONNECTOR_INSTANCE_DELETED\",\n EventTypeId == 202, \"REAPPLIED_MAPPINGS\",\n EventTypeId == 203, \"SELF_REGISTRATION_PROFILE_CREATED\",\n EventTypeId == 204, \"SELF_REGISTRATION_PROFILE_UPDATED\",\n EventTypeId == 205, \"SELF_REGISTRATION_PROFILE_DESTROYED\",\n EventTypeId == 206, \"MANUALLY_ADDED_LOGIN\",\n EventTypeId == 207, \"MANUALLY_REMOVED_LOGIN\",\n EventTypeId == 208, \"RETRIED_PROVISIONING\",\n EventTypeId == 209, \"DIRECTORY_USER_IMPORT_WARNING\",\n EventTypeId == 210, \"LDAP_CONNECTOR_EXCEPTION\",\n EventTypeId == 211, \"ADMIN_CHANGED_USER_PASSWORD\",\n EventTypeId == 212, \"DIRECTORY_LOCKED\",\n EventTypeId == 213, \"PROFILE_PICTURE_UPLOADED\",\n EventTypeId == 214, \"PROFILE_PICTURE_DELETED\",\n EventTypeId == 215, \"ADMIN_CHANGED_ACCOUNT_SETTINGS\",\n EventTypeId == 216, \"JOB_IN_QUEUE\",\n EventTypeId == 217, \"DIRECTORY_IMPORT_LIMIT_REACHED\",\n EventTypeId == 218, \"REAPPLIED_MAPPINGS_FAILED\",\n EventTypeId == 219, \"WORKDAY_REAL_TIME_NOTIFICATION\",\n EventTypeId == 220, \"ADMIN_CREATED_PAYMENT_RECORD\",\n EventTypeId == 221, \"ADMIN_UPDATED_PAYMENT_RECORD\",\n EventTypeId == 222, \"ADMIN_DELETED_PAYMENT_RECORD\",\n EventTypeId == 223, \"USER_UNLICENSED\",\n EventTypeId == 224, \"USER_LICENSED_MANUALLY\",\n EventTypeId == 225, \"USER_UNLICENSED_MANUALLY\",\n EventTypeId == 226, \"USER_UNLICENSED_AUTOMATICALLY\",\n EventTypeId == 227, \"USER_LICENSE_FAILED\",\n EventTypeId == 228, \"USERS_LICENSED_BULK\",\n EventTypeId == 229, \"ACCOUNT_NEAR_LIMIT\",\n EventTypeId == 230, \"ACCOUNT_IN_LIMIT\",\n EventTypeId == 231, \"USERS_IN_UNLICENSED_STATE\",\n EventTypeId == 232, \"USER_AGREED_TERMS\",\n EventTypeId == 233, \"USER_DENIED_TERMS\",\n EventTypeId == 234, \"ADMIN_ENABLED_TERMS\",\n EventTypeId == 235, \"ADMIN_UPDATED_TERMS\",\n EventTypeId == 236, \"ADMIN_DISABLED_TERMS\",\n EventTypeId == 237, \"DELETE_USER_FAILED\",\n EventTypeId == 238, \"USER_REDIRECTED_FOR_PASSWORD_CHANGE\",\n EventTypeId == 239, \"IMPORT_USER_FAILED\",\n EventTypeId == 240, \"USER_REVEALED_PASSWORD\",\n EventTypeId == 241, \"CSV_IMPORT_FAILED\",\n EventTypeId == 242, \"JOB_START_FAILED\",\n EventTypeId == 243, \"JOB_TERMINATED\",\n EventTypeId == 244, \"REPORT_GENERATED\",\n EventTypeId == 245, \"REPORT_GENERATION_FAILED\",\n EventTypeId == 246, \"REPORT_GENERATION_TERMINATED\",\n EventTypeId == 247, \"USER_MAPPINGS_FAILED\",\n EventTypeId == 248, \"USER_MAPPINGS_SUCCEEDED\",\n EventTypeId == 249, \"USER_BULK_OPERATION_FAILED\",\n EventTypeId == 250, \"PROVISIONING_APP_CONFIG_ERROR\",\n EventTypeId == 251, \"PROVISIONING_APP_THROTTLED\",\n EventTypeId == 252, \"USER_REMOVELOGINS_FAILED\",\n EventTypeId == 253, \"ENTITLEMENT_MAPPINGS_FAILED\",\n EventTypeId == 254, \"ENTITLEMENT_MAPPINGS_REAPPLIED\",\n EventTypeId == 255, \"MANUALLY_UPDATED_LOGIN\",\n EventTypeId == 291, \"USER_CREATED_BY_TIDP\",\n EventTypeId == 300, \"LDAP_CONNECTOR_STARTED\",\n EventTypeId == 301, \"LDAP_CONNECTOR_NOTIFICATION\",\n EventTypeId == 303, \"LDAP_CONNECTOR_CONFIG_RELOAD\",\n EventTypeId == 304, \"LDAP_CONNECTOR_STOPPED\",\n EventTypeId == 305, \"LDAP_CONNECTOR_FAIL_OVER\",\n EventTypeId == 306, \"MANUALLY_ADDED_LOGIN_FAILURE\",\n EventTypeId == 307, \"LDAP_CONNECTOR_PROVISIONING_ERROR\",\n EventTypeId == 330, \"USER_DISASSOCIATED_FROM_DIRECTORY\",\n EventTypeId == 331, \"USER_ASSOCIATED_TO_DIRECTORY\",\n EventTypeId == 332, \"USER_DIRECTORY_EXTERNAL_ID_UPDATED\",\n EventTypeId == 333, \"USER_DIRECTORY_EXTERNAL_ID_DELETED\",\n EventTypeId == 334, \"USER_NOT_UPDATED_IN_APP\",\n EventTypeId == 400, \"API_BAD_REQUEST\",\n EventTypeId == 401, \"API_UNAUTHORIZED\",\n EventTypeId == 402, \"MAPPING_SKIPPED\",\n EventTypeId == 410, \"BROADCASTER_CREATED\",\n EventTypeId == 411, \"BROADCASTER_UPDATED\",\n EventTypeId == 412, \"BROADCASTER_DELETED\",\n EventTypeId == 501, \"API_INDEX_ACTION\",\n EventTypeId == 502, \"API_SHOW_ACTION\",\n EventTypeId == 503, \"API_RES_ACTION\",\n EventTypeId == 510, \"API_SET_PWD_SALT\",\n EventTypeId == 511, \"API_SET_PWD_CLEAR_TEXT\",\n EventTypeId == 512, \"API_SET_CUSTOM_ATTRS\",\n EventTypeId == 513, \"API_ADD_ROLES\",\n EventTypeId == 514, \"API_REMOVE_ROLES\",\n EventTypeId == 515, \"API_AUTH_ISSUE_TOKEN\",\n EventTypeId == 516, \"API_LOGOUT\",\n EventTypeId == 517, \"API_SET_PWD_SALT_FAILED\",\n EventTypeId == 518, \"API_SET_PWD_CLEAR_TEXT_FAILED\",\n EventTypeId == 519, \"API_SET_CUSTOM_ATTRS_FAILED\",\n EventTypeId == 520, \"API_ADD_ROLES_FAILED\",\n EventTypeId == 521, \"API_REMOVE_ROLES_FAILED\",\n EventTypeId == 522, \"API_AUTH_ISSUE_TOKEN_FAILED\",\n EventTypeId == 523, \"API_LOGOUT_FAILED\",\n EventTypeId == 524, \"API_DESTROY_USER_FAILED\",\n EventTypeId == 525, \"API_GET_INVITE_LINK_FAILED\",\n EventTypeId == 526, \"API_LOCK_USER_FAILED\",\n EventTypeId == 527, \"API_VERIFY_FACTOR_FAILED\",\n EventTypeId == 528, \"API_VERIFY_FACTOR\",\n EventTypeId == 529, \"API_UPDATE_USER\",\n EventTypeId == 530, \"API_DESTROY_USER\",\n EventTypeId == 531, \"API_LOCK_USER\",\n EventTypeId == 532, \"API_UPDATE_USER_FAILED\",\n EventTypeId == 533, \"API_CREATE_USER\",\n EventTypeId == 534, \"API_CREATE_USER_FAILED\",\n EventTypeId == 535, \"API_GET_INVITE_LINK\",\n EventTypeId == 536, \"API_USER_OTPS_RETRIEVED\",\n EventTypeId == 537, \"API_CONFIRM_FACTOR\",\n EventTypeId == 538, \"API_CONFIRM_FACTOR_FAILED\",\n EventTypeId == 539, \"API_TRIGGER_FACTOR\",\n EventTypeId == 540, \"API_ADDED_OTP_DEVICE\",\n EventTypeId == 541, \"DIRECTORY_UPDATED\",\n EventTypeId == 542, \"DIRECTORY_OUS_CHANGED\",\n EventTypeId == 545, \"API_SEND_INVITE_LINK_FAILED\",\n EventTypeId == 546, \"API_SEND_INVITE_LINK\",\n EventTypeId == 550, \"FORCE_LOGOUT_USER\",\n EventTypeId == 551, \"SUSPENDED_USER_VIA_API\",\n EventTypeId == 552, \"REACTIVATED_USER_VIA_API\",\n EventTypeId == 553, \"USER_LOCKED_VIA_API\",\n EventTypeId == 554, \"UNLOCKED_USER_VIA_API\",\n EventTypeId == 555, \"EXTERNAL_ASSUME_USER\",\n EventTypeId == 600, \"APP_CREATED_BY_USER\",\n EventTypeId == 601, \"APP_UPDATED_BY_USER\",\n EventTypeId == 602, \"APP_DELETED_BY_USER\",\n EventTypeId == 700, \"CONNECTOR_CREATED\",\n EventTypeId == 701, \"CONNECTOR_CREATE_FAILED\",\n EventTypeId == 702, \"CONNECTOR_UPDATED\",\n EventTypeId == 703, \"CONNECTOR_UPDATE_FAILED\",\n EventTypeId == 704, \"CONNECTOR_DELETED\",\n EventTypeId == 705, \"CONNECTOR_DELETE_FAILED\",\n EventTypeId == 706, \"CONNECTOR_STATS_UPDATE\",\n EventTypeId == 800, \"PARAMETER_CREATED\",\n EventTypeId == 801, \"PARAMETER_CREATE_FAILED\",\n EventTypeId == 802, \"PARAMETER_UPDATED\",\n EventTypeId == 803, \"PARAMETER_UPDATE_FAILED\",\n EventTypeId == 804, \"PARAMETER_DELETED\",\n EventTypeId == 805, \"PARAMETER_DELETE_FAILED\",\n EventTypeId == 900, \"ONELOGIN_DESKTOP_MAC_LOGIN_SUCCESS\",\n EventTypeId == 901, \"ONELOGIN_DESKTOP_MAC_LOGIN_FAILURE\",\n EventTypeId == 902, \"ONELOGIN_DESKTOP_DEVICE_DELETED\",\n EventTypeId == 903, \"ONELOGIN_DESKTOP_DEVICE_UNBIND\",\n EventTypeId == 904, \"ONELOGIN_DESKTOP_LOGIN_SUCCESS\",\n EventTypeId == 905, \"ONELOGIN_DESKTOP_LOGIN_FAILURE\",\n EventTypeId == 906, \"ONELOGIN_DESKTOP_USER_FAILED_ONELOGIN_LOGIN\",\n EventTypeId == 907, \"DIRECTORY_EXPORT_SUCCESS\",\n EventTypeId == 911, \"ONELOGIN_DESKTOP_REVOKE_CERT_FOR_USER\",\n EventTypeId == 912, \"ONELOGIN_DESKTOP_REVOKE_CERT_FOR_DEVICE\",\n EventTypeId == 931, \"ADAPTIVE_LOGIN_ENABLED\",\n EventTypeId == 932, \"ADAPTIVE_LOGIN_DISABLED\",\n EventTypeId == 950, \"OL_OTP_PUSH_REJECT\",\n EventTypeId == 1001, \"USER_LOGIN_CHALLENGE\",\n EventTypeId == 1002, \"USER_LOGIN_CHALLENGE_FAILED\",\n EventTypeId == 1010, \"USER_REAUTH_SUCCESS\",\n EventTypeId == 1100, \"TEMP_OTP_TOKEN_GENERATED\",\n EventTypeId == 1101, \"TEMP_OTP_TOKEN_REVOKED\",\n EventTypeId == 1200, \"DELEGATED_APP_PRIVILEGE_DENIED\",\n EventTypeId == 1201, \"DELEGATED_USER_PRIVILEGE_DENIED\",\n EventTypeId == 1244, \"USER_ADDED_PHONE_NUMBER\",\n EventTypeId == 1245, \"USER_UPDATED_PHONE_NUMBER\",\n EventTypeId == 1300, \"API_APP_CREATED\",\n EventTypeId == 1301, \"API_APP_CREATE_FAILED\",\n EventTypeId == 1302, \"API_APP_UPDATED\",\n EventTypeId == 1303, \"API_APP_UPDATE_FAILED\",\n EventTypeId == 1304, \"API_APP_DESTROYED\",\n EventTypeId == 1305, \"API_APP_DESTROY_FAILED\",\n EventTypeId == 1400, \"USER_VERIFIED_OTP_DEVICE\",\n EventTypeId == 1401, \"API_AUTH_APP_CREATE_FAILED\",\n EventTypeId == 1402, \"API_AUTH_APP_UPDATED\",\n EventTypeId == 1403, \"API_AUTH_APP_UPDATE_FAILED\",\n EventTypeId == 1404, \"API_AUTH_APP_DESTROYED\",\n EventTypeId == 1405, \"API_AUTH_APP_DESTROY_FAILED\",\n EventTypeId == 1406, \"API_AUTH_SCOPE_CREATED\",\n EventTypeId == 1407, \"API_AUTH_SCOPE_CREATE_FAILED\",\n EventTypeId == 1408, \"API_AUTH_SCOPE_UPDATED\",\n EventTypeId == 1409, \"API_AUTH_SCOPE_UPDATE_FAILED\",\n EventTypeId == 1410, \"API_AUTH_SCOPE_DESTROYED\",\n EventTypeId == 1411, \"API_AUTH_SCOPE_DESTROY_FAILED\",\n EventTypeId == 1412, \"API_AUTH_CLAIM_CREATED\",\n EventTypeId == 1413, \"API_AUTH_CLAIM_CREATE_FAILED\",\n EventTypeId == 1414, \"API_AUTH_CLAIM_UPDATED\",\n EventTypeId == 1415, \"API_AUTH_CLAIM_UPDATE_FAILED\",\n EventTypeId == 1416, \"API_AUTH_CLAIM_DESTROYED\",\n EventTypeId == 1417, \"API_AUTH_CLAIM_DESTROY_FAILED\",\n EventTypeId == 1418, \"API_AUTH_CLIENT_CREATED\",\n EventTypeId == 1419, \"API_AUTH_CLIENT_CREATE_FAILED\",\n EventTypeId == 1420, \"API_AUTH_CLIENT_UPDATED\",\n EventTypeId == 1421, \"API_AUTH_CLIENT_UPDATE_FAILED\",\n EventTypeId == 1422, \"API_AUTH_CLIENT_DESTROYED\",\n EventTypeId == 1423, \"API_AUTH_CLIENT_DESTROY_FAILED\",\n EventTypeId == 1424, \"API_AUTH_APP_CREATED\",\n EventTypeId == 1500, \"SANDBOX_SYNC_STARTED\",\n EventTypeId == 1501, \"SANDBOX_SYNC_FAILED\",\n EventTypeId == 1502, \"SANDBOX_SYNCED\",\n EventTypeId == 1503, \"SANDBOX_DELETED\",\n EventTypeId == 1504, \"SANDBOX_DELETE_FAILED\",\n EventTypeId == 1505, \"SANDBOX_CREATED\",\n EventTypeId == 1506, \"SANDBOX_CREATION_FAILED\",\n EventTypeId == 1507, \"SANDBOX_UPDATED\",\n EventTypeId == 1508, \"SANDBOX_UPDATE_FAILED\",\n EventTypeId == 1509, \"SANDBOX_DELETED_BY_API\",\n EventTypeId == 1510, \"SANDBOX_DELETE_FAILED_BY_API\",\n EventTypeId == 1511, \"SANDBOX_CREATED_BY_API\",\n EventTypeId == 1512, \"SANDBOX_CREATION_FAILED_BY_API\",\n EventTypeId == 1513, \"SANDBOX_UPDATED_BY_API\",\n EventTypeId == 1514, \"SANDBOX_UPDATE_FAILED_BY_API\",\n EventTypeId == 1600, \"PROFILE_DEVICES_DELETE_DEVICE\",\n EventTypeId == 1601, \"PROFILE_DEVICES_RENAME_DEVICE\",\n EventTypeId == 1602, \"PROFILE_DEVICES_UPDATE_DEFAULT\",\n EventTypeId == 1603, \"PROFILE_SETTINGS_UPDATE_LOCALE\",\n EventTypeId == 1604, \"PROFILE_SETTINGS_UPDATE_PHONE\",\n EventTypeId == 1605, \"PROFILE_SETTINGS_UPDATE_DEFAULT_TAB\",\n EventTypeId == 1606, \"PROFILE_SETTINGS_UPDATE_PROFILE_PHOTO\",\n EventTypeId == 1607, \"PROFILE_SETTINGS_UPDATE_APP_AUTO_DETECT\",\n EventTypeId == 1608, \"PROFILE_CHANGE_PASSWORD\",\n EventTypeId == 1609, \"PROFILE_SETTINGS_UPDATE_SHOW_TABS\",\n EventTypeId == 1700, \"RADIUS_ATTRIBUTE_CREATED\",\n EventTypeId == 1701, \"RADIUS_ATTRIBUTE_UPDATED\",\n EventTypeId == 1702, \"RADIUS_ATTRIBUTE_DELETED\",\n EventTypeId == 1801, \"ROLE_CREATED\",\n EventTypeId == 1802, \"ROLE_DELETED\",\n EventTypeId == 1900, \"API_BRAND_CREATED\",\n EventTypeId == 1901, \"API_BRAND_CREATE_FAILED\",\n EventTypeId == 1902, \"API_BRAND_UPDATED\",\n EventTypeId == 1903, \"API_BRAND_UPDATE_FAILED\",\n EventTypeId == 1904, \"API_BRAND_DESTROYED\",\n EventTypeId == 1905, \"API_BRAND_DESTROY_FAILED\",\n EventTypeId == 2000, \"HOOKS_LIST_FUNCTION\",\n EventTypeId == 2001, \"CUSTOM_SMTP_ERROR\",\n EventTypeId == 2002, \"SMTP_SETTINGS_UPDATED\",\n EventTypeId == 2003, \"HOOKS_CREATE_FUNCTION\",\n EventTypeId == 2004, \"HOOKS_CREATE_FUNCTION_FAILED\",\n EventTypeId == 2005, \"HOOKS_GET_FUNCTION\",\n EventTypeId == 2006, \"HOOKS_GET_FUNCTION_LOGS\",\n EventTypeId == 2007, \"HOOKS_UPDATE_FUNCTION\",\n EventTypeId == 2008, \"HOOKS_UPDATE_FUNCTION_FAILED\",\n EventTypeId == 2009, \"HOOKS_DELETE_FUNCTION\",\n EventTypeId == 2010, \"HOOKS_DELETE_FUNCTION_FAILED\",\n EventTypeId == 2011, \"HOOKS_LIST_ENVVAR\",\n EventTypeId == 2012, \"HOOKS_CREATE_ENVVAR\",\n EventTypeId == 2013, \"HOOKS_CREATE_ENVVAR_FAILED\",\n EventTypeId == 2014, \"HOOKS_GET_ENVVAR\",\n EventTypeId == 2015, \"HOOKS_UPDATE_ENVVAR\",\n EventTypeId == 2016, \"HOOKS_UPDATE_ENVVAR_FAILED\",\n EventTypeId == 2017, \"HOOKS_DELETE_ENVVAR\",\n EventTypeId == 2018, \"HOOKS_DELETE_ENVVAR_FAILED\",\n EventTypeId == 2100, \"DELEGATED_PRIVILEGE_CREATED_VIA_API\",\n EventTypeId == 2101, \"DELEGATED_PRIVILEGE_CREATED_BY_USER\",\n EventTypeId == 2102, \"DELEGATED_PRIVILEGE_UPDATED_VIA_API\",\n EventTypeId == 2103, \"DELEGATED_PRIVILEGE_UPDATED_BY_USER\",\n EventTypeId == 2104, \"DELEGATED_PRIVILEGE_DELETED_VIA_API\",\n EventTypeId == 2105, \"DELEGATED_PRIVILEGE_DELETED_BY_USER\",\n EventTypeId == 2106, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_VIA_API\",\n EventTypeId == 2107, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_BY_USER\",\n EventTypeId == 2108, \"DELEGATED_PRIVILEGE_REMOVED_FROM_USER_VIA_API\",\n EventTypeId == 2109, \"DELEGATED_PRIVILEGE_REMOVED_FROM_USER_BY_USER\",\n EventTypeId == 2110, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_VIA_API\",\n EventTypeId == 2111, \"DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_BY_USER\",\n EventTypeId == 2112, \"DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_VIA_API\",\n EventTypeId == 2113, \"DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_BY_USER\",\n EventTypeId == 2114, \"DELEGATED_ROLE_PRIVILEGE_DENIED\",\n EventTypeId == 2201, \"REPORT_CREATED_BY_USER\",\n EventTypeId == 2202, \"REPORT_UPDATED_BY_USER\",\n EventTypeId == 2203, \"REPORT_CLONED_BY_USER\",\n EventTypeId == 2204, \"REPORT_DESTROYED_BY_USER\",\n EventTypeId == 3000, \"OIDC_GENERAL_FAIL\",\n EventTypeId == 3001, \"OIDC_IMPLICIT_FLOW_SUCCESS\",\n EventTypeId == 3002, \"OIDC_IMPLICIT_FLOW_FAILED\",\n EventTypeId == 3003, \"OIDC_GET_CODE_SUCCESS\",\n EventTypeId == 3004, \"OIDC_GET_CODE_FAILED\",\n EventTypeId == 3005, \"OIDC_AUTHORIZATION_CODE_SUCCESS\",\n EventTypeId == 3006, \"OIDC_AUTHORIZATION_CODE_FAILED\",\n EventTypeId == 3007, \"OIDC_CLIENT_CREDENTIALS_SUCCESS\",\n EventTypeId == 3008, \"OIDC_CLIENT_CREDENTIALS_FAILED\",\n EventTypeId == 3009, \"OIDC_PASSWORD_SUCCESS\",\n EventTypeId == 3010, \"OIDC_PASSWORD_FAILED\",\n EventTypeId == 3011, \"OIDC_REFRESH_TOKEN_SUCCESS\",\n EventTypeId == 3012, \"OIDC_REFRESH_TOKEN_FAILED\",\n EventTypeId == 3013, \"OIDC_VALIDATE_TOKEN_SUCCESS\",\n EventTypeId == 3014, \"OIDC_VALIDATE_TOKEN_FAILED\",\n EventTypeId == 3015, \"OIDC_REVOKE_TOKEN_SUCCESS\",\n EventTypeId == 3016, \"OIDC_REVOKE_TOKEN_FAILED\",\n EventTypeId == 3017, \"OIDC_USER_INFO_SUCCESS\",\n EventTypeId == 3018, \"OIDC_USER_INFO_FAILED\",\n EventTypeId == 3019, \"NOTIFICATION_WAS_SENT\",\n EventTypeId == 3020, \"GROUP_CREATED\",\n EventTypeId == 3021, \"GROUP_UPDATED\",\n EventTypeId == 3022, \"GROUP_DESTROYED\",\n EventTypeId == 3023, \"USER_CREATED_NOTE\",\n EventTypeId == 3024, \"DELEGATED_GROUP_PRIVILEGE_DENIED\",\n EventTypeId == 3025, \"DELEGATED_POLICY_PRIVILEGE_DENIED\",\n EventTypeId == 3026, \"PROFILE_DEVICES_UNSET_DEFAULT\",\n EventTypeId == 3027, \"DELEGATED_REPORT_PRIVILEGE_DENIED\",\n EventTypeId == 9000, \"USER_ENABLED_WORKFLOW\",\n EventTypeId == 9001, \"USER_DISABLED_WORKFLOW\",\n EventTypeId == 9002, \"USER_INITIATED_WORKFLOW\",\n EventTypeId == 9003, \"USER_COMPLETED_TASK\",\n EventTypeId == 9004, \"USER_MARKED_TASK_COMPLETE\",\n EventTypeId == 9005, \"USER_MARKED_WORKFLOW_COMPLETE\",\n EventTypeId == 9006, \"USER_MARKED_TASK_INCOMPLETE\",\n EventTypeId == 9007, \"USER_ENABLED_ONBOARDING\",\n EventTypeId == 9008, \"USER_DISABLED_ONBOARDING\",\n EventTypeId == 9009, \"USER_ENABLED_OFFBOARDING\",\n EventTypeId == 9010, \"USER_DISABLED_OFFBOARDING\",\n EventTypeId == 9011, \"USER_INITIATED_OFFBOARDING\",\n EventTypeId == 9012, \"USER_INITIATED_ONBOARDING\",\n EventTypeId == 9013, \"USER_COMPLETED_WORKFLOW\",\n EventTypeId == 9014, \"APP_RULES_LIST_SUCCESS\",\n EventTypeId == 9015, \"APP_RULES_LIST_FAILED\",\n EventTypeId == 9016, \"APP_RULES_CREATE_SUCCESS\",\n EventTypeId == 9017, \"APP_RULES_CREATE_FAILED\",\n EventTypeId == 9018, \"APP_RULES_UPDATE_SUCCESS\",\n EventTypeId == 9019, \"APP_RULES_UPDATE_FAILED\",\n EventTypeId == 9020, \"APP_RULES_GET_SUCCESS\",\n EventTypeId == 9021, \"APP_RULES_GET_FAILED\",\n EventTypeId == 9022, \"APP_RULES_DRYRUN_SUCCESS\",\n EventTypeId == 9023, \"APP_RULES_DRYRUN_FAILED\",\n EventTypeId == 9024, \"APP_RULES_DELETE_SUCCESS\",\n EventTypeId == 9025, \"APP_RULES_DELETE_FAILED\",\n EventTypeId == 9026, \"APP_RULES_SORT_SUCCESS\",\n EventTypeId == 9027, \"APP_RULES_SORT_FAILED\",\n EventTypeId == 9028, \"APP_RULES_APPLY_SUCCESS\",\n EventTypeId == 9029, \"APP_RULES_APPLY_FAILED\",\n EventTypeId == 9030, \"APP_RULES_REFRESH_ENTITLEMENTS_SUCCESS\",\n EventTypeId == 9031, \"APP_RULES_REFRESH_ENTITLEMENTS_FAILED\",\n EventTypeId == 9032, \"APP_RULES_LIST_CONDITIONS_SUCCESS\",\n EventTypeId == 9033, \"APP_RULES_LIST_CONDITIONS_FAILED\",\n EventTypeId == 9034, \"APP_RULES_LIST_CONDITION_OPERATORS_SUCCESS\",\n EventTypeId == 9035, \"APP_RULES_LIST_CONDITION_OPERATORS_FAILED\",\n EventTypeId == 9036, \"APP_RULES_LIST_ACTIONS_SUCCESS\",\n EventTypeId == 9037, \"APP_RULES_LIST_ACTIONS_FAILED\",\n EventTypeId == 9038, \"APP_RULES_LIST_ACTION_VALUES_SUCCESS\",\n EventTypeId == 9039, \"APP_RULES_LIST_ACTION_VALUES_FAILED\",\n EventTypeId == 9040, \"USER_ROLE_MANAGEMENT_GRANTED_FAILED\",\n EventTypeId == 9041, \"USER_ROLE_MANAGEMENT_REVOKED_FAILED\",\n EventTypeId == 9042, \"APP_ADDED_TO_ROLE_FAILED\",\n EventTypeId == 9043, \"APP_REMOVED_FROM_ROLE_FAILED\",\n EventTypeId == 9044, \"USER_MANUALLY_ADDED_TO_ROLE_FAILED\",\n EventTypeId == 9045, \"USER_MANUALLY_REMOVED_FROM_ROLE_FAILED\",\n EventTypeId == 9046, \"ROLE_CREATE_FAILED\",\n EventTypeId == 9047, \"ROLE_DELETE_FAILED\",\n EventTypeId == 9048, \"ROLE_LIST_SUCCESS\",\n EventTypeId == 9049, \"ROLE_LIST_FAILED\",\n EventTypeId == 9050, \"ROLE_GET_SUCCESS\",\n EventTypeId == 9051, \"ROLE_GET_FAILED\",\n EventTypeId == 9052, \"ROLE_UPDATE_SUCCESS\",\n EventTypeId == 9053, \"ROLE_UPDATE_FAILED\",\n EventTypeId == 9054, \"ROLE_LIST_APPS_SUCCESS\",\n EventTypeId == 9055, \"ROLE_LIST_APPS_FAILED\",\n EventTypeId == 9056, \"ROLE_LIST_USERS_SUCCESS\",\n EventTypeId == 9057, \"ROLE_LIST_USERS_FAILED\",\n EventTypeId == 9058, \"ROLE_LIST_ADMINISTRATORS_SUCCESS\",\n EventTypeId == 9059, \"ROLE_LIST_ADMINISTRATORS_FAILED\",\n \"\"\n )\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { @@ -544,7 +586,7 @@ "version": "[variables('parserVersion1')]", "source": { "kind": "Solution", - "name": "OneLogin IAM", + "name": "OneLoginIAM", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -560,18 +602,25 @@ } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.2", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "OneLoginIAM", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The OneLogin solution for Microsoft Sentinel provides the capability to ingest common OneLogin IAM Platform events into Microsoft Sentinel through Webhooks.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor HTTP Data Collector API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n
\n

Data Connectors: 1, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { "kind": "Solution", - "name": "OneLogin IAM", + "name": "OneLoginIAM", "sourceId": "[variables('_solutionId')]" }, "author": { diff --git a/Solutions/OneLoginIAM/Parsers/OneLogin.yaml b/Solutions/OneLoginIAM/Parsers/OneLogin.yaml index f38ee515df8..a7e0328b7d1 100644 --- a/Solutions/OneLoginIAM/Parsers/OneLogin.yaml +++ b/Solutions/OneLoginIAM/Parsers/OneLogin.yaml @@ -1,13 +1,20 @@ id: cd80d5ce-6c89-4d23-9f98-77066a599982 Function: Title: Parser for OneLogin - Version: '1.0.0' - LastUpdated: '2023-08-23' + Version: '1.0.1' + LastUpdated: '2023-09-25' Category: Microsoft Sentinel Parser FunctionName: OneLogin FunctionAlias: OneLogin FunctionQuery: | OneLogin_CL + | extend app_name_s = column_ifexists("app_name_s", ''), + app_id_d = column_ifexists("app_id_d", ''), + role_name_s = column_ifexists("role_name_s", ''), + role_id_d = column_ifexists("role_id_d", ''), + user_attributes_username_s = column_ifexists("user_attributes_username_s", ''), + user_attributes_department_s = column_ifexists("user_attributes_department_s", ''), + user_attributes_title_s = column_ifexists("user_attributes_title_s", '') | project-rename TargetAppName = app_name_s, TargetAppId = app_id_d, RoleName = role_name_s, diff --git a/Solutions/OneLoginIAM/ReleaseNotes.md b/Solutions/OneLoginIAM/ReleaseNotes.md new file mode 100644 index 00000000000..4075994d6a6 --- /dev/null +++ b/Solutions/OneLoginIAM/ReleaseNotes.md @@ -0,0 +1,5 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------| +| 3.0.0 | 25-09-2023 | Modified **Parser** for query optimization. | +| | | Manual deployment instructions updated for **Data Connector** | + diff --git a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLConflictingMacAddress.yaml b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLConflictingMacAddress.yaml index febcea8c894..3249272b483 100644 --- a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLConflictingMacAddress.yaml +++ b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLConflictingMacAddress.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -35,5 +38,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLDroppingSessionWithSentTraffic.yaml b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLDroppingSessionWithSentTraffic.yaml index bbb612d6bc1..78d8c9e38d3 100644 --- a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLDroppingSessionWithSentTraffic.yaml +++ b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLDroppingSessionWithSentTraffic.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -36,5 +39,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLFileTypeWasChanged.yaml b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLFileTypeWasChanged.yaml index 0f74b67bec6..e88356b23f9 100644 --- a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLFileTypeWasChanged.yaml +++ b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLFileTypeWasChanged.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -32,5 +35,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: FileCustomEntity -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLInboundRiskPorts.yaml b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLInboundRiskPorts.yaml index de1987e25b2..281ef14caeb 100644 --- a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLInboundRiskPorts.yaml +++ b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLInboundRiskPorts.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -29,5 +32,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleAttackWithoutResponse.yaml b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleAttackWithoutResponse.yaml index d8c6abf3530..5d9ca1e3395 100644 --- a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleAttackWithoutResponse.yaml +++ b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleAttackWithoutResponse.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -35,5 +38,5 @@ entityMappings: fieldMappings: - identifier: Url columnName: UrlCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleFlooding.yaml b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleFlooding.yaml index ab69ea35774..b7cc42c4522 100644 --- a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleFlooding.yaml +++ b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleFlooding.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -32,5 +35,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossiblePortScan.yaml b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossiblePortScan.yaml index 35e70c1dffa..9354d3e9c5e 100644 --- a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossiblePortScan.yaml +++ b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossiblePortScan.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -29,5 +32,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled diff --git a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPrivilegesWasChanged.yaml b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPrivilegesWasChanged.yaml index ac1ea11bac6..bfbcb784c38 100644 --- a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPrivilegesWasChanged.yaml +++ b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPrivilegesWasChanged.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent queryFrequency: 1h queryPeriod: 14d triggerOperator: gt @@ -34,5 +37,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: AccountCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPutMethodInHighRiskFileType.yaml b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPutMethodInHighRiskFileType.yaml index 02688bb6c55..d8553fee7b3 100644 --- a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPutMethodInHighRiskFileType.yaml +++ b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPutMethodInHighRiskFileType.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent queryFrequency: 10m queryPeriod: 10m triggerOperator: gt @@ -30,5 +33,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: FileCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled diff --git a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLUnexpectedCountries.yaml b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLUnexpectedCountries.yaml index fc697d0aab4..80a2d54058f 100644 --- a/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLUnexpectedCountries.yaml +++ b/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLUnexpectedCountries.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -33,5 +36,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/PaloAltoCDL/Data Connectors/Connector_PaloAlto_CDL_CEF.json b/Solutions/PaloAltoCDL/Data Connectors/Connector_PaloAlto_CDL_CEF.json index bf1d1c2b037..36f2416fdc6 100644 --- a/Solutions/PaloAltoCDL/Data Connectors/Connector_PaloAlto_CDL_CEF.json +++ b/Solutions/PaloAltoCDL/Data Connectors/Connector_PaloAlto_CDL_CEF.json @@ -1,6 +1,6 @@ { "id": "PaloAltoCDL", - "title": "Palo Alto Networks Cortex Data Lake (CDL)", + "title": "[Deprecated] Palo Alto Networks Cortex Data Lake (CDL) via Legacy Agent", "publisher": "Palo Alto Networks", "descriptionMarkdown": "The [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) data connector provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview.html) into Microsoft Sentinel.", "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution.", diff --git a/Solutions/PaloAltoCDL/Data Connectors/template_PaloAlto_CDLAMA.json b/Solutions/PaloAltoCDL/Data Connectors/template_PaloAlto_CDLAMA.json new file mode 100644 index 00000000000..7b988559461 --- /dev/null +++ b/Solutions/PaloAltoCDL/Data Connectors/template_PaloAlto_CDLAMA.json @@ -0,0 +1,115 @@ +{ + "id": "PaloAltoCDLAma", + "title": "[Recommended] Palo Alto Networks Cortex Data Lake (CDL) via AMA", + "publisher": "Palo Alto Networks", + "descriptionMarkdown": "The [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) data connector provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview.html) into Microsoft Sentinel.", + "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "PaloAltoNetworksCDL", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Palo Alto Networks'\n |where DeviceProduct =~ 'LF'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description" : "Top 10 Destinations", + "query": "PaloAltoCDLEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (PaloAltoNetworksCDL)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Palo Alto Networks'\n |where DeviceProduct =~ 'LF'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Palo Alto Networks'\n |where DeviceProduct =~ 'LF'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "title": "", + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine", + "instructions": [ + ] + }, + { + "title": "Step B. Configure Cortex Data Lake to forward logs to a Syslog Server using CEF", + "description": "[Follow the instructions](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-from-logging-service-to-syslog-server.html) to configure logs forwarding from Cortex Data Lake to a Syslog Server.", + "instructions": [ + ] + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "title": "2. Secure your machine ", + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)" + } + ] +} diff --git a/Solutions/PaloAltoCDL/Data/Solution_PaloAltoCDL.json b/Solutions/PaloAltoCDL/Data/Solution_PaloAltoCDL.json index 46fd29efcc1..9c82bdc82f8 100644 --- a/Solutions/PaloAltoCDL/Data/Solution_PaloAltoCDL.json +++ b/Solutions/PaloAltoCDL/Data/Solution_PaloAltoCDL.json @@ -2,12 +2,12 @@ "Name": "PaloAltoCDL", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) solution provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview) into Microsoft Sentinel.\n\r**Underlying Microsoft Technologies used:**\n\rThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\ra. [Agent-based log collection (CEF over Syslog)](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)", + "Description": "The [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) solution provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview) into Microsoft Sentinel.\n\r\n1. **PaloAltoCDL via AMA** - This data connector helps in ingesting PaloAltoCDL logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **PaloAltoCDL via Legacy Agent** - This data connector helps in ingesting PaloAltoCDL logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of PaloAltoCDL via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", "Workbooks": [ "Workbooks/PaloAltoCDL.json" ], "Parsers": [ - "Parsers/PaloAltoCDLEvent.txt" + "Parsers/PaloAltoCDLEvent.yaml" ], "Hunting Queries": [ "Hunting Queries/PaloAltoCDLCriticalEventResult.yaml", @@ -22,7 +22,8 @@ "Hunting Queries/PaloAltoCDLRarePortsbyUser.yaml" ], "Data Connectors": [ - "Data Connectors/Connector_PaloAlto_CDL_CEF.json" + "Data Connectors/Connector_PaloAlto_CDL_CEF.json", + "Data Connectors/template_PaloAlto_CDLAMA.json" ], "Analytic Rules": [ "Analytic Rules/PaloAltoCDLConflictingMacAddress.yaml", diff --git a/Solutions/PaloAltoCDL/Data/system_generated_metadata.json b/Solutions/PaloAltoCDL/Data/system_generated_metadata.json new file mode 100644 index 00000000000..2fef117cbba --- /dev/null +++ b/Solutions/PaloAltoCDL/Data/system_generated_metadata.json @@ -0,0 +1,33 @@ +{ + "Name": "PaloAltoCDL", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "The [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) solution provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview) into Microsoft Sentinel.\n\r\n1. **PaloAltoCDL via AMA** - This data connector helps in ingesting PaloAltoCDL logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **PaloAltoCDL via Legacy Agent** - This data connector helps in ingesting PaloAltoCDL logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of PaloAltoCDL via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "Metadata": "SolutionMetadata.json", + "BasePath": "C:\\One\\Azure\\Azure-Sentinel\\Solutions\\PaloAltoCDL", + "TemplateSpec": true, + "Is1PConnector": false, + "Version": "3.0.0", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-paloaltocdl", + "providers": [ + "Palo Alto Networks" + ], + "categories": { + "domains": [ + "Security - Cloud Security" + ] + }, + "firstPublishDate": "2021-10-23", + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "Data Connectors": "[\n \"Data Connectors/Connector_PaloAlto_CDL_CEF.json\",\n \"Data Connectors/template_PaloAlto_CDLAMA.json\"\n]", + "Parsers": "[\n \"PaloAltoCDLEvent.yaml\"\n]", + "Workbooks": "[\n \"Workbooks/PaloAltoCDL.json\"\n]", + "Analytic Rules": "[\n \"PaloAltoCDLConflictingMacAddress.yaml\",\n \"PaloAltoCDLDroppingSessionWithSentTraffic.yaml\",\n \"PaloAltoCDLFileTypeWasChanged.yaml\",\n \"PaloAltoCDLInboundRiskPorts.yaml\",\n \"PaloAltoCDLPossibleAttackWithoutResponse.yaml\",\n \"PaloAltoCDLPossibleFlooding.yaml\",\n \"PaloAltoCDLPossiblePortScan.yaml\",\n \"PaloAltoCDLPrivilegesWasChanged.yaml\",\n \"PaloAltoCDLPutMethodInHighRiskFileType.yaml\",\n \"PaloAltoCDLUnexpectedCountries.yaml\"\n]", + "Hunting Queries": "[\n \"PaloAltoCDLCriticalEventResult.yaml\",\n \"PaloAltoCDLFilePermissionWithPutRequest.yaml\",\n \"PaloAltoCDLIPsByPorts.yaml\",\n \"PaloAltoCDLIncompleteApplicationProtocol.yaml\",\n \"PaloAltoCDLMultiDenyResultbyUser.yaml\",\n \"PaloAltoCDLOutdatedAgentVersions.yaml\",\n \"PaloAltoCDLOutdatedConfigVersions.yaml\",\n \"PaloAltoCDLRareApplicationLayerProtocol.yaml\",\n \"PaloAltoCDLRareFileRequests.yaml\",\n \"PaloAltoCDLRarePortsbyUser.yaml\"\n]" +} diff --git a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLCriticalEventResult.yaml b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLCriticalEventResult.yaml index c7fa6ecd4e7..157f7c0841e 100644 --- a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLCriticalEventResult.yaml +++ b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLCriticalEventResult.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLFilePermissionWithPutRequest.yaml b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLFilePermissionWithPutRequest.yaml index f4a1e3e3e1f..fa47b79cf8f 100644 --- a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLFilePermissionWithPutRequest.yaml +++ b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLFilePermissionWithPutRequest.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLIPsByPorts.yaml b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLIPsByPorts.yaml index 8bc5b0cd4ae..eef780ab970 100644 --- a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLIPsByPorts.yaml +++ b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLIPsByPorts.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLIncompleteApplicationProtocol.yaml b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLIncompleteApplicationProtocol.yaml index 6f5b814bacb..5c39e60b327 100644 --- a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLIncompleteApplicationProtocol.yaml +++ b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLIncompleteApplicationProtocol.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLMultiDenyResultbyUser.yaml b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLMultiDenyResultbyUser.yaml index 639a3a7ac5f..c3ae5a69935 100644 --- a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLMultiDenyResultbyUser.yaml +++ b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLMultiDenyResultbyUser.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLOutdatedAgentVersions.yaml b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLOutdatedAgentVersions.yaml index e503e9a0384..ce1f538ff93 100644 --- a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLOutdatedAgentVersions.yaml +++ b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLOutdatedAgentVersions.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLOutdatedConfigVersions.yaml b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLOutdatedConfigVersions.yaml index ac76cd48c2d..32c47737c92 100644 --- a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLOutdatedConfigVersions.yaml +++ b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLOutdatedConfigVersions.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRareApplicationLayerProtocol.yaml b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRareApplicationLayerProtocol.yaml index 03ce19e46b2..d8b07c2d787 100644 --- a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRareApplicationLayerProtocol.yaml +++ b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRareApplicationLayerProtocol.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRareFileRequests.yaml b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRareFileRequests.yaml index c92f33d43a4..d749917529b 100644 --- a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRareFileRequests.yaml +++ b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRareFileRequests.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRarePortsbyUser.yaml b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRarePortsbyUser.yaml index b998585f9b1..501d1113fea 100644 --- a/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRarePortsbyUser.yaml +++ b/Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRarePortsbyUser.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: PaloAltoCDL dataTypes: - PaloAltoCDLEvent + - connectorId: PaloAltoCDLAma + dataTypes: + - PaloAltoCDLEvent tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/PaloAltoCDL/Package/3.0.0.zip b/Solutions/PaloAltoCDL/Package/3.0.0.zip new file mode 100644 index 00000000000..c08f94fc91a Binary files /dev/null and b/Solutions/PaloAltoCDL/Package/3.0.0.zip differ diff --git a/Solutions/PaloAltoCDL/Package/createUiDefinition.json b/Solutions/PaloAltoCDL/Package/createUiDefinition.json index c281e12e134..87d4931541b 100644 --- a/Solutions/PaloAltoCDL/Package/createUiDefinition.json +++ b/Solutions/PaloAltoCDL/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) solution provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview) into Microsoft Sentinel.\n\r**Underlying Microsoft Technologies used:**\n\rThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\ra. [Agent-based log collection (CEF over Syslog)](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/PaloAltoCDL/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) solution provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview) into Microsoft Sentinel.\n\r\n1. **PaloAltoCDL via AMA** - This data connector helps in ingesting PaloAltoCDL logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **PaloAltoCDL via Legacy Agent** - This data connector helps in ingesting PaloAltoCDL logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of PaloAltoCDL via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,7 +60,7 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This solution installs the data connector for ingesting CDL logs into Microsoft Sentinel. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This solution installs the data connector for ingesting CDL logs into Microsoft Sentinel. After installing the solution, configure and enable this data connector by following guidance in Manage solution view.." } }, { @@ -95,7 +95,7 @@ "name": "workbooks-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The workbook installed with the Palo Alto Networks Cortex Data Lake help’s you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." + "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." } }, { diff --git a/Solutions/PaloAltoCDL/Package/mainTemplate.json b/Solutions/PaloAltoCDL/Package/mainTemplate.json index 2796042848e..eb3e941550e 100644 --- a/Solutions/PaloAltoCDL/Package/mainTemplate.json +++ b/Solutions/PaloAltoCDL/Package/mainTemplate.json @@ -42,191 +42,317 @@ "_solutionId": "[variables('solutionId')]", "email": "support@microsoft.com", "_email": "[variables('email')]", + "_solutionName": "PaloAltoCDL", + "_solutionVersion": "3.0.0", + "uiConfigId1": "PaloAltoCDL", + "_uiConfigId1": "[variables('uiConfigId1')]", + "dataConnectorContentId1": "PaloAltoCDL", + "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", + "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "_dataConnectorId1": "[variables('dataConnectorId1')]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", + "dataConnectorVersion1": "1.0.0", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "uiConfigId2": "PaloAltoCDLAma", + "_uiConfigId2": "[variables('uiConfigId2')]", + "dataConnectorContentId2": "PaloAltoCDLAma", + "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", + "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "_dataConnectorId2": "[variables('dataConnectorId2')]", + "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", + "dataConnectorVersion2": "1.0.0", + "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", + "parserName1": "PaloAltoCDLEvent", + "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", + "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", + "_parserId1": "[variables('parserId1')]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", + "parserVersion1": "1.0.0", + "parserContentId1": "PaloAltoCDLEvent-Parser", + "_parserContentId1": "[variables('parserContentId1')]", + "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", "workbookVersion1": "1.0.0", "workbookContentId1": "PaloAltoCDL", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "parserVersion1": "1.0.0", - "parserContentId1": "PaloAltoCDLEvent-Parser", - "_parserContentId1": "[variables('parserContentId1')]", - "parserName1": "PaloAltoCDLEvent", - "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", - "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1')))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "analyticRuleVersion1": "1.0.1", + "analyticRulecontentId1": "976d2eee-51cb-11ec-bf63-0242ac130002", + "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId1'),'-', variables('analyticRuleVersion1'))))]", + "analyticRuleVersion2": "1.0.2", + "analyticRulecontentId2": "ba663b74-51f4-11ec-bf63-0242ac130002", + "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2'))))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId2'),'-', variables('analyticRuleVersion2'))))]", + "analyticRuleVersion3": "1.0.1", + "analyticRulecontentId3": "9150ad68-51c8-11ec-bf63-0242ac130002", + "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3'))))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId3'),'-', variables('analyticRuleVersion3'))))]", + "analyticRuleVersion4": "1.0.1", + "analyticRulecontentId4": "b2dd2dac-51c9-11ec-bf63-0242ac130002", + "_analyticRulecontentId4": "[variables('analyticRulecontentId4')]", + "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId4'))]", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId4'))))]", + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId4'),'-', variables('analyticRuleVersion4'))))]", + "analyticRuleVersion5": "1.0.2", + "analyticRulecontentId5": "b6d54840-51d3-11ec-bf63-0242ac130002", + "_analyticRulecontentId5": "[variables('analyticRulecontentId5')]", + "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId5'))]", + "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId5'))))]", + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId5'),'-', variables('analyticRuleVersion5'))))]", + "analyticRuleVersion6": "1.0.2", + "analyticRulecontentId6": "feb185cc-51f4-11ec-bf63-0242ac130002", + "_analyticRulecontentId6": "[variables('analyticRulecontentId6')]", + "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId6'))]", + "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId6'))))]", + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId6'),'-', variables('analyticRuleVersion6'))))]", + "analyticRuleVersion7": "1.0.2", + "analyticRulecontentId7": "3575a9c0-51c9-11ec-bf63-0242ac130002", + "_analyticRulecontentId7": "[variables('analyticRulecontentId7')]", + "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId7'))]", + "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId7'))))]", + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId7'),'-', variables('analyticRuleVersion7'))))]", + "analyticRuleVersion8": "1.0.2", + "analyticRulecontentId8": "38f9e010-51ca-11ec-bf63-0242ac130002", + "_analyticRulecontentId8": "[variables('analyticRulecontentId8')]", + "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId8'))]", + "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId8'))))]", + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId8'),'-', variables('analyticRuleVersion8'))))]", + "analyticRuleVersion9": "1.0.2", + "analyticRulecontentId9": "f12e9d10-51ca-11ec-bf63-0242ac130002", + "_analyticRulecontentId9": "[variables('analyticRulecontentId9')]", + "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId9'))]", + "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId9'))))]", + "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId9'),'-', variables('analyticRuleVersion9'))))]", + "analyticRuleVersion10": "1.0.2", + "analyticRulecontentId10": "9fcc7734-4d1b-11ec-81d3-0242ac130003", + "_analyticRulecontentId10": "[variables('analyticRulecontentId10')]", + "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId10'))]", + "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId10'))))]", + "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId10'),'-', variables('analyticRuleVersion10'))))]", "huntingQueryVersion1": "1.0.0", "huntingQuerycontentId1": "97760cb0-511e-11ec-bf63-0242ac130002", "_huntingQuerycontentId1": "[variables('huntingQuerycontentId1')]", "huntingQueryId1": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId1'))]", - "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId1')))]", + "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId1'))))]", + "_huntingQuerycontentProductId1": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId1'),'-', variables('huntingQueryVersion1'))))]", "huntingQueryVersion2": "1.0.0", "huntingQuerycontentId2": "2af5e154-511f-11ec-bf63-0242ac130002", "_huntingQuerycontentId2": "[variables('huntingQuerycontentId2')]", "huntingQueryId2": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId2'))]", - "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId2')))]", + "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId2'))))]", + "_huntingQuerycontentProductId2": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId2'),'-', variables('huntingQueryVersion2'))))]", "huntingQueryVersion3": "1.0.0", "huntingQuerycontentId3": "a8887944-4c72-11ec-81d3-0242ac130003", "_huntingQuerycontentId3": "[variables('huntingQuerycontentId3')]", "huntingQueryId3": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId3'))]", - "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId3')))]", + "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId3'))))]", + "_huntingQuerycontentProductId3": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId3'),'-', variables('huntingQueryVersion3'))))]", "huntingQueryVersion4": "1.0.0", "huntingQuerycontentId4": "7cbd46ce-5121-11ec-bf63-0242ac130002", "_huntingQuerycontentId4": "[variables('huntingQuerycontentId4')]", "huntingQueryId4": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId4'))]", - "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId4')))]", + "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId4'))))]", + "_huntingQuerycontentProductId4": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId4'),'-', variables('huntingQueryVersion4'))))]", "huntingQueryVersion5": "1.0.0", "huntingQuerycontentId5": "04456860-5122-11ec-bf63-0242ac130002", "_huntingQuerycontentId5": "[variables('huntingQuerycontentId5')]", "huntingQueryId5": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId5'))]", - "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId5')))]", + "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId5'))))]", + "_huntingQuerycontentProductId5": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId5'),'-', variables('huntingQueryVersion5'))))]", "huntingQueryVersion6": "1.0.0", "huntingQuerycontentId6": "555bf415-e171-4ad2-920f-1a4a96a9644c", "_huntingQuerycontentId6": "[variables('huntingQuerycontentId6')]", "huntingQueryId6": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId6'))]", - "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId6')))]", + "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId6'))))]", + "_huntingQuerycontentProductId6": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId6'),'-', variables('huntingQueryVersion6'))))]", "huntingQueryVersion7": "1.0.0", "huntingQuerycontentId7": "6e4b6758-23a5-409b-a444-9bdef78e9dcc", "_huntingQuerycontentId7": "[variables('huntingQuerycontentId7')]", "huntingQueryId7": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId7'))]", - "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId7')))]", + "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId7'))))]", + "_huntingQuerycontentProductId7": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId7'),'-', variables('huntingQueryVersion7'))))]", "huntingQueryVersion8": "1.0.0", "huntingQuerycontentId8": "0a18756a-5123-11ec-bf63-0242ac130002", "_huntingQuerycontentId8": "[variables('huntingQuerycontentId8')]", "huntingQueryId8": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId8'))]", - "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId8')))]", + "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId8'))))]", + "_huntingQuerycontentProductId8": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId8'),'-', variables('huntingQueryVersion8'))))]", "huntingQueryVersion9": "1.0.0", "huntingQuerycontentId9": "93ae5df2-4c74-11ec-81d3-0242ac130003", "_huntingQuerycontentId9": "[variables('huntingQuerycontentId9')]", "huntingQueryId9": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId9'))]", - "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId9')))]", + "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId9'))))]", + "_huntingQuerycontentProductId9": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId9'),'-', variables('huntingQueryVersion9'))))]", "huntingQueryVersion10": "1.0.0", "huntingQuerycontentId10": "ce9d58ce-51cd-11ec-bf63-0242ac130002", "_huntingQuerycontentId10": "[variables('huntingQuerycontentId10')]", "huntingQueryId10": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId10'))]", - "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId10')))]", - "uiConfigId1": "PaloAltoCDL", - "_uiConfigId1": "[variables('uiConfigId1')]", - "dataConnectorContentId1": "PaloAltoCDL", - "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", - "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", - "dataConnectorVersion1": "1.0.0", - "analyticRuleVersion1": "1.0.0", - "analyticRulecontentId1": "976d2eee-51cb-11ec-bf63-0242ac130002", - "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", - "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1')))]", - "analyticRuleVersion2": "1.0.1", - "analyticRulecontentId2": "ba663b74-51f4-11ec-bf63-0242ac130002", - "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", - "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", - "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2')))]", - "analyticRuleVersion3": "1.0.0", - "analyticRulecontentId3": "9150ad68-51c8-11ec-bf63-0242ac130002", - "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", - "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", - "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3')))]", - "analyticRuleVersion4": "1.0.0", - "analyticRulecontentId4": "b2dd2dac-51c9-11ec-bf63-0242ac130002", - "_analyticRulecontentId4": "[variables('analyticRulecontentId4')]", - "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId4'))]", - "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId4')))]", - "analyticRuleVersion5": "1.0.1", - "analyticRulecontentId5": "b6d54840-51d3-11ec-bf63-0242ac130002", - "_analyticRulecontentId5": "[variables('analyticRulecontentId5')]", - "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId5'))]", - "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId5')))]", - "analyticRuleVersion6": "1.0.1", - "analyticRulecontentId6": "feb185cc-51f4-11ec-bf63-0242ac130002", - "_analyticRulecontentId6": "[variables('analyticRulecontentId6')]", - "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId6'))]", - "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId6')))]", - "analyticRuleVersion7": "1.0.1", - "analyticRulecontentId7": "3575a9c0-51c9-11ec-bf63-0242ac130002", - "_analyticRulecontentId7": "[variables('analyticRulecontentId7')]", - "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId7'))]", - "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId7')))]", - "analyticRuleVersion8": "1.0.1", - "analyticRulecontentId8": "38f9e010-51ca-11ec-bf63-0242ac130002", - "_analyticRulecontentId8": "[variables('analyticRulecontentId8')]", - "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId8'))]", - "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId8')))]", - "analyticRuleVersion9": "1.0.1", - "analyticRulecontentId9": "f12e9d10-51ca-11ec-bf63-0242ac130002", - "_analyticRulecontentId9": "[variables('analyticRulecontentId9')]", - "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId9'))]", - "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId9')))]", - "analyticRuleVersion10": "1.0.1", - "analyticRulecontentId10": "9fcc7734-4d1b-11ec-81d3-0242ac130003", - "_analyticRulecontentId10": "[variables('analyticRulecontentId10')]", - "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId10'))]", - "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId10')))]" + "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId10'))))]", + "_huntingQuerycontentProductId10": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId10'),'-', variables('huntingQueryVersion10'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('workbookTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "properties": { - "description": "PaloAltoCDL Workbook with template", - "displayName": "PaloAltoCDL workbook template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLWorkbook with template version 2.0.4", + "description": "PaloAltoCDL data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('workbookVersion1')]", + "contentVersion": "[variables('dataConnectorVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.Insights/workbooks", - "name": "[variables('workbookContentId1')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", - "kind": "shared", - "apiVersion": "2021-08-01", - "metadata": { - "description": "Sets the time name for analysis" - }, + "kind": "GenericUI", "properties": { - "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"**NOTE**: This data connector depends on a parser based on Kusto Function **PaloAltoCDLEvent** to work as expected. [Follow steps to get this Kusto Function](https://aka.ms/sentinel-paloaltocdl-parser)\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"cd8447d9-b096-4673-92d8-2a1e8291a125\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"description\":\"Sets the time name for analysis\",\"value\":{\"durationMs\":7776000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":900000},{\"durationMs\":3600000},{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":7776000000}]},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};\",\"size\":0,\"title\":\"Events Over Time\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"graphSettings\":{\"type\":0}},\"customWidth\":\"60\",\"name\":\"query - 12\",\"styleSettings\":{\"maxWidth\":\"55\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n | summarize Result = count() by EventSeverity\",\"size\":3,\"title\":\"Events Severity\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 0\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where isnotempty(SrcIpAddr)\\r\\n| summarize dcount(SrcIpAddr) \",\"size\":3,\"title\":\"Unique IP Addresses\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 0\"}]},\"name\":\"group - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where EventResourceId contains \\\"THREAT\\\"\\r\\n| count \",\"size\":3,\"title\":\"Total Threat Events\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 0\"}]},\"name\":\"group - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where EventResourceId contains \\\"THREAT\\\"\\r\\n| where isnotempty(DvcAction) \\r\\n| where EventResult contains \\\"drop\\\" or EventResult contains \\\"deny\\\" or EventResult contains \\\"reset\\\" or EventResult contains \\\"block\\\" or EventResult contains \\\"lockout\\\" or EventResult contains \\\"override\\\"\\r\\n| count \",\"size\":3,\"title\":\"Total Threat Response\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 0\"}]},\"name\":\"group - 2\"}]},\"customWidth\":\"10\",\"name\":\"group - 9\",\"styleSettings\":{\"maxWidth\":\"100\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where EventResourceId contains \\\"THREAT\\\"\\r\\n| summarize ResponseAction = count() by DvcAction\",\"size\":3,\"title\":\"Response action \",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10\",\"padding\":\"10\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\" PaloAltoCDLEvent\\r\\n | where isnotempty(NetworkApplicationProtocol) \\r\\n | summarize ApplicationLayerProtocol = count() by NetworkApplicationProtocol\",\"size\":3,\"title\":\"Application layer protocol\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 15\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where EventResourceId contains \\\"THREAT\\\"\\r\\n| where isnotempty(IndicatorThreatType) \\r\\n| summarize ThreatType = count() by IndicatorThreatType\",\"size\":3,\"title\":\"Threat Types\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where isnotempty(DstUsername)\\r\\n| sort by TimeGenerated desc \\r\\n| project User=DstUsername, ThreatEvent=strcat(iff(EventResourceId contains \\\"THREAT\\\", '❌', '✅')), SourceAddress=SrcIpAddr\",\"size\":0,\"title\":\"Latest events\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":50,\"filter\":true}},\"customWidth\":\"35\",\"name\":\"query - 12\",\"styleSettings\":{\"maxWidth\":\"33\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where isnotempty(DstPortNumber) \\r\\n| summarize TopPorts = count() by tostring(DstPortNumber)\\r\\n| top 20 by TopPorts desc \",\"size\":3,\"title\":\"Top ports\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"tileSettings\":{\"showBorder\":false},\"graphSettings\":{\"type\":0},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"DstPortNumber\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"DstPortNumber\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"DstPortNumber\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"30\",\"name\":\"query - 14\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where EventResourceId contains \\\"THREAT\\\"\\r\\n| where isnotempty(Url)\\r\\n| summarize ThreatEventUrl = count() by Url\\r\\n| top 10 by ThreatEventUrl desc \",\"size\":3,\"title\":\"Top Threat Event URLs \",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"35\",\"name\":\"query - 10\",\"styleSettings\":{\"maxWidth\":\"100\"}}],\"fromTemplateId\":\"sentinel-PaloAltoCDLWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", - "version": "1.0", - "sourceId": "[variables('workspaceResourceId')]", - "category": "sentinel" + "connectorUiConfig": { + "id": "[variables('_uiConfigId1')]", + "title": "[Deprecated] Palo Alto Networks Cortex Data Lake (CDL) via Legacy Agent", + "publisher": "Palo Alto Networks", + "descriptionMarkdown": "The [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) data connector provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview.html) into Microsoft Sentinel.", + "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "PaloAltoNetworksCDL", + "baseQuery": "PaloAltoCDLEvent" + } + ], + "sampleQueries": [ + { + "description": "Top 10 Destinations", + "query": "PaloAltoCDLEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (PaloAltoNetworksCDL)", + "lastDataReceivedQuery": "PaloAltoCDLEvent\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "PaloAltoCDLEvent\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(1d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution." + }, + { + "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", + "innerSteps": [ + { + "title": "1.1 Select or create a Linux machine", + "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." + }, + { + "title": "1.2 Install the CEF collector on the Linux machine", + "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId", + "PrimaryKey" + ], + "label": "Run the following command to install and apply the CEF collector:", + "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" + }, + "type": "CopyableLabel" + } + ] + } + ], + "title": "1. Linux Syslog agent configuration" + }, + { + "description": "[Follow the instructions](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-from-logging-service-to-syslog-server.html) to configure logs forwarding from Cortex Data Lake to a Syslog Server.", + "title": "2. Configure Cortex Data Lake to forward logs to a Syslog Server using CEF" + }, + { + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" + }, + "type": "CopyableLabel" + } + ], + "title": "3. Validate connection" + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "4. Secure your machine " + } + ] + } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { - "description": "@{workbookKey=PaloAltoCDL; logoFileName=paloalto_logo.svg; description=Sets the time name for analysis; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Palo Alto Networks Cortex Data Lake; templateRelativePath=PaloAltoCDL.json; subtitle=; provider=Palo Alto Networks}.description", - "parentId": "[variables('workbookId1')]", - "contentId": "[variables('_workbookContentId1')]", - "kind": "Workbook", - "version": "[variables('workbookVersion1')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -241,95 +367,330 @@ "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "contentId": "CommonSecurityLog", - "kind": "DataType" - }, - { - "contentId": "PaloAltoCDL", - "kind": "DataConnector" - } - ] } } } ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "[Deprecated] Palo Alto Networks Cortex Data Lake (CDL) via Legacy Agent", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId1')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", + "source": { + "kind": "Solution", + "name": "PaloAltoCDL", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('parserTemplateSpecName1')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, + "kind": "GenericUI", "properties": { - "description": "PaloAltoCDLEvent Data Parser with template", - "displayName": "PaloAltoCDLEvent Data Parser template" + "connectorUiConfig": { + "title": "[Deprecated] Palo Alto Networks Cortex Data Lake (CDL) via Legacy Agent", + "publisher": "Palo Alto Networks", + "descriptionMarkdown": "The [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) data connector provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview.html) into Microsoft Sentinel.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "PaloAltoNetworksCDL", + "baseQuery": "PaloAltoCDLEvent" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (PaloAltoNetworksCDL)", + "lastDataReceivedQuery": "PaloAltoCDLEvent\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "PaloAltoCDLEvent\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(1d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Top 10 Destinations", + "query": "PaloAltoCDLEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution." + }, + { + "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", + "innerSteps": [ + { + "title": "1.1 Select or create a Linux machine", + "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." + }, + { + "title": "1.2 Install the CEF collector on the Linux machine", + "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId", + "PrimaryKey" + ], + "label": "Run the following command to install and apply the CEF collector:", + "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" + }, + "type": "CopyableLabel" + } + ] + } + ], + "title": "1. Linux Syslog agent configuration" + }, + { + "description": "[Follow the instructions](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-from-logging-service-to-syslog-server.html) to configure logs forwarding from Cortex Data Lake to a Syslog Server.", + "title": "2. Configure Cortex Data Lake to forward logs to a Syslog Server using CEF" + }, + { + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" + }, + "type": "CopyableLabel" + } + ], + "title": "3. Validate connection" + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "4. Secure your machine " + } + ], + "id": "[variables('_uiConfigId1')]", + "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution." + } } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('parserTemplateSpecName1'),'/',variables('parserVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('parserTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLEvent Data Parser with template version 2.0.4", + "description": "PaloAltoCDL data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserVersion1')]", + "contentVersion": "[variables('dataConnectorVersion2')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[variables('_parserName1')]", - "apiVersion": "2020-08-01", - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", + "kind": "GenericUI", "properties": { - "eTag": "*", - "displayName": "PaloAltoCDLEvent", - "category": "Samples", - "functionAlias": "PaloAltoCDLEvent", - "query": "\nCommonSecurityLog\r\n| where DeviceVendor =~ 'Palo Alto Networks'\r\n| where DeviceProduct =~ 'LF'\r\n| extend EventVendor = 'Palo Alto Networks'\r\n| extend EventProduct = 'Cortex Data Lake'\r\n| extend EventSchemaVersion = 0.2\r\n| extend EventCount = 1\r\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\r\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\r\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\r\n| extend packed = pack(DeviceCustomNumber1Label, DeviceCustomNumber1\r\n , DeviceCustomNumber2Label, DeviceCustomNumber2\r\n , DeviceCustomNumber3Label, DeviceCustomNumber3\r\n , DeviceCustomString1Label, DeviceCustomString1\r\n , DeviceCustomString2Label, DeviceCustomString2\r\n , DeviceCustomString3Label, DeviceCustomString3\r\n , DeviceCustomString4Label, DeviceCustomString4\r\n , DeviceCustomString5Label, DeviceCustomString5\r\n , DeviceCustomString6Label, DeviceCustomString6\r\n , DeviceCustomDate1Label, DeviceCustomDate1\r\n , DeviceCustomDate2Label, DeviceCustomDate2\r\n , FlexString1Label, FlexString1\r\n , FlexString2Label, FlexString2\r\n , DeviceCustomFloatingPoint1Label, DeviceCustomFloatingPoint1\r\n , DeviceCustomFloatingPoint2Label, DeviceCustomFloatingPoint2\r\n , DeviceCustomIPv6Address1Label, DeviceCustomIPv6Address1\r\n , DeviceCustomIPv6Address2Label, DeviceCustomIPv6Address2\r\n , DeviceCustomIPv6Address3Label, DeviceCustomIPv6Address3)\r\n| evaluate bag_unpack(packed)\r\n| mv-apply AdditionalFields = extract_all(@'(?P[a-zA-Z0-9-_]+)=(?P[a-zA-Z0-9-_:@.,?%#(){}><\\/\"\\\\ ]+)', dynamic([\"key\",\"value\"]), AdditionalExtensions) on (\r\n project packed1 = pack(tostring(AdditionalFields[0]), tostring(AdditionalFields[1]))\r\n | summarize bag = make_bag(packed1)\r\n)\r\n| evaluate bag_unpack(bag)\r\n| extend DvcIpAddr = column_ifexists( \"Device IPv6 Address\" , \"\")\r\n , DstIpAddr = column_ifexists( \"Destination IPv6 Address\" , \"\")\r\n , SrcIpAddr = column_ifexists( \"Source IPv6 Address\" , \"\")\r\n , EventResultDetails = coalesce(column_ifexists(\"reason\",\"\"),column_ifexists(\"Reason\",\"\"))\r\n , SrcZone = column_ifexists( \"FromZone\" , \"\")\r\n , DstZone = column_ifexists( \"Zone\" , \"\")\r\n , NetworkPackets = column_ifexists( \"PacketsTotal\" , int(null))\r\n , NetworkDuration = column_ifexists( \"SessionDuration\" , int(null))\r\n , NetworkSessionId = column_ifexists( \"SessionID\" , int(null))\r\n , EventStartTime = coalesce(column_ifexists(\"StartTime\",datetime(null))\r\n , todatetime(column_ifexists(\"start\",\"\")))\r\n , EventEndTime = coalesce(column_ifexists(\"EventEndTime\",datetime(null))\r\n , todatetime(column_ifexists(\"end\",\"\")))\r\n , EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"), column_ifexists(\"cat\",\"\"))\r\n| project-rename EventProductVersion = DeviceVersion\r\n , DvcId = DeviceExternalID\r\n , DvcHostname = DeviceName\r\n , DstNatPortNumber = DestinationTranslatedPort\r\n , DstHostname = DestinationHostName\r\n , SrcNatPortNumber = SourceTranslatedPort\r\n , SrcFileName = FileName\r\n , SrcFilePath = FilePath\r\n , EventMessage = Message\r\n , EventSeverity = LogSeverity\r\n , EventResult = Activity\r\n , DstPortNumber = DestinationPort\r\n , DstUserId = DestinationUserID\r\n , EventResourceId = DeviceEventClassID\r\n , HttpRequestMethod = RequestMethod\r\n , Url = RequestURL\r\n , HttpContentFormat = RequestContext\r\n , SrcHostname = SourceHostName\r\n , DvcAction = DeviceAction\r\n , DstDomain = DestinationNTDomain\r\n , SrcPortNumber = SourcePort\r\n , DvcInboundInterface = DeviceInboundInterface\r\n , DvcOutboundInterface = DeviceOutboundInterface\r\n , NetworkProtocol = Protocol\r\n , NetworkApplicationProtocol = ApplicationProtocol\r\n , SrcDomain = SourceNTDomain\r\n , SrcUserId = SourceUserID\r\n , DstBytes = ReceivedBytes\r\n , SrcBytes = SentBytes\r\n| extend EventTimeIngested = todatetime(ReceiptTime)\r\n| extend SrcNatIpAddr = case(isempty(SourceIP), SourceTranslatedAddress, \r\n pack_array(SourceTranslatedAddress,SourceIP))\r\n| extend DstNatIpAddr = case(isempty(DestinationIP), DestinationTranslatedAddress,\r\n pack_array(DestinationTranslatedAddress, DestinationIP))\r\n| extend suser0 = column_ifexists(\"suser0\",\"\")\r\n , duser0 = column_ifexists(\"duser0\",\"\")\r\n | extend SrcUsername = case(isempty(suser0), SourceUserName, \r\n pack_array(SourceUserName,suser0))\r\n | extend DstUsername = case(isempty(duser0), DestinationUserName,\r\n pack_array(DestinationUserName,duser0))\r\n| project-away ReceiptTime\r\n , Type\r\n , StartTime\r\n , EndTime\r\n , DeviceVendor\r\n , DeviceProduct\r\n , duser0\r\n , DestinationUserName\r\n , suser0\r\n , SourceUserName\r\n , AdditionalExtensions\r\n , DestinationTranslatedAddress\r\n , DestinationIP\r\n , SourceTranslatedAddress\r\n , SourceIP\r\n , DeviceCustomNumber1Label\r\n , DeviceCustomNumber1\r\n , DeviceCustomNumber2Label\r\n , DeviceCustomNumber2\r\n , DeviceCustomNumber3Label\r\n , DeviceCustomNumber3\r\n , DeviceCustomString1Label\r\n , DeviceCustomString1\r\n , DeviceCustomString2Label\r\n , DeviceCustomString2\r\n , DeviceCustomString3Label\r\n , DeviceCustomString3\r\n , DeviceCustomString4Label\r\n , DeviceCustomString4\r\n , DeviceCustomString5Label\r\n , DeviceCustomString5\r\n , DeviceCustomString6Label\r\n , DeviceCustomString6\r\n , DeviceCustomDate1Label\r\n , DeviceCustomDate1\r\n , DeviceCustomDate2Label\r\n , DeviceCustomDate2\r\n , FlexString1Label\r\n , FlexString1\r\n , FlexString2Label\r\n , FlexString2\r\n , DeviceCustomIPv6Address1Label\r\n , DeviceCustomIPv6Address1\r\n , DeviceCustomIPv6Address2Label\r\n , DeviceCustomIPv6Address2\r\n , DeviceCustomIPv6Address3Label\r\n , DeviceCustomIPv6Address3\r\n , DeviceCustomFloatingPoint1Label\r\n , DeviceCustomFloatingPoint1\r\n , DeviceCustomFloatingPoint2Label\r\n , DeviceCustomFloatingPoint2", - "version": 1, - "tags": [ - { - "name": "description", - "value": "PaloAltoCDLEvent" - } - ] + "connectorUiConfig": { + "id": "[variables('_uiConfigId2')]", + "title": "[Recommended] Palo Alto Networks Cortex Data Lake (CDL) via AMA", + "publisher": "Palo Alto Networks", + "descriptionMarkdown": "The [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) data connector provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview.html) into Microsoft Sentinel.", + "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "PaloAltoNetworksCDL", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Palo Alto Networks'\n |where DeviceProduct =~ 'LF'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description": "Top 10 Destinations", + "query": "PaloAltoCDLEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (PaloAltoNetworksCDL)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Palo Alto Networks'\n |where DeviceProduct =~ 'LF'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Palo Alto Networks'\n |where DeviceProduct =~ 'LF'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Configure Cortex Data Lake to forward logs to a Syslog Server using CEF", + "description": "[Follow the instructions](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-from-logging-service-to-syslog-server.html) to configure logs forwarding from Cortex Data Lake to a Syslog Server." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ] + } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", - "dependsOn": [ - "[variables('_parserName1')]" - ], + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", - "kind": "Parser", - "version": "[variables('parserVersion1')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", "source": { - "name": "PaloAltoCDL", "kind": "Solution", + "name": "PaloAltoCDL", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -345,36 +706,33 @@ } } ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2021-06-01", - "name": "[variables('_parserName1')]", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "PaloAltoCDLEvent", - "category": "Samples", - "functionAlias": "PaloAltoCDLEvent", - "query": "\nCommonSecurityLog\r\n| where DeviceVendor =~ 'Palo Alto Networks'\r\n| where DeviceProduct =~ 'LF'\r\n| extend EventVendor = 'Palo Alto Networks'\r\n| extend EventProduct = 'Cortex Data Lake'\r\n| extend EventSchemaVersion = 0.2\r\n| extend EventCount = 1\r\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\r\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\r\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\r\n| extend packed = pack(DeviceCustomNumber1Label, DeviceCustomNumber1\r\n , DeviceCustomNumber2Label, DeviceCustomNumber2\r\n , DeviceCustomNumber3Label, DeviceCustomNumber3\r\n , DeviceCustomString1Label, DeviceCustomString1\r\n , DeviceCustomString2Label, DeviceCustomString2\r\n , DeviceCustomString3Label, DeviceCustomString3\r\n , DeviceCustomString4Label, DeviceCustomString4\r\n , DeviceCustomString5Label, DeviceCustomString5\r\n , DeviceCustomString6Label, DeviceCustomString6\r\n , DeviceCustomDate1Label, DeviceCustomDate1\r\n , DeviceCustomDate2Label, DeviceCustomDate2\r\n , FlexString1Label, FlexString1\r\n , FlexString2Label, FlexString2\r\n , DeviceCustomFloatingPoint1Label, DeviceCustomFloatingPoint1\r\n , DeviceCustomFloatingPoint2Label, DeviceCustomFloatingPoint2\r\n , DeviceCustomIPv6Address1Label, DeviceCustomIPv6Address1\r\n , DeviceCustomIPv6Address2Label, DeviceCustomIPv6Address2\r\n , DeviceCustomIPv6Address3Label, DeviceCustomIPv6Address3)\r\n| evaluate bag_unpack(packed)\r\n| mv-apply AdditionalFields = extract_all(@'(?P[a-zA-Z0-9-_]+)=(?P[a-zA-Z0-9-_:@.,?%#(){}><\\/\"\\\\ ]+)', dynamic([\"key\",\"value\"]), AdditionalExtensions) on (\r\n project packed1 = pack(tostring(AdditionalFields[0]), tostring(AdditionalFields[1]))\r\n | summarize bag = make_bag(packed1)\r\n)\r\n| evaluate bag_unpack(bag)\r\n| extend DvcIpAddr = column_ifexists( \"Device IPv6 Address\" , \"\")\r\n , DstIpAddr = column_ifexists( \"Destination IPv6 Address\" , \"\")\r\n , SrcIpAddr = column_ifexists( \"Source IPv6 Address\" , \"\")\r\n , EventResultDetails = coalesce(column_ifexists(\"reason\",\"\"),column_ifexists(\"Reason\",\"\"))\r\n , SrcZone = column_ifexists( \"FromZone\" , \"\")\r\n , DstZone = column_ifexists( \"Zone\" , \"\")\r\n , NetworkPackets = column_ifexists( \"PacketsTotal\" , int(null))\r\n , NetworkDuration = column_ifexists( \"SessionDuration\" , int(null))\r\n , NetworkSessionId = column_ifexists( \"SessionID\" , int(null))\r\n , EventStartTime = coalesce(column_ifexists(\"StartTime\",datetime(null))\r\n , todatetime(column_ifexists(\"start\",\"\")))\r\n , EventEndTime = coalesce(column_ifexists(\"EventEndTime\",datetime(null))\r\n , todatetime(column_ifexists(\"end\",\"\")))\r\n , EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"), column_ifexists(\"cat\",\"\"))\r\n| project-rename EventProductVersion = DeviceVersion\r\n , DvcId = DeviceExternalID\r\n , DvcHostname = DeviceName\r\n , DstNatPortNumber = DestinationTranslatedPort\r\n , DstHostname = DestinationHostName\r\n , SrcNatPortNumber = SourceTranslatedPort\r\n , SrcFileName = FileName\r\n , SrcFilePath = FilePath\r\n , EventMessage = Message\r\n , EventSeverity = LogSeverity\r\n , EventResult = Activity\r\n , DstPortNumber = DestinationPort\r\n , DstUserId = DestinationUserID\r\n , EventResourceId = DeviceEventClassID\r\n , HttpRequestMethod = RequestMethod\r\n , Url = RequestURL\r\n , HttpContentFormat = RequestContext\r\n , SrcHostname = SourceHostName\r\n , DvcAction = DeviceAction\r\n , DstDomain = DestinationNTDomain\r\n , SrcPortNumber = SourcePort\r\n , DvcInboundInterface = DeviceInboundInterface\r\n , DvcOutboundInterface = DeviceOutboundInterface\r\n , NetworkProtocol = Protocol\r\n , NetworkApplicationProtocol = ApplicationProtocol\r\n , SrcDomain = SourceNTDomain\r\n , SrcUserId = SourceUserID\r\n , DstBytes = ReceivedBytes\r\n , SrcBytes = SentBytes\r\n| extend EventTimeIngested = todatetime(ReceiptTime)\r\n| extend SrcNatIpAddr = case(isempty(SourceIP), SourceTranslatedAddress, \r\n pack_array(SourceTranslatedAddress,SourceIP))\r\n| extend DstNatIpAddr = case(isempty(DestinationIP), DestinationTranslatedAddress,\r\n pack_array(DestinationTranslatedAddress, DestinationIP))\r\n| extend suser0 = column_ifexists(\"suser0\",\"\")\r\n , duser0 = column_ifexists(\"duser0\",\"\")\r\n | extend SrcUsername = case(isempty(suser0), SourceUserName, \r\n pack_array(SourceUserName,suser0))\r\n | extend DstUsername = case(isempty(duser0), DestinationUserName,\r\n pack_array(DestinationUserName,duser0))\r\n| project-away ReceiptTime\r\n , Type\r\n , StartTime\r\n , EndTime\r\n , DeviceVendor\r\n , DeviceProduct\r\n , duser0\r\n , DestinationUserName\r\n , suser0\r\n , SourceUserName\r\n , AdditionalExtensions\r\n , DestinationTranslatedAddress\r\n , DestinationIP\r\n , SourceTranslatedAddress\r\n , SourceIP\r\n , DeviceCustomNumber1Label\r\n , DeviceCustomNumber1\r\n , DeviceCustomNumber2Label\r\n , DeviceCustomNumber2\r\n , DeviceCustomNumber3Label\r\n , DeviceCustomNumber3\r\n , DeviceCustomString1Label\r\n , DeviceCustomString1\r\n , DeviceCustomString2Label\r\n , DeviceCustomString2\r\n , DeviceCustomString3Label\r\n , DeviceCustomString3\r\n , DeviceCustomString4Label\r\n , DeviceCustomString4\r\n , DeviceCustomString5Label\r\n , DeviceCustomString5\r\n , DeviceCustomString6Label\r\n , DeviceCustomString6\r\n , DeviceCustomDate1Label\r\n , DeviceCustomDate1\r\n , DeviceCustomDate2Label\r\n , DeviceCustomDate2\r\n , FlexString1Label\r\n , FlexString1\r\n , FlexString2Label\r\n , FlexString2\r\n , DeviceCustomIPv6Address1Label\r\n , DeviceCustomIPv6Address1\r\n , DeviceCustomIPv6Address2Label\r\n , DeviceCustomIPv6Address2\r\n , DeviceCustomIPv6Address3Label\r\n , DeviceCustomIPv6Address3\r\n , DeviceCustomFloatingPoint1Label\r\n , DeviceCustomFloatingPoint1\r\n , DeviceCustomFloatingPoint2Label\r\n , DeviceCustomFloatingPoint2", - "version": 1 + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId2')]", + "contentKind": "DataConnector", + "displayName": "[Recommended] Palo Alto Networks Cortex Data Lake (CDL) via AMA", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", + "version": "[variables('dataConnectorVersion2')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", "dependsOn": [ - "[variables('_parserId1')]" + "[variables('_dataConnectorId2')]" ], + "location": "[parameters('workspace-location')]", "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", - "kind": "Parser", - "version": "[variables('parserVersion1')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -393,62 +751,159 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('huntingQueryTemplateSpecName1')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, + "kind": "GenericUI", "properties": { - "description": "PaloAltoCDL Hunting Query 1 with template", - "displayName": "PaloAltoCDL Hunting Query template" + "connectorUiConfig": { + "title": "[Recommended] Palo Alto Networks Cortex Data Lake (CDL) via AMA", + "publisher": "Palo Alto Networks", + "descriptionMarkdown": "The [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) data connector provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview.html) into Microsoft Sentinel.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "PaloAltoNetworksCDL", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Palo Alto Networks'\n |where DeviceProduct =~ 'LF'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (PaloAltoNetworksCDL)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Palo Alto Networks'\n |where DeviceProduct =~ 'LF'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Palo Alto Networks'\n |where DeviceProduct =~ 'LF'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Top 10 Destinations", + "query": "PaloAltoCDLEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Configure Cortex Data Lake to forward logs to a Syslog Server using CEF", + "description": "[Follow the instructions](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-from-logging-service-to-syslog-server.html) to configure logs forwarding from Cortex Data Lake to a Syslog Server." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ], + "id": "[variables('_uiConfigId2')]", + "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution." + } } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('huntingQueryTemplateSpecName1'),'/',variables('huntingQueryVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLCriticalEventResult_HuntingQueries Hunting Query with template version 2.0.4", + "description": "PaloAltoCDLEvent Data Parser with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion1')]", + "contentVersion": "[variables('parserVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", - "name": "PaloAltoCDL_Hunting_Query_1", + "name": "[variables('_parserName1')]", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "PaloAlto - Critical event result", - "category": "Hunting Queries", - "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where EventSeverity has 'critical' or tostring(ThreatSeverity) has_any ('high', 'critical')\n| extend UrlCustomEntity = Url, AccountCustomEntity = DstUsername\n", + "displayName": "PaloAltoCDLEvent", + "category": "Microsoft Sentinel Parser", + "functionAlias": "PaloAltoCDLEvent", + "query": "CommonSecurityLog\n| where DeviceVendor =~ 'Palo Alto Networks'\n| where DeviceProduct =~ 'LF'\n| extend EventVendor = 'Palo Alto Networks'\n| extend EventProduct = 'Cortex Data Lake'\n| extend EventSchemaVersion = 0.2\n| extend EventCount = 1\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n| extend packed = pack(DeviceCustomNumber1Label, DeviceCustomNumber1\n , DeviceCustomNumber2Label, DeviceCustomNumber2\n , DeviceCustomNumber3Label, DeviceCustomNumber3\n , DeviceCustomString1Label, DeviceCustomString1\n , DeviceCustomString2Label, DeviceCustomString2\n , DeviceCustomString3Label, DeviceCustomString3\n , DeviceCustomString4Label, DeviceCustomString4\n , DeviceCustomString5Label, DeviceCustomString5\n , DeviceCustomString6Label, DeviceCustomString6\n , DeviceCustomDate1Label, DeviceCustomDate1\n , DeviceCustomDate2Label, DeviceCustomDate2\n , FlexString1Label, FlexString1\n , FlexString2Label, FlexString2\n , DeviceCustomFloatingPoint1Label, DeviceCustomFloatingPoint1\n , DeviceCustomFloatingPoint2Label, DeviceCustomFloatingPoint2\n , DeviceCustomIPv6Address1Label, DeviceCustomIPv6Address1\n , DeviceCustomIPv6Address2Label, DeviceCustomIPv6Address2\n , DeviceCustomIPv6Address3Label, DeviceCustomIPv6Address3)\n| evaluate bag_unpack(packed)\n| mv-apply AdditionalFields = extract_all(@'(?P[a-zA-Z0-9-_]+)=(?P[a-zA-Z0-9-_:@.,?%#(){}><\\/\"\\\\ ]+)', dynamic([\"key\",\"value\"]), AdditionalExtensions) on (\n project packed1 = pack(tostring(AdditionalFields[0]), tostring(AdditionalFields[1]))\n | summarize bag = make_bag(packed1)\n)\n| evaluate bag_unpack(bag)\n| extend DvcIpAddr = column_ifexists( \"Device IPv6 Address\" , \"\")\n , DstIpAddr = column_ifexists( \"Destination IPv6 Address\" , \"\")\n , SrcIpAddr = column_ifexists( \"Source IPv6 Address\" , \"\")\n , EventResultDetails = coalesce(column_ifexists(\"reason\",\"\"),column_ifexists(\"Reason\",\"\"))\n , SrcZone = column_ifexists( \"FromZone\" , \"\")\n , DstZone = column_ifexists( \"Zone\" , \"\")\n , NetworkPackets = column_ifexists( \"PacketsTotal\" , int(null))\n , NetworkDuration = column_ifexists( \"SessionDuration\" , int(null))\n , NetworkSessionId = column_ifexists( \"SessionID\" , int(null))\n , EventStartTime = coalesce(column_ifexists(\"StartTime\",datetime(null))\n , todatetime(column_ifexists(\"start\",\"\")))\n , EventEndTime = coalesce(column_ifexists(\"EventEndTime\",datetime(null))\n , todatetime(column_ifexists(\"end\",\"\")))\n , EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"), column_ifexists(\"cat\",\"\"))\n| project-rename EventProductVersion = DeviceVersion\n , DvcId = DeviceExternalID\n , DvcHostname = DeviceName\n , DstNatPortNumber = DestinationTranslatedPort\n , DstHostname = DestinationHostName\n , SrcNatPortNumber = SourceTranslatedPort\n , SrcFileName = FileName\n , SrcFilePath = FilePath\n , EventMessage = Message\n , EventSeverity = LogSeverity\n , EventResult = Activity\n , DstPortNumber = DestinationPort\n , DstUserId = DestinationUserID\n , EventResourceId = DeviceEventClassID\n , HttpRequestMethod = RequestMethod\n , Url = RequestURL\n , HttpContentFormat = RequestContext\n , SrcHostname = SourceHostName\n , DvcAction = DeviceAction\n , DstDomain = DestinationNTDomain\n , SrcPortNumber = SourcePort\n , DvcInboundInterface = DeviceInboundInterface\n , DvcOutboundInterface = DeviceOutboundInterface\n , NetworkProtocol = Protocol\n , NetworkApplicationProtocol = ApplicationProtocol\n , SrcDomain = SourceNTDomain\n , SrcUserId = SourceUserID\n , DstBytes = ReceivedBytes\n , SrcBytes = SentBytes\n| extend EventTimeIngested = todatetime(ReceiptTime)\n| extend SrcNatIpAddr = case(isempty(SourceIP), SourceTranslatedAddress, \n pack_array(SourceTranslatedAddress,SourceIP))\n| extend DstNatIpAddr = case(isempty(DestinationIP), DestinationTranslatedAddress,\n pack_array(DestinationTranslatedAddress, DestinationIP))\n| extend suser0 = column_ifexists(\"suser0\",\"\")\n , duser0 = column_ifexists(\"duser0\",\"\")\n | extend SrcUsername = case(isempty(suser0), SourceUserName, \n pack_array(SourceUserName,suser0))\n | extend DstUsername = case(isempty(duser0), DestinationUserName,\n pack_array(DestinationUserName,duser0))\n| project-away ReceiptTime\n , Type\n , StartTime\n , EndTime\n , DeviceVendor\n , DeviceProduct\n , duser0\n , DestinationUserName\n , suser0\n , SourceUserName\n , AdditionalExtensions\n , DestinationTranslatedAddress\n , DestinationIP\n , SourceTranslatedAddress\n , SourceIP\n , DeviceCustomNumber1Label\n , DeviceCustomNumber1\n , DeviceCustomNumber2Label\n , DeviceCustomNumber2\n , DeviceCustomNumber3Label\n , DeviceCustomNumber3\n , DeviceCustomString1Label\n , DeviceCustomString1\n , DeviceCustomString2Label\n , DeviceCustomString2\n , DeviceCustomString3Label\n , DeviceCustomString3\n , DeviceCustomString4Label\n , DeviceCustomString4\n , DeviceCustomString5Label\n , DeviceCustomString5\n , DeviceCustomString6Label\n , DeviceCustomString6\n , DeviceCustomDate1Label\n , DeviceCustomDate1\n , DeviceCustomDate2Label\n , DeviceCustomDate2\n , FlexString1Label\n , FlexString1\n , FlexString2Label\n , FlexString2\n , DeviceCustomIPv6Address1Label\n , DeviceCustomIPv6Address1\n , DeviceCustomIPv6Address2Label\n , DeviceCustomIPv6Address2\n , DeviceCustomIPv6Address3Label\n , DeviceCustomIPv6Address3\n , DeviceCustomFloatingPoint1Label\n , DeviceCustomFloatingPoint1\n , DeviceCustomFloatingPoint2Label\n , DeviceCustomFloatingPoint2\n", + "functionParameters": "", "version": 2, "tags": [ { "name": "description", - "value": "Query shows critical event result" - }, - { - "name": "tactics", - "value": "InitialAccess" - }, - { - "name": "techniques", - "value": "T1190,T1133" + "value": "" } ] } @@ -456,16 +911,18 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "dependsOn": [ + "[variables('_parserId1')]" + ], "properties": { - "description": "PaloAltoCDL Hunting Query 1", - "parentId": "[variables('huntingQueryId1')]", - "contentId": "[variables('_huntingQuerycontentId1')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", + "contentId": "[variables('_parserContentId1')]", + "kind": "Parser", + "version": "[variables('parserVersion1')]", "source": { - "kind": "Solution", "name": "PaloAltoCDL", + "kind": "Solution", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -481,80 +938,114 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_parserContentId1')]", + "contentKind": "Parser", + "displayName": "PaloAltoCDLEvent", + "contentProductId": "[variables('_parsercontentProductId1')]", + "id": "[variables('_parsercontentProductId1')]", + "version": "[variables('parserVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('huntingQueryTemplateSpecName2')]", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2022-10-01", + "name": "[variables('_parserName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "properties": { - "description": "PaloAltoCDL Hunting Query 2 with template", - "displayName": "PaloAltoCDL Hunting Query template" + "eTag": "*", + "displayName": "PaloAltoCDLEvent", + "category": "Microsoft Sentinel Parser", + "functionAlias": "PaloAltoCDLEvent", + "query": "CommonSecurityLog\n| where DeviceVendor =~ 'Palo Alto Networks'\n| where DeviceProduct =~ 'LF'\n| extend EventVendor = 'Palo Alto Networks'\n| extend EventProduct = 'Cortex Data Lake'\n| extend EventSchemaVersion = 0.2\n| extend EventCount = 1\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n| extend packed = pack(DeviceCustomNumber1Label, DeviceCustomNumber1\n , DeviceCustomNumber2Label, DeviceCustomNumber2\n , DeviceCustomNumber3Label, DeviceCustomNumber3\n , DeviceCustomString1Label, DeviceCustomString1\n , DeviceCustomString2Label, DeviceCustomString2\n , DeviceCustomString3Label, DeviceCustomString3\n , DeviceCustomString4Label, DeviceCustomString4\n , DeviceCustomString5Label, DeviceCustomString5\n , DeviceCustomString6Label, DeviceCustomString6\n , DeviceCustomDate1Label, DeviceCustomDate1\n , DeviceCustomDate2Label, DeviceCustomDate2\n , FlexString1Label, FlexString1\n , FlexString2Label, FlexString2\n , DeviceCustomFloatingPoint1Label, DeviceCustomFloatingPoint1\n , DeviceCustomFloatingPoint2Label, DeviceCustomFloatingPoint2\n , DeviceCustomIPv6Address1Label, DeviceCustomIPv6Address1\n , DeviceCustomIPv6Address2Label, DeviceCustomIPv6Address2\n , DeviceCustomIPv6Address3Label, DeviceCustomIPv6Address3)\n| evaluate bag_unpack(packed)\n| mv-apply AdditionalFields = extract_all(@'(?P[a-zA-Z0-9-_]+)=(?P[a-zA-Z0-9-_:@.,?%#(){}><\\/\"\\\\ ]+)', dynamic([\"key\",\"value\"]), AdditionalExtensions) on (\n project packed1 = pack(tostring(AdditionalFields[0]), tostring(AdditionalFields[1]))\n | summarize bag = make_bag(packed1)\n)\n| evaluate bag_unpack(bag)\n| extend DvcIpAddr = column_ifexists( \"Device IPv6 Address\" , \"\")\n , DstIpAddr = column_ifexists( \"Destination IPv6 Address\" , \"\")\n , SrcIpAddr = column_ifexists( \"Source IPv6 Address\" , \"\")\n , EventResultDetails = coalesce(column_ifexists(\"reason\",\"\"),column_ifexists(\"Reason\",\"\"))\n , SrcZone = column_ifexists( \"FromZone\" , \"\")\n , DstZone = column_ifexists( \"Zone\" , \"\")\n , NetworkPackets = column_ifexists( \"PacketsTotal\" , int(null))\n , NetworkDuration = column_ifexists( \"SessionDuration\" , int(null))\n , NetworkSessionId = column_ifexists( \"SessionID\" , int(null))\n , EventStartTime = coalesce(column_ifexists(\"StartTime\",datetime(null))\n , todatetime(column_ifexists(\"start\",\"\")))\n , EventEndTime = coalesce(column_ifexists(\"EventEndTime\",datetime(null))\n , todatetime(column_ifexists(\"end\",\"\")))\n , EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"), column_ifexists(\"cat\",\"\"))\n| project-rename EventProductVersion = DeviceVersion\n , DvcId = DeviceExternalID\n , DvcHostname = DeviceName\n , DstNatPortNumber = DestinationTranslatedPort\n , DstHostname = DestinationHostName\n , SrcNatPortNumber = SourceTranslatedPort\n , SrcFileName = FileName\n , SrcFilePath = FilePath\n , EventMessage = Message\n , EventSeverity = LogSeverity\n , EventResult = Activity\n , DstPortNumber = DestinationPort\n , DstUserId = DestinationUserID\n , EventResourceId = DeviceEventClassID\n , HttpRequestMethod = RequestMethod\n , Url = RequestURL\n , HttpContentFormat = RequestContext\n , SrcHostname = SourceHostName\n , DvcAction = DeviceAction\n , DstDomain = DestinationNTDomain\n , SrcPortNumber = SourcePort\n , DvcInboundInterface = DeviceInboundInterface\n , DvcOutboundInterface = DeviceOutboundInterface\n , NetworkProtocol = Protocol\n , NetworkApplicationProtocol = ApplicationProtocol\n , SrcDomain = SourceNTDomain\n , SrcUserId = SourceUserID\n , DstBytes = ReceivedBytes\n , SrcBytes = SentBytes\n| extend EventTimeIngested = todatetime(ReceiptTime)\n| extend SrcNatIpAddr = case(isempty(SourceIP), SourceTranslatedAddress, \n pack_array(SourceTranslatedAddress,SourceIP))\n| extend DstNatIpAddr = case(isempty(DestinationIP), DestinationTranslatedAddress,\n pack_array(DestinationTranslatedAddress, DestinationIP))\n| extend suser0 = column_ifexists(\"suser0\",\"\")\n , duser0 = column_ifexists(\"duser0\",\"\")\n | extend SrcUsername = case(isempty(suser0), SourceUserName, \n pack_array(SourceUserName,suser0))\n | extend DstUsername = case(isempty(duser0), DestinationUserName,\n pack_array(DestinationUserName,duser0))\n| project-away ReceiptTime\n , Type\n , StartTime\n , EndTime\n , DeviceVendor\n , DeviceProduct\n , duser0\n , DestinationUserName\n , suser0\n , SourceUserName\n , AdditionalExtensions\n , DestinationTranslatedAddress\n , DestinationIP\n , SourceTranslatedAddress\n , SourceIP\n , DeviceCustomNumber1Label\n , DeviceCustomNumber1\n , DeviceCustomNumber2Label\n , DeviceCustomNumber2\n , DeviceCustomNumber3Label\n , DeviceCustomNumber3\n , DeviceCustomString1Label\n , DeviceCustomString1\n , DeviceCustomString2Label\n , DeviceCustomString2\n , DeviceCustomString3Label\n , DeviceCustomString3\n , DeviceCustomString4Label\n , DeviceCustomString4\n , DeviceCustomString5Label\n , DeviceCustomString5\n , DeviceCustomString6Label\n , DeviceCustomString6\n , DeviceCustomDate1Label\n , DeviceCustomDate1\n , DeviceCustomDate2Label\n , DeviceCustomDate2\n , FlexString1Label\n , FlexString1\n , FlexString2Label\n , FlexString2\n , DeviceCustomIPv6Address1Label\n , DeviceCustomIPv6Address1\n , DeviceCustomIPv6Address2Label\n , DeviceCustomIPv6Address2\n , DeviceCustomIPv6Address3Label\n , DeviceCustomIPv6Address3\n , DeviceCustomFloatingPoint1Label\n , DeviceCustomFloatingPoint1\n , DeviceCustomFloatingPoint2Label\n , DeviceCustomFloatingPoint2\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('huntingQueryTemplateSpecName2'),'/',variables('huntingQueryVersion2'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName2'))]" + "[variables('_parserId1')]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", + "contentId": "[variables('_parserContentId1')]", + "kind": "Parser", + "version": "[variables('parserVersion1')]", + "source": { + "kind": "Solution", + "name": "PaloAltoCDL", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLFilePermissionWithPutRequest_HuntingQueries Hunting Query with template version 2.0.4", + "description": "PaloAltoCDLWorkbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion2')]", + "contentVersion": "[variables('workbookVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", - "name": "PaloAltoCDL_Hunting_Query_2", + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "Sets the time name for analysis" + }, "properties": { - "eTag": "*", - "displayName": "PaloAlto - File permission with PUT or POST request", - "category": "Hunting Queries", - "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where HttpRequestMethod contains \"PUT\" or HttpRequestMethod contains \"POST\"\n| where isnotempty(FilePermission)\n| summarize Permissions = count() by FilePermission, DstUsername\n| extend AccountCustomEntity = DstUsername\n", - "version": 2, - "tags": [ - { - "name": "description", - "value": "Query shows file permission with PUT or POST request" - }, - { - "name": "tactics", - "value": "InitialAccess" - }, - { - "name": "techniques", - "value": "T1190,T1133" - } - ] + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"**NOTE**: This data connector depends on a parser based on Kusto Function **PaloAltoCDLEvent** to work as expected. [Follow steps to get this Kusto Function](https://aka.ms/sentinel-paloaltocdl-parser)\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"cd8447d9-b096-4673-92d8-2a1e8291a125\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"description\":\"Sets the time name for analysis\",\"value\":{\"durationMs\":7776000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":900000},{\"durationMs\":3600000},{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":7776000000}]},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};\",\"size\":0,\"title\":\"Events Over Time\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"graphSettings\":{\"type\":0}},\"customWidth\":\"60\",\"name\":\"query - 12\",\"styleSettings\":{\"maxWidth\":\"55\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n | summarize Result = count() by EventSeverity\",\"size\":3,\"title\":\"Events Severity\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 0\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where isnotempty(SrcIpAddr)\\r\\n| summarize dcount(SrcIpAddr) \",\"size\":3,\"title\":\"Unique IP Addresses\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 0\"}]},\"name\":\"group - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where EventResourceId contains \\\"THREAT\\\"\\r\\n| count \",\"size\":3,\"title\":\"Total Threat Events\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 0\"}]},\"name\":\"group - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where EventResourceId contains \\\"THREAT\\\"\\r\\n| where isnotempty(DvcAction) \\r\\n| where EventResult contains \\\"drop\\\" or EventResult contains \\\"deny\\\" or EventResult contains \\\"reset\\\" or EventResult contains \\\"block\\\" or EventResult contains \\\"lockout\\\" or EventResult contains \\\"override\\\"\\r\\n| count \",\"size\":3,\"title\":\"Total Threat Response\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 0\"}]},\"name\":\"group - 2\"}]},\"customWidth\":\"10\",\"name\":\"group - 9\",\"styleSettings\":{\"maxWidth\":\"100\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where EventResourceId contains \\\"THREAT\\\"\\r\\n| summarize ResponseAction = count() by DvcAction\",\"size\":3,\"title\":\"Response action \",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10\",\"padding\":\"10\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\" PaloAltoCDLEvent\\r\\n | where isnotempty(NetworkApplicationProtocol) \\r\\n | summarize ApplicationLayerProtocol = count() by NetworkApplicationProtocol\",\"size\":3,\"title\":\"Application layer protocol\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 15\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where EventResourceId contains \\\"THREAT\\\"\\r\\n| where isnotempty(IndicatorThreatType) \\r\\n| summarize ThreatType = count() by IndicatorThreatType\",\"size\":3,\"title\":\"Threat Types\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where isnotempty(DstUsername)\\r\\n| sort by TimeGenerated desc \\r\\n| project User=DstUsername, ThreatEvent=strcat(iff(EventResourceId contains \\\"THREAT\\\", '❌', '✅')), SourceAddress=SrcIpAddr\",\"size\":0,\"title\":\"Latest events\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":50,\"filter\":true}},\"customWidth\":\"35\",\"name\":\"query - 12\",\"styleSettings\":{\"maxWidth\":\"33\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where isnotempty(DstPortNumber) \\r\\n| summarize TopPorts = count() by tostring(DstPortNumber)\\r\\n| top 20 by TopPorts desc \",\"size\":3,\"title\":\"Top ports\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"tileSettings\":{\"showBorder\":false},\"graphSettings\":{\"type\":0},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"DstPortNumber\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"DstPortNumber\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"DstPortNumber\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"30\",\"name\":\"query - 14\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PaloAltoCDLEvent\\r\\n| where EventResourceId contains \\\"THREAT\\\"\\r\\n| where isnotempty(Url)\\r\\n| summarize ThreatEventUrl = count() by Url\\r\\n| top 10 by ThreatEventUrl desc \",\"size\":3,\"title\":\"Top Threat Event URLs \",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"35\",\"name\":\"query - 10\",\"styleSettings\":{\"maxWidth\":\"100\"}}],\"fromTemplateId\":\"sentinel-PaloAltoCDLWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId2'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "description": "PaloAltoCDL Hunting Query 2", - "parentId": "[variables('huntingQueryId2')]", - "contentId": "[variables('_huntingQuerycontentId2')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion2')]", + "description": "@{workbookKey=PaloAltoCDL; logoFileName=paloalto_logo.svg; description=Sets the time name for analysis; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Palo Alto Networks Cortex Data Lake; templateRelativePath=PaloAltoCDL.json; subtitle=; provider=Palo Alto Networks}.description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -569,70 +1060,111 @@ "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "CommonSecurityLog", + "kind": "DataType" + }, + { + "contentId": "PaloAltoCDL", + "kind": "DataConnector" + } + ] } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('huntingQueryTemplateSpecName3')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "description": "PaloAltoCDL Hunting Query 3 with template", - "displayName": "PaloAltoCDL Hunting Query template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('huntingQueryTemplateSpecName3'),'/',variables('huntingQueryVersion3'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName3'))]" - ], - "properties": { - "description": "PaloAltoCDLIPsByPorts_HuntingQueries Hunting Query with template version 2.0.4", + "description": "PaloAltoCDLConflictingMacAddress_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion3')]", + "contentVersion": "[variables('analyticRuleVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", - "name": "PaloAltoCDL_Hunting_Query_3", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId1')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "PaloAlto - Destination ports by IPs", - "category": "Hunting Queries", - "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(DstPortNumber)\n| summarize IP_Dst = make_set(tostring(DstNatIpAddr)) by DstPortNumber\n| extend IPCustomEntity = IP_Dst\n", - "version": 2, - "tags": [ + "description": "Detects several users with the same MAC address.", + "displayName": "PaloAlto - MAC address conflict", + "enabled": false, + "query": "let threshold = 2;\nPaloAltoCDLEvent\n| where EventResourceId =~ 'TRAFFIC'\n| where isnotempty(DestinationMACAddress) and isnotempty(DstUsername)\n| summarize UserSet = make_set(DstUsername) by DestinationMACAddress\n| extend Users = array_length(UserSet)\n| where Users >= threshold\n| extend AccountCustomEntity = UserSet, IPCustomEntity = DestinationMACAddress\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query shows destination ports by IP address." + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDL" }, { - "name": "tactics", - "value": "InitialAccess" + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDLAma" + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1190", + "T1133" + ], + "entityMappings": [ + { + "entityType": "Account", + "fieldMappings": [ + { + "columnName": "AccountCustomEntity", + "identifier": "Name" + } + ] }, { - "name": "techniques", - "value": "T1190,T1133" + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "IPCustomEntity", + "identifier": "Address" + } + ] } ] } @@ -640,13 +1172,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", "properties": { - "description": "PaloAltoCDL Hunting Query 3", - "parentId": "[variables('huntingQueryId3')]", - "contentId": "[variables('_huntingQuerycontentId3')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion3')]", + "description": "PaloAltoCDL Analytics Rule 1", + "parentId": "[variables('analyticRuleId1')]", + "contentId": "[variables('_analyticRulecontentId1')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion1')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -665,66 +1197,94 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('huntingQueryTemplateSpecName4')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "PaloAltoCDL Hunting Query 4 with template", - "displayName": "PaloAltoCDL Hunting Query template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId1')]", + "contentKind": "AnalyticsRule", + "displayName": "PaloAlto - MAC address conflict", + "contentProductId": "[variables('_analyticRulecontentProductId1')]", + "id": "[variables('_analyticRulecontentProductId1')]", + "version": "[variables('analyticRuleVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('huntingQueryTemplateSpecName4'),'/',variables('huntingQueryVersion4'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName4'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLIncompleteApplicationProtocol_HuntingQueries Hunting Query with template version 2.0.4", + "description": "PaloAltoCDLDroppingSessionWithSentTraffic_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion4')]", + "contentVersion": "[variables('analyticRuleVersion2')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", - "name": "PaloAltoCDL_Hunting_Query_4", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId2')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "PaloAlto - Incomplete application protocol", - "category": "Hunting Queries", - "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where NetworkApplicationProtocol has_any (\"incomplete\", \"Not-Applicable\", \"insufficient\")\n| extend UrlCustomEntity = Url, IPCustomEntity = DstIpAddr\n", - "version": 2, - "tags": [ + "description": "Detects dropping or denying session with traffic.", + "displayName": "PaloAlto - Dropping or denying session with traffic", + "enabled": false, + "query": "let threshold = 100;\nPaloAltoCDLEvent\n| where EventResourceId =~ 'TRAFFIC'\n| where EventResult has_any (\"deny\", \"drop\", \"reject\") \n| where tolong(DstBytes) > 0\n| where tolong(NetworkPackets) > 0\n| summarize count() by SrcIpAddr, DstUsername, bin(TimeGenerated, 10m)\n| where count_ > threshold\n| extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query shows incomplete application protocol" + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDL" }, { - "name": "tactics", - "value": "InitialAccess" + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDLAma" + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1190", + "T1133" + ], + "entityMappings": [ + { + "entityType": "Account", + "fieldMappings": [ + { + "columnName": "AccountCustomEntity", + "identifier": "Name" + } + ] }, { - "name": "techniques", - "value": "T1190,T1133" + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "IPCustomEntity", + "identifier": "Address" + } + ] } ] } @@ -732,13 +1292,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId4'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", "properties": { - "description": "PaloAltoCDL Hunting Query 4", - "parentId": "[variables('huntingQueryId4')]", - "contentId": "[variables('_huntingQuerycontentId4')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion4')]", + "description": "PaloAltoCDL Analytics Rule 2", + "parentId": "[variables('analyticRuleId2')]", + "contentId": "[variables('_analyticRulecontentId2')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion2')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -757,66 +1317,94 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('huntingQueryTemplateSpecName5')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "PaloAltoCDL Hunting Query 5 with template", - "displayName": "PaloAltoCDL Hunting Query template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId2')]", + "contentKind": "AnalyticsRule", + "displayName": "PaloAlto - Dropping or denying session with traffic", + "contentProductId": "[variables('_analyticRulecontentProductId2')]", + "id": "[variables('_analyticRulecontentProductId2')]", + "version": "[variables('analyticRuleVersion2')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('huntingQueryTemplateSpecName5'),'/',variables('huntingQueryVersion5'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName3')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName5'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLMultiDenyResultbyUser_HuntingQueries Hunting Query with template version 2.0.4", + "description": "PaloAltoCDLFileTypeWasChanged_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion5')]", + "contentVersion": "[variables('analyticRuleVersion3')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", - "name": "PaloAltoCDL_Hunting_Query_5", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId3')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "PaloAlto - Multiple Deny result by user", - "category": "Hunting Queries", - "query": "let threshold = 20;\nPaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where DvcAction has 'deny'\n| summarize DenyCount = count() by DvcAction, DstUsername\n| where DenyCount > threshold\n| extend AccountCustomEntity = DstUsername\n", - "version": 2, - "tags": [ + "description": "Detects when file type changed.", + "displayName": "PaloAlto - File type changed", + "enabled": false, + "query": "PaloAltoCDLEvent\n| where EventResourceId =~ 'THREAT'\n| where EventResult =~ 'file'\n| where FileType != OldFileType\n| extend FileCustomEntity = SrcFileName, AccountCustomEntity = DstUsername\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query shows multiple Deny results by user" + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDL" }, { - "name": "tactics", - "value": "InitialAccess" + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDLAma" + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1190", + "T1133" + ], + "entityMappings": [ + { + "entityType": "Account", + "fieldMappings": [ + { + "columnName": "AccountCustomEntity", + "identifier": "Name" + } + ] }, { - "name": "techniques", - "value": "T1190,T1133" + "entityType": "File", + "fieldMappings": [ + { + "columnName": "FileCustomEntity", + "identifier": "Name" + } + ] } ] } @@ -824,13 +1412,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId5'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId3'),'/'))))]", "properties": { - "description": "PaloAltoCDL Hunting Query 5", - "parentId": "[variables('huntingQueryId5')]", - "contentId": "[variables('_huntingQuerycontentId5')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion5')]", + "description": "PaloAltoCDL Analytics Rule 3", + "parentId": "[variables('analyticRuleId3')]", + "contentId": "[variables('_analyticRulecontentId3')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion3')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -849,66 +1437,85 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('huntingQueryTemplateSpecName6')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "PaloAltoCDL Hunting Query 6 with template", - "displayName": "PaloAltoCDL Hunting Query template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId3')]", + "contentKind": "AnalyticsRule", + "displayName": "PaloAlto - File type changed", + "contentProductId": "[variables('_analyticRulecontentProductId3')]", + "id": "[variables('_analyticRulecontentProductId3')]", + "version": "[variables('analyticRuleVersion3')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('huntingQueryTemplateSpecName6'),'/',variables('huntingQueryVersion6'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName4')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName6'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLOutdatedAgentVersions_HuntingQueries Hunting Query with template version 2.0.4", + "description": "PaloAltoCDLInboundRiskPorts_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion6')]", + "contentVersion": "[variables('analyticRuleVersion4')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", - "name": "PaloAltoCDL_Hunting_Query_6", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId4')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "PaloAlto - Agent versions", - "category": "Hunting Queries", - "query": "let cur_ver = dynamic(['0.1']); //put latest agent version here\nPaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(PanOSAgentVersion)\n| where PanOSAgentVersion != cur_ver\n| project SrcIpAddr, PanOSAgentVersion\n| extend IPCustomEntity = SrcIpAddr\n", - "version": 2, - "tags": [ + "description": "Detects inbound connection to high risk ports.", + "displayName": "PaloAlto - Inbound connection to high risk ports", + "enabled": false, + "query": "let HighRiskPorts = dynamic(['21', '22', '23', '25', '53', '443', '110', '135', '137', '138', '139', '1433', '1434']);\nPaloAltoCDLEvent\n| where EventResourceId =~ 'TRAFFIC'\n| where ipv4_is_private(SrcIpAddr) == false\n| where DstPortNumber in (HighRiskPorts)\n| extend IPCustomEntity = SrcIpAddr\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query shows agents which are not updated to the latest version" + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDL" }, { - "name": "tactics", - "value": "InitialAccess" - }, + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDLAma" + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1190", + "T1133" + ], + "entityMappings": [ { - "name": "techniques", - "value": "T1190,T1133" + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "IPCustomEntity", + "identifier": "Address" + } + ] } ] } @@ -916,13 +1523,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId6'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId4'),'/'))))]", "properties": { - "description": "PaloAltoCDL Hunting Query 6", - "parentId": "[variables('huntingQueryId6')]", - "contentId": "[variables('_huntingQuerycontentId6')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion6')]", + "description": "PaloAltoCDL Analytics Rule 4", + "parentId": "[variables('analyticRuleId4')]", + "contentId": "[variables('_analyticRulecontentId4')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion4')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -941,66 +1548,103 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('huntingQueryTemplateSpecName7')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "PaloAltoCDL Hunting Query 7 with template", - "displayName": "PaloAltoCDL Hunting Query template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId4')]", + "contentKind": "AnalyticsRule", + "displayName": "PaloAlto - Inbound connection to high risk ports", + "contentProductId": "[variables('_analyticRulecontentProductId4')]", + "id": "[variables('_analyticRulecontentProductId4')]", + "version": "[variables('analyticRuleVersion4')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('huntingQueryTemplateSpecName7'),'/',variables('huntingQueryVersion7'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName5')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName7'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLOutdatedConfigVersions_HuntingQueries Hunting Query with template version 2.0.4", + "description": "PaloAltoCDLPossibleAttackWithoutResponse_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion7')]", + "contentVersion": "[variables('analyticRuleVersion5')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", - "name": "PaloAltoCDL_Hunting_Query_7", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId5')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "PaloAlto - Outdated config vesions", - "category": "Hunting Queries", - "query": "let cur_ver = dynamic(['0.1']); //put latest config version here\nPaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(PanOSConfigVersion)\n| where PanOSConfigVersion != cur_ver\n| project SrcIpAddr, PanOSConfigVersion\n| extend IPCustomEntity = SrcIpAddr\n", - "version": 2, - "tags": [ + "description": "Detects possible attack without response.", + "displayName": "PaloAlto - Possible attack without response", + "enabled": false, + "query": "PaloAltoCDLEvent\n| where EventResourceId =~ 'THREAT'\n| where DvcAction !has \"block\" or DvcAction !has \"override\" or DvcAction !has \"deny\"\n| extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr, UrlCustomEntity = Url\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query shows outdated config vesions" + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDL" }, { - "name": "tactics", - "value": "InitialAccess" + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDLAma" + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1190", + "T1133" + ], + "entityMappings": [ + { + "entityType": "Account", + "fieldMappings": [ + { + "columnName": "AccountCustomEntity", + "identifier": "Name" + } + ] }, { - "name": "techniques", - "value": "T1190,T1133" + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "IPCustomEntity", + "identifier": "Address" + } + ] + }, + { + "entityType": "URL", + "fieldMappings": [ + { + "columnName": "UrlCustomEntity", + "identifier": "Url" + } + ] } ] } @@ -1008,13 +1652,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId7'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId5'),'/'))))]", "properties": { - "description": "PaloAltoCDL Hunting Query 7", - "parentId": "[variables('huntingQueryId7')]", - "contentId": "[variables('_huntingQuerycontentId7')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion7')]", + "description": "PaloAltoCDL Analytics Rule 5", + "parentId": "[variables('analyticRuleId5')]", + "contentId": "[variables('_analyticRulecontentId5')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion5')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -1033,66 +1677,94 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('huntingQueryTemplateSpecName8')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "PaloAltoCDL Hunting Query 8 with template", - "displayName": "PaloAltoCDL Hunting Query template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId5')]", + "contentKind": "AnalyticsRule", + "displayName": "PaloAlto - Possible attack without response", + "contentProductId": "[variables('_analyticRulecontentProductId5')]", + "id": "[variables('_analyticRulecontentProductId5')]", + "version": "[variables('analyticRuleVersion5')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('huntingQueryTemplateSpecName8'),'/',variables('huntingQueryVersion8'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName6')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName8'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLRareApplicationLayerProtocol_HuntingQueries Hunting Query with template version 2.0.4", + "description": "PaloAltoCDLPossibleFlooding_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion8')]", + "contentVersion": "[variables('analyticRuleVersion6')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", - "name": "PaloAltoCDL_Hunting_Query_8", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId6')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "PaloAlto - Rare application layer protocols", - "category": "Hunting Queries", - "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(NetworkApplicationProtocol) \n| summarize ApplicationLayerProtocol = count() by NetworkApplicationProtocol\n| top 10 by ApplicationLayerProtocol asc\n| extend UrlCustomEntity = NetworkApplicationProtocol\n", - "version": 2, - "tags": [ + "description": "Detects possible flooding.", + "displayName": "PaloAlto - Possible flooding", + "enabled": false, + "query": "PaloAltoCDLEvent\n| where EventResourceId =~ 'TRAFFIC'\n| where isnotempty(NetworkSessionId)\n| where DstBytes == 0 and tolong(NetworkPackets) > 0\n| extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query shows Rare application layer protocols" + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDL" }, { - "name": "tactics", - "value": "InitialAccess" + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDLAma" + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1190", + "T1133" + ], + "entityMappings": [ + { + "entityType": "Account", + "fieldMappings": [ + { + "columnName": "AccountCustomEntity", + "identifier": "Name" + } + ] }, { - "name": "techniques", - "value": "T1190,T1133" + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "IPCustomEntity", + "identifier": "Address" + } + ] } ] } @@ -1100,13 +1772,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId8'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId6'),'/'))))]", "properties": { - "description": "PaloAltoCDL Hunting Query 8", - "parentId": "[variables('huntingQueryId8')]", - "contentId": "[variables('_huntingQuerycontentId8')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion8')]", + "description": "PaloAltoCDL Analytics Rule 6", + "parentId": "[variables('analyticRuleId6')]", + "contentId": "[variables('_analyticRulecontentId6')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion6')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -1125,158 +1797,84 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('huntingQueryTemplateSpecName9')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "PaloAltoCDL Hunting Query 9 with template", - "displayName": "PaloAltoCDL Hunting Query template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId6')]", + "contentKind": "AnalyticsRule", + "displayName": "PaloAlto - Possible flooding", + "contentProductId": "[variables('_analyticRulecontentProductId6')]", + "id": "[variables('_analyticRulecontentProductId6')]", + "version": "[variables('analyticRuleVersion6')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('huntingQueryTemplateSpecName9'),'/',variables('huntingQueryVersion9'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName7')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName9'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLRareFileRequests_HuntingQueries Hunting Query with template version 2.0.4", + "description": "PaloAltoCDLPossiblePortScan_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion9')]", + "contentVersion": "[variables('analyticRuleVersion7')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", - "name": "PaloAltoCDL_Hunting_Query_9", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId7')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "PaloAlto - Rare files observed", - "category": "Hunting Queries", - "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(SrcFileName)\n| summarize RareFiles = count() by SrcFileName\n| top 20 by RareFiles asc\n| extend FileCustomEntity = SrcFileName\n", - "version": 2, - "tags": [ - { - "name": "description", - "value": "Query shows rare files observed" - }, - { - "name": "tactics", - "value": "InitialAccess" - }, - { - "name": "techniques", - "value": "T1190,T1133" - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId9'),'/'))))]", - "properties": { - "description": "PaloAltoCDL Hunting Query 9", - "parentId": "[variables('huntingQueryId9')]", - "contentId": "[variables('_huntingQuerycontentId9')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion9')]", - "source": { - "kind": "Solution", - "name": "PaloAltoCDL", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - } - ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('huntingQueryTemplateSpecName10')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "PaloAltoCDL Hunting Query 10 with template", - "displayName": "PaloAltoCDL Hunting Query template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('huntingQueryTemplateSpecName10'),'/',variables('huntingQueryVersion10'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName10'))]" - ], - "properties": { - "description": "PaloAltoCDLRarePortsbyUser_HuntingQueries Hunting Query with template version 2.0.4", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion10')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", - "name": "PaloAltoCDL_Hunting_Query_10", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "PaloAlto - Rare ports by user", - "category": "Hunting Queries", - "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(DstPortNumber) \n| summarize RarePorts = count() by DstPortNumber, DstIpAddr, DstUsername\n| top 20 by RarePorts asc \n| extend IPCustomEntity = DstIpAddr, AccountCustomEntity = DstUsername\n", - "version": 2, - "tags": [ + "description": "Detects possible port scan.", + "displayName": "PaloAlto - Possible port scan", + "enabled": false, + "query": "let threshold = 10;\nPaloAltoCDLEvent\n| where EventResourceId =~ 'TRAFFIC'\n| where isnotempty(DstPortNumber) and isnotempty(SrcIpAddr)\n| summarize PortSet = make_set(DstPortNumber) by SrcIpAddr, bin(TimeGenerated, 5m)\n| where array_length(PortSet) > threshold\n| extend IPCustomEntity = SrcIpAddr\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query shows rare ports by user." + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDL" }, { - "name": "tactics", - "value": "InitialAccess" - }, + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDLAma" + } + ], + "tactics": [ + "Reconnaissance" + ], + "techniques": [ + "T1595" + ], + "entityMappings": [ { - "name": "techniques", - "value": "T1190,T1133" + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "IPCustomEntity", + "identifier": "Address" + } + ] } ] } @@ -1284,13 +1882,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId10'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId7'),'/'))))]", "properties": { - "description": "PaloAltoCDL Hunting Query 10", - "parentId": "[variables('huntingQueryId10')]", - "contentId": "[variables('_huntingQuerycontentId10')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion10')]", + "description": "PaloAltoCDL Analytics Rule 7", + "parentId": "[variables('analyticRuleId7')]", + "contentId": "[variables('_analyticRulecontentId7')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion7')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -1309,405 +1907,161 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('dataConnectorTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "PaloAltoCDL data connector with template", - "displayName": "PaloAltoCDL template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId7')]", + "contentKind": "AnalyticsRule", + "displayName": "PaloAlto - Possible port scan", + "contentProductId": "[variables('_analyticRulecontentProductId7')]", + "id": "[variables('_analyticRulecontentProductId7')]", + "version": "[variables('analyticRuleVersion7')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName8')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDL data connector with template version 2.0.4", + "description": "PaloAltoCDLPrivilegesWasChanged_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion1')]", + "contentVersion": "[variables('analyticRuleVersion8')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId8')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId1')]", - "title": "Palo Alto Networks Cortex Data Lake (CDL)", - "publisher": "Palo Alto Networks", - "descriptionMarkdown": "The [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) data connector provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview.html) into Microsoft Sentinel.", - "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "PaloAltoNetworksCDL", - "baseQuery": "PaloAltoCDLEvent" - } - ], - "sampleQueries": [ - { - "description": "Top 10 Destinations", - "query": "PaloAltoCDLEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (PaloAltoNetworksCDL)", - "lastDataReceivedQuery": "PaloAltoCDLEvent\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "PaloAltoCDLEvent\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(1d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false + "description": "Detects changing of user privileges.", + "displayName": "PaloAlto - User privileges was changed", + "enabled": false, + "query": "let q_period = 14d;\nlet dt_lookBack = 24h;\nlet p = PaloAltoCDLEvent\n| where TimeGenerated between (ago(q_period)..ago(dt_lookBack))\n| summarize OldPrivileges = make_set(DestinationUserPrivileges) by DstUsername;\nPaloAltoCDLEvent\n| where TimeGenerated > ago(dt_lookBack)\n| summarize NewPrivileges = make_set(DestinationUserPrivileges) by DstUsername\n| join kind=innerunique (p) on DstUsername\n| where tostring(OldPrivileges) != tostring(NewPrivileges)\n| extend AccountCustomEntity = DstUsername\n", + "queryFrequency": "PT1H", + "queryPeriod": "P14D", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDL" }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, + { + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDLAma" + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1190", + "T1133" + ], + "entityMappings": [ + { + "entityType": "Account", + "fieldMappings": [ { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution." - }, - { - "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", - "innerSteps": [ - { - "title": "1.1 Select or create a Linux machine", - "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." - }, - { - "title": "1.2 Install the CEF collector on the Linux machine", - "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Run the following command to install and apply the CEF collector:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ] - } - ], - "title": "1. Linux Syslog agent configuration" - }, - { - "description": "[Follow the instructions](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-from-logging-service-to-syslog-server.html) to configure logs forwarding from Cortex Data Lake to a Syslog Server.", - "title": "2. Configure Cortex Data Lake to forward logs to a Syslog Server using CEF" - }, - { - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" - }, - "type": "CopyableLabel" - } - ], - "title": "3. Validate connection" - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "4. Secure your machine " - } - ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "PaloAltoCDL", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - } - ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId1')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "PaloAltoCDL", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "title": "Palo Alto Networks Cortex Data Lake (CDL)", - "publisher": "Palo Alto Networks", - "descriptionMarkdown": "The [Palo Alto Networks CDL](https://www.paloaltonetworks.com/cortex/cortex-data-lake) data connector provides the capability to ingest [CDL logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/log-forwarding-schema-overview.html) into Microsoft Sentinel.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "PaloAltoNetworksCDL", - "baseQuery": "PaloAltoCDLEvent" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (PaloAltoNetworksCDL)", - "lastDataReceivedQuery": "PaloAltoCDLEvent\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "PaloAltoCDLEvent\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(1d)" - ] - } - ], - "sampleQueries": [ - { - "description": "Top 10 Destinations", - "query": "PaloAltoCDLEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution." - }, - { - "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", - "innerSteps": [ - { - "title": "1.1 Select or create a Linux machine", - "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." - }, - { - "title": "1.2 Install the CEF collector on the Linux machine", - "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Run the following command to install and apply the CEF collector:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ] - } - ], - "title": "1. Linux Syslog agent configuration" - }, - { - "description": "[Follow the instructions](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-from-logging-service-to-syslog-server.html) to configure logs forwarding from Cortex Data Lake to a Syslog Server.", - "title": "2. Configure Cortex Data Lake to forward logs to a Syslog Server using CEF" + "columnName": "AccountCustomEntity", + "identifier": "Name" + } + ] + } + ] + } }, { - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" - }, - "type": "CopyableLabel" + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId8'),'/'))))]", + "properties": { + "description": "PaloAltoCDL Analytics Rule 8", + "parentId": "[variables('analyticRuleId8')]", + "contentId": "[variables('_analyticRulecontentId8')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion8')]", + "source": { + "kind": "Solution", + "name": "PaloAltoCDL", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } - ], - "title": "3. Validate connection" - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "4. Secure your machine " + } } - ], - "id": "[variables('_uiConfigId1')]", - "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**PaloAltoCDLEvent**](https://aka.ms/sentinel-paloaltocdl-parser) which is deployed with the Microsoft Sentinel Solution." - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "PaloAltoCDL Analytics Rule 1 with template", - "displayName": "PaloAltoCDL Analytics Rule template" + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId8')]", + "contentKind": "AnalyticsRule", + "displayName": "PaloAlto - User privileges was changed", + "contentProductId": "[variables('_analyticRulecontentProductId8')]", + "id": "[variables('_analyticRulecontentProductId8')]", + "version": "[variables('analyticRuleVersion8')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName1'),'/',variables('analyticRuleVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName9')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLConflictingMacAddress_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "PaloAltoCDLPutMethodInHighRiskFileType_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion1')]", + "contentVersion": "[variables('analyticRuleVersion9')]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId1')]", + "name": "[variables('analyticRulecontentId9')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects several users with the same MAC address.", - "displayName": "PaloAlto - MAC address conflict", + "description": "Detects put and post method request in high risk file type.", + "displayName": "PaloAlto - Put and post method request in high risk file type", "enabled": false, - "query": "let threshold = 2;\nPaloAltoCDLEvent\n| where EventResourceId =~ 'TRAFFIC'\n| where isnotempty(DestinationMACAddress) and isnotempty(DstUsername)\n| summarize UserSet = make_set(DstUsername) by DestinationMACAddress\n| extend Users = array_length(UserSet)\n| where Users >= threshold\n| extend AccountCustomEntity = UserSet, IPCustomEntity = DestinationMACAddress\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "Low", + "query": "let HighRiskFileType = dynamic(['.exe', '.msi', '.msp', '.jar', '.bat', '.cmd', '.js', '.jse', 'ws', '.ps1', '.ps2', '.msh']);\nPaloAltoCDLEvent\n| where EventResourceId =~ 'THREAT'\n| where EventResult =~ 'file'\n| where HttpRequestMethod has_any (\"POST\", \"PUT\")\n| where FileType in (HighRiskFileType)\n| extend FileCustomEntity = SrcFileName\n", + "queryFrequency": "PT10M", + "queryPeriod": "PT10M", + "severity": "High", "suppressionDuration": "PT1H", "suppressionEnabled": false, "triggerOperator": "GreaterThan", @@ -1715,10 +2069,16 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "PaloAltoCDL", "dataTypes": [ "PaloAltoCDLEvent" - ] + ], + "connectorId": "PaloAltoCDL" + }, + { + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDLAma" } ], "tactics": [ @@ -1730,22 +2090,13 @@ ], "entityMappings": [ { + "entityType": "File", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" - } - ], - "entityType": "Account" - }, - { - "fieldMappings": [ - { - "identifier": "Address", - "columnName": "IPCustomEntity" + "columnName": "FileCustomEntity", + "identifier": "Name" } - ], - "entityType": "IP" + ] } ] } @@ -1753,13 +2104,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId9'),'/'))))]", "properties": { - "description": "PaloAltoCDL Analytics Rule 1", - "parentId": "[variables('analyticRuleId1')]", - "contentId": "[variables('_analyticRulecontentId1')]", + "description": "PaloAltoCDL Analytics Rule 9", + "parentId": "[variables('analyticRuleId9')]", + "contentId": "[variables('_analyticRulecontentId9')]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion1')]", + "version": "[variables('analyticRuleVersion9')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -1778,54 +2129,47 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName2')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "PaloAltoCDL Analytics Rule 2 with template", - "displayName": "PaloAltoCDL Analytics Rule template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId9')]", + "contentKind": "AnalyticsRule", + "displayName": "PaloAlto - Put and post method request in high risk file type", + "contentProductId": "[variables('_analyticRulecontentProductId9')]", + "id": "[variables('_analyticRulecontentProductId9')]", + "version": "[variables('analyticRuleVersion9')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName2'),'/',variables('analyticRuleVersion2'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName10')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName2'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLDroppingSessionWithSentTraffic_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "PaloAltoCDLUnexpectedCountries_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion2')]", + "contentVersion": "[variables('analyticRuleVersion10')]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId2')]", + "name": "[variables('analyticRulecontentId10')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects dropping or denying session with traffic.", - "displayName": "PaloAlto - Dropping or denying session with traffic", + "description": "Detects suspicious connections from forbidden countries.", + "displayName": "PaloAlto - Forbidden countries", "enabled": false, - "query": "let threshold = 100;\nPaloAltoCDLEvent\n| where EventResourceId =~ 'TRAFFIC'\n| where EventResult has_any (\"deny\", \"drop\", \"reject\") \n| where tolong(DstBytes) > 0\n| where tolong(NetworkPackets) > 0\n| summarize count() by SrcIpAddr, DstUsername, bin(TimeGenerated, 10m)\n| where count_ > threshold\n| extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr\n", + "query": "let bl_countries = dynamic(['CH', 'RU']);\nPaloAltoCDLEvent \n| where EventResourceId =~ 'TRAFFIC'\n| where MaliciousIPCountry in (bl_countries)\n| summarize count() by DstUsername, SrcIpAddr \n| extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -1836,10 +2180,16 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "PaloAltoCDL", "dataTypes": [ "PaloAltoCDLEvent" - ] + ], + "connectorId": "PaloAltoCDL" + }, + { + "dataTypes": [ + "PaloAltoCDLEvent" + ], + "connectorId": "PaloAltoCDLAma" } ], "tactics": [ @@ -1851,22 +2201,192 @@ ], "entityMappings": [ { - "fieldMappings": [ - { - "identifier": "Name", - "columnName": "AccountCustomEntity" - } - ], - "entityType": "Account" + "entityType": "Account", + "fieldMappings": [ + { + "columnName": "AccountCustomEntity", + "identifier": "Name" + } + ] + }, + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "IPCustomEntity", + "identifier": "Address" + } + ] + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId10'),'/'))))]", + "properties": { + "description": "PaloAltoCDL Analytics Rule 10", + "parentId": "[variables('analyticRuleId10')]", + "contentId": "[variables('_analyticRulecontentId10')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion10')]", + "source": { + "kind": "Solution", + "name": "PaloAltoCDL", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId10')]", + "contentKind": "AnalyticsRule", + "displayName": "PaloAlto - Forbidden countries", + "contentProductId": "[variables('_analyticRulecontentProductId10')]", + "id": "[variables('_analyticRulecontentProductId10')]", + "version": "[variables('analyticRuleVersion10')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "PaloAltoCDLCriticalEventResult_HuntingQueries Hunting Query with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('huntingQueryVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "PaloAltoCDL_Hunting_Query_1", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "PaloAlto - Critical event result", + "category": "Hunting Queries", + "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where EventSeverity has 'critical' or tostring(ThreatSeverity) has_any ('high', 'critical')\n| extend UrlCustomEntity = Url, AccountCustomEntity = DstUsername\n", + "version": 2, + "tags": [ + { + "name": "description", + "value": "Query shows critical event result" + }, + { + "name": "tactics", + "value": "InitialAccess" + }, + { + "name": "techniques", + "value": "T1190,T1133" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId1'),'/'))))]", + "properties": { + "description": "PaloAltoCDL Hunting Query 1", + "parentId": "[variables('huntingQueryId1')]", + "contentId": "[variables('_huntingQuerycontentId1')]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryVersion1')]", + "source": { + "kind": "Solution", + "name": "PaloAltoCDL", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId1')]", + "contentKind": "HuntingQuery", + "displayName": "PaloAlto - Critical event result", + "contentProductId": "[variables('_huntingQuerycontentProductId1')]", + "id": "[variables('_huntingQuerycontentProductId1')]", + "version": "[variables('huntingQueryVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryTemplateSpecName2')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "PaloAltoCDLFilePermissionWithPutRequest_HuntingQueries Hunting Query with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('huntingQueryVersion2')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "PaloAltoCDL_Hunting_Query_2", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "PaloAlto - File permission with PUT or POST request", + "category": "Hunting Queries", + "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where HttpRequestMethod contains \"PUT\" or HttpRequestMethod contains \"POST\"\n| where isnotempty(FilePermission)\n| summarize Permissions = count() by FilePermission, DstUsername\n| extend AccountCustomEntity = DstUsername\n", + "version": 2, + "tags": [ + { + "name": "description", + "value": "Query shows file permission with PUT or POST request" }, { - "fieldMappings": [ - { - "identifier": "Address", - "columnName": "IPCustomEntity" - } - ], - "entityType": "IP" + "name": "tactics", + "value": "InitialAccess" + }, + { + "name": "techniques", + "value": "T1190,T1133" } ] } @@ -1874,13 +2394,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId2'),'/'))))]", "properties": { - "description": "PaloAltoCDL Analytics Rule 2", - "parentId": "[variables('analyticRuleId2')]", - "contentId": "[variables('_analyticRulecontentId2')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion2')]", + "description": "PaloAltoCDL Hunting Query 2", + "parentId": "[variables('huntingQueryId2')]", + "contentId": "[variables('_huntingQuerycontentId2')]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryVersion2')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -1899,95 +2419,59 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName3')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "PaloAltoCDL Analytics Rule 3 with template", - "displayName": "PaloAltoCDL Analytics Rule template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId2')]", + "contentKind": "HuntingQuery", + "displayName": "PaloAlto - File permission with PUT or POST request", + "contentProductId": "[variables('_huntingQuerycontentProductId2')]", + "id": "[variables('_huntingQuerycontentProductId2')]", + "version": "[variables('huntingQueryVersion2')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName3'),'/',variables('analyticRuleVersion3'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryTemplateSpecName3')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName3'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLFileTypeWasChanged_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "PaloAltoCDLIPsByPorts_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion3')]", + "contentVersion": "[variables('huntingQueryVersion3')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId3')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "PaloAltoCDL_Hunting_Query_3", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects when file type changed.", - "displayName": "PaloAlto - File type changed", - "enabled": false, - "query": "PaloAltoCDLEvent\n| where EventResourceId =~ 'THREAT'\n| where EventResult =~ 'file'\n| where FileType != OldFileType\n| extend FileCustomEntity = SrcFileName, AccountCustomEntity = DstUsername\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ + "eTag": "*", + "displayName": "PaloAlto - Destination ports by IPs", + "category": "Hunting Queries", + "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(DstPortNumber)\n| summarize IP_Dst = make_set(tostring(DstNatIpAddr)) by DstPortNumber\n| extend IPCustomEntity = IP_Dst\n", + "version": 2, + "tags": [ { - "connectorId": "PaloAltoCDL", - "dataTypes": [ - "PaloAltoCDLEvent" - ] - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1190", - "T1133" - ], - "entityMappings": [ + "name": "description", + "value": "Query shows destination ports by IP address." + }, { - "fieldMappings": [ - { - "identifier": "Name", - "columnName": "AccountCustomEntity" - } - ], - "entityType": "Account" + "name": "tactics", + "value": "InitialAccess" }, { - "fieldMappings": [ - { - "identifier": "Name", - "columnName": "FileCustomEntity" - } - ], - "entityType": "File" + "name": "techniques", + "value": "T1190,T1133" } ] } @@ -1995,13 +2479,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId3'),'/'))))]", "properties": { - "description": "PaloAltoCDL Analytics Rule 3", - "parentId": "[variables('analyticRuleId3')]", - "contentId": "[variables('_analyticRulecontentId3')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion3')]", + "description": "PaloAltoCDL Hunting Query 3", + "parentId": "[variables('huntingQueryId3')]", + "contentId": "[variables('_huntingQuerycontentId3')]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryVersion3')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -2020,86 +2504,59 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName4')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "PaloAltoCDL Analytics Rule 4 with template", - "displayName": "PaloAltoCDL Analytics Rule template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId3')]", + "contentKind": "HuntingQuery", + "displayName": "PaloAlto - Destination ports by IPs", + "contentProductId": "[variables('_huntingQuerycontentProductId3')]", + "id": "[variables('_huntingQuerycontentProductId3')]", + "version": "[variables('huntingQueryVersion3')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName4'),'/',variables('analyticRuleVersion4'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryTemplateSpecName4')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName4'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLInboundRiskPorts_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "PaloAltoCDLIncompleteApplicationProtocol_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion4')]", + "contentVersion": "[variables('huntingQueryVersion4')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId4')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "PaloAltoCDL_Hunting_Query_4", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects inbound connection to high risk ports.", - "displayName": "PaloAlto - Inbound connection to high risk ports", - "enabled": false, - "query": "let HighRiskPorts = dynamic(['21', '22', '23', '25', '53', '443', '110', '135', '137', '138', '139', '1433', '1434']);\nPaloAltoCDLEvent\n| where EventResourceId =~ 'TRAFFIC'\n| where ipv4_is_private(SrcIpAddr) == false\n| where DstPortNumber in (HighRiskPorts)\n| extend IPCustomEntity = SrcIpAddr\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ + "eTag": "*", + "displayName": "PaloAlto - Incomplete application protocol", + "category": "Hunting Queries", + "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where NetworkApplicationProtocol has_any (\"incomplete\", \"Not-Applicable\", \"insufficient\")\n| extend UrlCustomEntity = Url, IPCustomEntity = DstIpAddr\n", + "version": 2, + "tags": [ { - "connectorId": "PaloAltoCDL", - "dataTypes": [ - "PaloAltoCDLEvent" - ] - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1190", - "T1133" - ], - "entityMappings": [ + "name": "description", + "value": "Query shows incomplete application protocol" + }, { - "fieldMappings": [ - { - "identifier": "Address", - "columnName": "IPCustomEntity" - } - ], - "entityType": "IP" + "name": "tactics", + "value": "InitialAccess" + }, + { + "name": "techniques", + "value": "T1190,T1133" } ] } @@ -2107,13 +2564,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId4'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId4'),'/'))))]", "properties": { - "description": "PaloAltoCDL Analytics Rule 4", - "parentId": "[variables('analyticRuleId4')]", - "contentId": "[variables('_analyticRulecontentId4')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion4')]", + "description": "PaloAltoCDL Hunting Query 4", + "parentId": "[variables('huntingQueryId4')]", + "contentId": "[variables('_huntingQuerycontentId4')]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryVersion4')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -2132,104 +2589,59 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName5')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "PaloAltoCDL Analytics Rule 5 with template", - "displayName": "PaloAltoCDL Analytics Rule template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId4')]", + "contentKind": "HuntingQuery", + "displayName": "PaloAlto - Incomplete application protocol", + "contentProductId": "[variables('_huntingQuerycontentProductId4')]", + "id": "[variables('_huntingQuerycontentProductId4')]", + "version": "[variables('huntingQueryVersion4')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName5'),'/',variables('analyticRuleVersion5'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryTemplateSpecName5')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName5'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLPossibleAttackWithoutResponse_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "PaloAltoCDLMultiDenyResultbyUser_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion5')]", + "contentVersion": "[variables('huntingQueryVersion5')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId5')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "PaloAltoCDL_Hunting_Query_5", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects possible attack without response.", - "displayName": "PaloAlto - Possible attack without response", - "enabled": false, - "query": "PaloAltoCDLEvent\n| where EventResourceId =~ 'THREAT'\n| where DvcAction !has \"block\" or DvcAction !has \"override\" or DvcAction !has \"deny\"\n| extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr, UrlCustomEntity = Url\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "connectorId": "PaloAltoCDL", - "dataTypes": [ - "PaloAltoCDLEvent" - ] - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1190", - "T1133" - ], - "entityMappings": [ + "eTag": "*", + "displayName": "PaloAlto - Multiple Deny result by user", + "category": "Hunting Queries", + "query": "let threshold = 20;\nPaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where DvcAction has 'deny'\n| summarize DenyCount = count() by DvcAction, DstUsername\n| where DenyCount > threshold\n| extend AccountCustomEntity = DstUsername\n", + "version": 2, + "tags": [ { - "fieldMappings": [ - { - "identifier": "Name", - "columnName": "AccountCustomEntity" - } - ], - "entityType": "Account" + "name": "description", + "value": "Query shows multiple Deny results by user" }, { - "fieldMappings": [ - { - "identifier": "Address", - "columnName": "IPCustomEntity" - } - ], - "entityType": "IP" + "name": "tactics", + "value": "InitialAccess" }, { - "fieldMappings": [ - { - "identifier": "Url", - "columnName": "UrlCustomEntity" - } - ], - "entityType": "URL" + "name": "techniques", + "value": "T1190,T1133" } ] } @@ -2237,13 +2649,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId5'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId5'),'/'))))]", "properties": { - "description": "PaloAltoCDL Analytics Rule 5", - "parentId": "[variables('analyticRuleId5')]", - "contentId": "[variables('_analyticRulecontentId5')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion5')]", + "description": "PaloAltoCDL Hunting Query 5", + "parentId": "[variables('huntingQueryId5')]", + "contentId": "[variables('_huntingQuerycontentId5')]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryVersion5')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -2262,95 +2674,59 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName6')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "PaloAltoCDL Analytics Rule 6 with template", - "displayName": "PaloAltoCDL Analytics Rule template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId5')]", + "contentKind": "HuntingQuery", + "displayName": "PaloAlto - Multiple Deny result by user", + "contentProductId": "[variables('_huntingQuerycontentProductId5')]", + "id": "[variables('_huntingQuerycontentProductId5')]", + "version": "[variables('huntingQueryVersion5')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName6'),'/',variables('analyticRuleVersion6'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryTemplateSpecName6')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName6'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLPossibleFlooding_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "PaloAltoCDLOutdatedAgentVersions_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion6')]", + "contentVersion": "[variables('huntingQueryVersion6')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId6')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "PaloAltoCDL_Hunting_Query_6", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects possible flooding.", - "displayName": "PaloAlto - Possible flooding", - "enabled": false, - "query": "PaloAltoCDLEvent\n| where EventResourceId =~ 'TRAFFIC'\n| where isnotempty(NetworkSessionId)\n| where DstBytes == 0 and tolong(NetworkPackets) > 0\n| extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ + "eTag": "*", + "displayName": "PaloAlto - Agent versions", + "category": "Hunting Queries", + "query": "let cur_ver = dynamic(['0.1']); //put latest agent version here\nPaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(PanOSAgentVersion)\n| where PanOSAgentVersion != cur_ver\n| project SrcIpAddr, PanOSAgentVersion\n| extend IPCustomEntity = SrcIpAddr\n", + "version": 2, + "tags": [ { - "connectorId": "PaloAltoCDL", - "dataTypes": [ - "PaloAltoCDLEvent" - ] - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1190", - "T1133" - ], - "entityMappings": [ + "name": "description", + "value": "Query shows agents which are not updated to the latest version" + }, { - "fieldMappings": [ - { - "identifier": "Name", - "columnName": "AccountCustomEntity" - } - ], - "entityType": "Account" + "name": "tactics", + "value": "InitialAccess" }, { - "fieldMappings": [ - { - "identifier": "Address", - "columnName": "IPCustomEntity" - } - ], - "entityType": "IP" + "name": "techniques", + "value": "T1190,T1133" } ] } @@ -2358,13 +2734,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId6'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId6'),'/'))))]", "properties": { - "description": "PaloAltoCDL Analytics Rule 6", - "parentId": "[variables('analyticRuleId6')]", - "contentId": "[variables('_analyticRulecontentId6')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion6')]", + "description": "PaloAltoCDL Hunting Query 6", + "parentId": "[variables('huntingQueryId6')]", + "contentId": "[variables('_huntingQuerycontentId6')]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryVersion6')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -2383,85 +2759,59 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName7')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "PaloAltoCDL Analytics Rule 7 with template", - "displayName": "PaloAltoCDL Analytics Rule template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId6')]", + "contentKind": "HuntingQuery", + "displayName": "PaloAlto - Agent versions", + "contentProductId": "[variables('_huntingQuerycontentProductId6')]", + "id": "[variables('_huntingQuerycontentProductId6')]", + "version": "[variables('huntingQueryVersion6')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName7'),'/',variables('analyticRuleVersion7'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryTemplateSpecName7')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName7'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLPossiblePortScan_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "PaloAltoCDLOutdatedConfigVersions_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion7')]", + "contentVersion": "[variables('huntingQueryVersion7')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId7')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "PaloAltoCDL_Hunting_Query_7", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects possible port scan.", - "displayName": "PaloAlto - Possible port scan", - "enabled": false, - "query": "let threshold = 10;\nPaloAltoCDLEvent\n| where EventResourceId =~ 'TRAFFIC'\n| where isnotempty(DstPortNumber) and isnotempty(SrcIpAddr)\n| summarize PortSet = make_set(DstPortNumber) by SrcIpAddr, bin(TimeGenerated, 5m)\n| where array_length(PortSet) > threshold\n| extend IPCustomEntity = SrcIpAddr\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ + "eTag": "*", + "displayName": "PaloAlto - Outdated config vesions", + "category": "Hunting Queries", + "query": "let cur_ver = dynamic(['0.1']); //put latest config version here\nPaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(PanOSConfigVersion)\n| where PanOSConfigVersion != cur_ver\n| project SrcIpAddr, PanOSConfigVersion\n| extend IPCustomEntity = SrcIpAddr\n", + "version": 2, + "tags": [ { - "connectorId": "PaloAltoCDL", - "dataTypes": [ - "PaloAltoCDLEvent" - ] - } - ], - "tactics": [ - "Reconnaissance" - ], - "techniques": [ - "T1595" - ], - "entityMappings": [ + "name": "description", + "value": "Query shows outdated config vesions" + }, { - "fieldMappings": [ - { - "identifier": "Address", - "columnName": "IPCustomEntity" - } - ], - "entityType": "IP" + "name": "tactics", + "value": "InitialAccess" + }, + { + "name": "techniques", + "value": "T1190,T1133" } ] } @@ -2469,13 +2819,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId7'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId7'),'/'))))]", "properties": { - "description": "PaloAltoCDL Analytics Rule 7", - "parentId": "[variables('analyticRuleId7')]", - "contentId": "[variables('_analyticRulecontentId7')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion7')]", + "description": "PaloAltoCDL Hunting Query 7", + "parentId": "[variables('huntingQueryId7')]", + "contentId": "[variables('_huntingQuerycontentId7')]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryVersion7')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -2494,86 +2844,59 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName8')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "PaloAltoCDL Analytics Rule 8 with template", - "displayName": "PaloAltoCDL Analytics Rule template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId7')]", + "contentKind": "HuntingQuery", + "displayName": "PaloAlto - Outdated config vesions", + "contentProductId": "[variables('_huntingQuerycontentProductId7')]", + "id": "[variables('_huntingQuerycontentProductId7')]", + "version": "[variables('huntingQueryVersion7')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName8'),'/',variables('analyticRuleVersion8'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryTemplateSpecName8')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName8'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLPrivilegesWasChanged_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "PaloAltoCDLRareApplicationLayerProtocol_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion8')]", + "contentVersion": "[variables('huntingQueryVersion8')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId8')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "PaloAltoCDL_Hunting_Query_8", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects changing of user privileges.", - "displayName": "PaloAlto - User privileges was changed", - "enabled": false, - "query": "let q_period = 14d;\nlet dt_lookBack = 24h;\nlet p = PaloAltoCDLEvent\n| where TimeGenerated between (ago(q_period)..ago(dt_lookBack))\n| summarize OldPrivileges = make_set(DestinationUserPrivileges) by DstUsername;\nPaloAltoCDLEvent\n| where TimeGenerated > ago(dt_lookBack)\n| summarize NewPrivileges = make_set(DestinationUserPrivileges) by DstUsername\n| join kind=innerunique (p) on DstUsername\n| where tostring(OldPrivileges) != tostring(NewPrivileges)\n| extend AccountCustomEntity = DstUsername\n", - "queryFrequency": "PT1H", - "queryPeriod": "P14D", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ + "eTag": "*", + "displayName": "PaloAlto - Rare application layer protocols", + "category": "Hunting Queries", + "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(NetworkApplicationProtocol) \n| summarize ApplicationLayerProtocol = count() by NetworkApplicationProtocol\n| top 10 by ApplicationLayerProtocol asc\n| extend UrlCustomEntity = NetworkApplicationProtocol\n", + "version": 2, + "tags": [ { - "connectorId": "PaloAltoCDL", - "dataTypes": [ - "PaloAltoCDLEvent" - ] - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1190", - "T1133" - ], - "entityMappings": [ + "name": "description", + "value": "Query shows Rare application layer protocols" + }, { - "fieldMappings": [ - { - "identifier": "Name", - "columnName": "AccountCustomEntity" - } - ], - "entityType": "Account" + "name": "tactics", + "value": "InitialAccess" + }, + { + "name": "techniques", + "value": "T1190,T1133" } ] } @@ -2581,13 +2904,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId8'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId8'),'/'))))]", "properties": { - "description": "PaloAltoCDL Analytics Rule 8", - "parentId": "[variables('analyticRuleId8')]", - "contentId": "[variables('_analyticRulecontentId8')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion8')]", + "description": "PaloAltoCDL Hunting Query 8", + "parentId": "[variables('huntingQueryId8')]", + "contentId": "[variables('_huntingQuerycontentId8')]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryVersion8')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -2606,86 +2929,59 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName9')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "PaloAltoCDL Analytics Rule 9 with template", - "displayName": "PaloAltoCDL Analytics Rule template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId8')]", + "contentKind": "HuntingQuery", + "displayName": "PaloAlto - Rare application layer protocols", + "contentProductId": "[variables('_huntingQuerycontentProductId8')]", + "id": "[variables('_huntingQuerycontentProductId8')]", + "version": "[variables('huntingQueryVersion8')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName9'),'/',variables('analyticRuleVersion9'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryTemplateSpecName9')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName9'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLPutMethodInHighRiskFileType_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "PaloAltoCDLRareFileRequests_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion9')]", + "contentVersion": "[variables('huntingQueryVersion9')]", "parameters": {}, "variables": {}, "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId9')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + { + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "PaloAltoCDL_Hunting_Query_9", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects put and post method request in high risk file type.", - "displayName": "PaloAlto - Put and post method request in high risk file type", - "enabled": false, - "query": "let HighRiskFileType = dynamic(['.exe', '.msi', '.msp', '.jar', '.bat', '.cmd', '.js', '.jse', 'ws', '.ps1', '.ps2', '.msh']);\nPaloAltoCDLEvent\n| where EventResourceId =~ 'THREAT'\n| where EventResult =~ 'file'\n| where HttpRequestMethod has_any (\"POST\", \"PUT\")\n| where FileType in (HighRiskFileType)\n| extend FileCustomEntity = SrcFileName\n", - "queryFrequency": "PT10M", - "queryPeriod": "PT10M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ + "eTag": "*", + "displayName": "PaloAlto - Rare files observed", + "category": "Hunting Queries", + "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(SrcFileName)\n| summarize RareFiles = count() by SrcFileName\n| top 20 by RareFiles asc\n| extend FileCustomEntity = SrcFileName\n", + "version": 2, + "tags": [ { - "connectorId": "PaloAltoCDL", - "dataTypes": [ - "PaloAltoCDLEvent" - ] - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1190", - "T1133" - ], - "entityMappings": [ + "name": "description", + "value": "Query shows rare files observed" + }, { - "fieldMappings": [ - { - "identifier": "Name", - "columnName": "FileCustomEntity" - } - ], - "entityType": "File" + "name": "tactics", + "value": "InitialAccess" + }, + { + "name": "techniques", + "value": "T1190,T1133" } ] } @@ -2693,13 +2989,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId9'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId9'),'/'))))]", "properties": { - "description": "PaloAltoCDL Analytics Rule 9", - "parentId": "[variables('analyticRuleId9')]", - "contentId": "[variables('_analyticRulecontentId9')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion9')]", + "description": "PaloAltoCDL Hunting Query 9", + "parentId": "[variables('huntingQueryId9')]", + "contentId": "[variables('_huntingQuerycontentId9')]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryVersion9')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -2718,95 +3014,59 @@ } } ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiversion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName10')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "PaloAltoCDL Analytics Rule 10 with template", - "displayName": "PaloAltoCDL Analytics Rule template" + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId9')]", + "contentKind": "HuntingQuery", + "displayName": "PaloAlto - Rare files observed", + "contentProductId": "[variables('_huntingQuerycontentProductId9')]", + "id": "[variables('_huntingQuerycontentProductId9')]", + "version": "[variables('huntingQueryVersion9')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiversion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName10'),'/',variables('analyticRuleVersion10'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryTemplateSpecName10')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName10'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PaloAltoCDLUnexpectedCountries_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "PaloAltoCDLRarePortsbyUser_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion10')]", + "contentVersion": "[variables('huntingQueryVersion10')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId10')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "PaloAltoCDL_Hunting_Query_10", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects suspicious connections from forbidden countries.", - "displayName": "PaloAlto - Forbidden countries", - "enabled": false, - "query": "let bl_countries = dynamic(['CH', 'RU']);\nPaloAltoCDLEvent \n| where EventResourceId =~ 'TRAFFIC'\n| where MaliciousIPCountry in (bl_countries)\n| summarize count() by DstUsername, SrcIpAddr \n| extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUsername\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ + "eTag": "*", + "displayName": "PaloAlto - Rare ports by user", + "category": "Hunting Queries", + "query": "PaloAltoCDLEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(DstPortNumber) \n| summarize RarePorts = count() by DstPortNumber, DstIpAddr, DstUsername\n| top 20 by RarePorts asc \n| extend IPCustomEntity = DstIpAddr, AccountCustomEntity = DstUsername\n", + "version": 2, + "tags": [ { - "connectorId": "PaloAltoCDL", - "dataTypes": [ - "PaloAltoCDLEvent" - ] - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1190", - "T1133" - ], - "entityMappings": [ + "name": "description", + "value": "Query shows rare ports by user." + }, { - "fieldMappings": [ - { - "identifier": "Name", - "columnName": "AccountCustomEntity" - } - ], - "entityType": "Account" + "name": "tactics", + "value": "InitialAccess" }, { - "fieldMappings": [ - { - "identifier": "Address", - "columnName": "IPCustomEntity" - } - ], - "entityType": "IP" + "name": "techniques", + "value": "T1190,T1133" } ] } @@ -2814,13 +3074,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId10'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId10'),'/'))))]", "properties": { - "description": "PaloAltoCDL Analytics Rule 10", - "parentId": "[variables('analyticRuleId10')]", - "contentId": "[variables('_analyticRulecontentId10')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion10')]", + "description": "PaloAltoCDL Hunting Query 10", + "parentId": "[variables('huntingQueryId10')]", + "contentId": "[variables('_huntingQuerycontentId10')]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryVersion10')]", "source": { "kind": "Solution", "name": "PaloAltoCDL", @@ -2839,17 +3099,35 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId10')]", + "contentKind": "HuntingQuery", + "displayName": "PaloAlto - Rare ports by user", + "contentProductId": "[variables('_huntingQuerycontentProductId10')]", + "id": "[variables('_huntingQuerycontentProductId10')]", + "version": "[variables('huntingQueryVersion10')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.4", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "PaloAltoCDL", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Palo Alto Networks CDL solution provides the capability to ingest CDL logs into Microsoft Sentinel.

\n
    \n

  1. PaloAltoCDL via AMA - This data connector helps in ingesting PaloAltoCDL logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. PaloAltoCDL via Legacy Agent - This data connector helps in ingesting PaloAltoCDL logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends installation of PaloAltoCDL via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 2, Parsers: 1, Workbooks: 1, Analytic Rules: 10, Hunting Queries: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { @@ -2871,9 +3149,14 @@ "operator": "AND", "criteria": [ { - "kind": "Workbook", - "contentId": "[variables('_workbookContentId1')]", - "version": "[variables('workbookVersion1')]" + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId1')]", + "version": "[variables('dataConnectorVersion1')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId2')]", + "version": "[variables('dataConnectorVersion2')]" }, { "kind": "Parser", @@ -2881,59 +3164,9 @@ "version": "[variables('parserVersion1')]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId1')]", - "version": "[variables('huntingQueryVersion1')]" - }, - { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId2')]", - "version": "[variables('huntingQueryVersion2')]" - }, - { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId3')]", - "version": "[variables('huntingQueryVersion3')]" - }, - { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId4')]", - "version": "[variables('huntingQueryVersion4')]" - }, - { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId5')]", - "version": "[variables('huntingQueryVersion5')]" - }, - { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId6')]", - "version": "[variables('huntingQueryVersion6')]" - }, - { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId7')]", - "version": "[variables('huntingQueryVersion7')]" - }, - { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId8')]", - "version": "[variables('huntingQueryVersion8')]" - }, - { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId9')]", - "version": "[variables('huntingQueryVersion9')]" - }, - { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId10')]", - "version": "[variables('huntingQueryVersion10')]" - }, - { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId1')]", - "version": "[variables('dataConnectorVersion1')]" + "kind": "Workbook", + "contentId": "[variables('_workbookContentId1')]", + "version": "[variables('workbookVersion1')]" }, { "kind": "AnalyticsRule", @@ -2984,6 +3217,56 @@ "kind": "AnalyticsRule", "contentId": "[variables('analyticRulecontentId10')]", "version": "[variables('analyticRuleVersion10')]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('_huntingQuerycontentId1')]", + "version": "[variables('huntingQueryVersion1')]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('_huntingQuerycontentId2')]", + "version": "[variables('huntingQueryVersion2')]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('_huntingQuerycontentId3')]", + "version": "[variables('huntingQueryVersion3')]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('_huntingQuerycontentId4')]", + "version": "[variables('huntingQueryVersion4')]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('_huntingQuerycontentId5')]", + "version": "[variables('huntingQueryVersion5')]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('_huntingQuerycontentId6')]", + "version": "[variables('huntingQueryVersion6')]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('_huntingQuerycontentId7')]", + "version": "[variables('huntingQueryVersion7')]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('_huntingQuerycontentId8')]", + "version": "[variables('huntingQueryVersion8')]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('_huntingQuerycontentId9')]", + "version": "[variables('huntingQueryVersion9')]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('_huntingQuerycontentId10')]", + "version": "[variables('huntingQueryVersion10')]" } ] }, diff --git a/Solutions/PaloAltoCDL/ReleaseNotes.md b/Solutions/PaloAltoCDL/ReleaseNotes.md new file mode 100644 index 00000000000..2ebb0688703 --- /dev/null +++ b/Solutions/PaloAltoCDL/ReleaseNotes.md @@ -0,0 +1,5 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------| +| 3.0.0 | 25-09-2023 | Addition of new PaloAltoCDL AMA **Data Connector** | | + + diff --git a/Solutions/SailPointIdentityNow/Data Connectors/SearchEvent.zip b/Solutions/SailPointIdentityNow/Data Connectors/SearchEvent.zip index aa60f69db12..4eea89898af 100644 Binary files a/Solutions/SailPointIdentityNow/Data Connectors/SearchEvent.zip and b/Solutions/SailPointIdentityNow/Data Connectors/SearchEvent.zip differ diff --git a/Solutions/SailPointIdentityNow/Data Connectors/requirements.txt b/Solutions/SailPointIdentityNow/Data Connectors/requirements.txt index e96dbdbb84e..f0e4152235a 100644 --- a/Solutions/SailPointIdentityNow/Data Connectors/requirements.txt +++ b/Solutions/SailPointIdentityNow/Data Connectors/requirements.txt @@ -9,4 +9,4 @@ azure-storage==0.36.0 azure-data-tables==12.1.0 azure-cosmos==4.2.0 azure-cosmosdb-table==1.0.6 -cryptography==41.0.3 \ No newline at end of file +cryptography==41.0.4 \ No newline at end of file diff --git a/Solutions/Salesforce Service Cloud/Data Connectors/SalesforceServiceCloud_API_FunctionApp.json b/Solutions/Salesforce Service Cloud/Data Connectors/SalesforceServiceCloud_API_FunctionApp.json index 26fb37a9b99..de8cbaa4c27 100644 --- a/Solutions/Salesforce Service Cloud/Data Connectors/SalesforceServiceCloud_API_FunctionApp.json +++ b/Solutions/Salesforce Service Cloud/Data Connectors/SalesforceServiceCloud_API_FunctionApp.json @@ -79,7 +79,7 @@ "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." }, { - "description":"**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce%20Service%20Cloud/Parsers/SalesforceServiceCloud.txt). The function usually takes 10-15 minutes to activate after solution installation/update." + "description":"**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://aka.ms/sentinel-SalesforceServiceCloud-parser). The function usually takes 10-15 minutes to activate after solution installation/update." }, { "title": "", @@ -114,21 +114,40 @@ ] }, { - "title": "Option 1 - Azure Resource Manager (ARM) Template", - "description": "Use this method for automated deployment of the Salesforce Service Cloud data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SalesforceServiceCloud-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." - }, - { - "title": "Option 2 - Manual Deployment of Azure Functions", - "description": "Use the following step-by-step instructions to deploy the Salesforce Service Cloud data connector manually with Azure Functions (Deployment via Visual Studio Code)." - }, - { - "title": "", - "description": "**1. Deploy a Function App**\n\n> NOTE:You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. SalesforceXXXXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration." - }, - { - "title": "", - "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tSalesforceUser\n\t\tSalesforcePass\n\t\tSalesforceSecurityToken\n\t\tSalesforceConsumerKey\n\t\tSalesforceConsumerSecret\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n3. Once all application settings have been entered, click **Save**." - - } - ] -} + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Option 1 - Azure Resource Manager (ARM) Template", + "description": "Use this method for automated deployment of the Salesforce Service Cloud data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SalesforceServiceCloud-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." + }, + { + "title": "Option 2 - Manual Deployment of Azure Functions", + "description": "Use the following step-by-step instructions to deploy the Salesforce Service Cloud data connector manually with Azure Functions (Deployment via Visual Studio Code).", + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Step 1 - Deploy a Function App", + "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Follow the [function app manual deployment instructions](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AzureFunctionsManualDeployment.md#function-app-manual-deployment-instructions) to deploy the Azure Functions app using VSCode.\n3. After successful deployment of the function app, follow next steps for configuring it." + }, + { + "title": "Step 2 - Configure the Function App", + "description": "1. Go to Azure Portal for the Function App configuration.\n2. In the Function App, select the Function App Name and select **Configuration**.\n3. In the **Application settings** tab, select **+ New application setting**.\n4. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tSalesforceUser\n\t\tSalesforcePass\n\t\tSalesforceSecurityToken\n\t\tSalesforceConsumerKey\n\t\tSalesforceConsumerSecret\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n5. Once all application settings have been entered, click **Save**." + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] +} \ No newline at end of file diff --git a/Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json b/Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json index 156f95e1ca0..5ea02a1e7c2 100644 --- a/Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json +++ b/Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json @@ -2,7 +2,7 @@ "Name": "Salesforce Service Cloud", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview).", + "Description": "The [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)", "Analytic Rules": [ "Analytic Rules/Salesforce-BruteForce.yaml", "Analytic Rules/Salesforce-PasswordSpray.yaml", @@ -12,13 +12,13 @@ "Data Connectors/SalesforceServiceCloud_API_FunctionApp.json" ], "Parsers": [ - "Parsers/SalesforceServiceCloud.txt" + "Parsers/SalesforceServiceCloud.yaml" ], "Workbooks": [ "Workbooks/SalesforceServiceCloud.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Salesforce Service Cloud", - "Version": "2.0.4", + "Version": "3.0.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json b/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json new file mode 100644 index 00000000000..0834e9ec209 --- /dev/null +++ b/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json @@ -0,0 +1,33 @@ +{ + "Name": "Salesforce Service Cloud", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "The [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview).", + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Salesforce Service Cloud", + "Version": "3.0.0", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false, + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-salesforceservicecloud", + "providers": [ + "Salesforce" + ], + "categories": { + "domains": [ + "Cloud Provider" + ], + "verticals": [] + }, + "firstPublishDate": "2022-05-16", + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com/" + }, + "Data Connectors": "[\n \"Data Connectors/SalesforceServiceCloud_API_FunctionApp.json\"\n]", + "Parsers": "[\n \"SalesforceServiceCloud.yaml\"\n]", + "Workbooks": "[\n \"Workbooks/SalesforceServiceCloud.json\"\n]", + "Analytic Rules": "[\n \"Salesforce-BruteForce.yaml\",\n \"Salesforce-PasswordSpray.yaml\",\n \"Salesforce-SigninsMultipleCountries.yaml\"\n]" +} diff --git a/Solutions/Salesforce Service Cloud/Package/3.0.0.zip b/Solutions/Salesforce Service Cloud/Package/3.0.0.zip new file mode 100644 index 00000000000..611ed9a2e28 Binary files /dev/null and b/Solutions/Salesforce Service Cloud/Package/3.0.0.zip differ diff --git a/Solutions/Salesforce Service Cloud/Package/createUiDefinition.json b/Solutions/Salesforce Service Cloud/Package/createUiDefinition.json index 66d3f3ad677..09c7fec5421 100644 --- a/Solutions/Salesforce Service Cloud/Package/createUiDefinition.json +++ b/Solutions/Salesforce Service Cloud/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview).\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Salesforce%20Service%20Cloud/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,14 +60,14 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Solution installs the data connector for Salesforce Service Cloud. You can get Salesforce Service Cloud custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides the ability to review events in your org on an accelerated basis and get event log files in hourly increments for recent activity. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." + "text": "The solution installs a parser that transforms ingested data. The transformed logs can be accessed using the SalesforceServiceCloud Kusto Function alias." } }, { diff --git a/Solutions/Salesforce Service Cloud/Package/mainTemplate.json b/Solutions/Salesforce Service Cloud/Package/mainTemplate.json index 7f281d5c0f2..b114a3242f1 100644 --- a/Solutions/Salesforce Service Cloud/Package/mainTemplate.json +++ b/Solutions/Salesforce Service Cloud/Package/mainTemplate.json @@ -42,140 +42,236 @@ "_solutionId": "[variables('solutionId')]", "email": "support@microsoft.com", "_email": "[variables('email')]", - "analyticRuleVersion1": "1.0.1", - "analyticRulecontentId1": "5a6ce089-e756-40fb-b022-c8e8864a973a", - "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", - "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1')))]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "analyticRuleVersion2": "1.0.1", - "analyticRulecontentId2": "64d16e62-1a17-4a35-9ea7-2b9fe6f07118", - "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", - "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", - "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2')))]", - "analyticRuleVersion3": "1.0.1", - "analyticRulecontentId3": "3094e036-e5ae-4d6e-8626-b0f86ebc71f2", - "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", - "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", - "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3')))]", + "_solutionName": "Salesforce Service Cloud", + "_solutionVersion": "3.0.0", "uiConfigId1": "SalesforceServiceCloud", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "SalesforceServiceCloud", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", - "parserVersion1": "1.0.0", - "parserContentId1": "SalesforceServiceCloud-Parser", - "_parserContentId1": "[variables('parserContentId1')]", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", "parserName1": "SalesforceServiceCloud", "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1')))]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", + "parserVersion1": "1.0.0", + "parserContentId1": "SalesforceServiceCloud-Parser", + "_parserContentId1": "[variables('parserContentId1')]", + "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", "workbookVersion1": "1.0.0", "workbookContentId1": "SalesforceServiceCloudWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", - "_workbookContentId1": "[variables('workbookContentId1')]" + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", + "_workbookContentId1": "[variables('workbookContentId1')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "analyticRuleVersion1": "1.0.1", + "analyticRulecontentId1": "5a6ce089-e756-40fb-b022-c8e8864a973a", + "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId1'),'-', variables('analyticRuleVersion1'))))]", + "analyticRuleVersion2": "1.0.1", + "analyticRulecontentId2": "64d16e62-1a17-4a35-9ea7-2b9fe6f07118", + "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2'))))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId2'),'-', variables('analyticRuleVersion2'))))]", + "analyticRuleVersion3": "1.0.1", + "analyticRulecontentId3": "3094e036-e5ae-4d6e-8626-b0f86ebc71f2", + "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3'))))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId3'),'-', variables('analyticRuleVersion3'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('analyticRuleTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Salesforce Service Cloud Analytics Rule 1 with template", - "displayName": "Salesforce Service Cloud Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName1'),'/',variables('analyticRuleVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Salesforce-BruteForce_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "Salesforce Service Cloud data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion1')]", + "contentVersion": "[variables('dataConnectorVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId1')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", + "kind": "GenericUI", "properties": { - "description": "Identifies evidence of brute force activity against a user based on multiple authentication failures \nand at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses\nThe default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.", - "displayName": "Brute force attack against user credentials", - "enabled": false, - "query": "let failureCountThreshold = 10;\nlet successCountThreshold = 1;\nlet Failures =\nSalesforceServiceCloud\n| where EventType == \"Login\" and LoginStatus != \"LOGIN_NO_ERROR\"\n| summarize\n FailureStartTime = min(TimeGenerated),\n FailureEndTime = max(TimeGenerated),\n IpAddresses = make_set (ClientIp, 100),\n FailureCount = count() by User, UserId, UserType;\n SalesforceServiceCloud\n | where EventType == \"Login\" and LoginStatus == \"LOGIN_NO_ERROR\"\n | summarize\n SuccessStartTime = min(TimeGenerated),\n SuccessEndTime = max(TimeGenerated),\n IpAddresses = make_set (ClientIp, 100),\n SuccessCount = count() by User, UserId, UserType\n | join kind=leftouter Failures on UserId\n | where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold\n | where FailureEndTime < SuccessStartTime\n | project User, EventStartTime = FailureStartTime, EventEndTime = SuccessEndTime, IpAddresses\n", - "queryFrequency": "PT20M", - "queryPeriod": "PT20M", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "SalesforceServiceCloud" - ], - "connectorId": "SalesforceServiceCloud" - } - ], - "tactics": [ - "CredentialAccess" - ], - "techniques": [ - "T1110" - ], - "entityMappings": [ - { - "fieldMappings": [ + "connectorUiConfig": { + "id": "[variables('_uiConfigId1')]", + "title": "Salesforce Service Cloud (using Azure Functions)", + "publisher": "Salesforce", + "descriptionMarkdown": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get [event log files](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/event_log_file_hourly_overview.htm) in hourly increments for recent activity.", + "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "SalesforceServiceCloud_CL", + "baseQuery": "SalesforceServiceCloud_CL" + } + ], + "sampleQueries": [ + { + "description": "Last Salesforce Service Cloud EventLogFile Events", + "query": "SalesforceServiceCloud\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "SalesforceServiceCloud_CL", + "lastDataReceivedQuery": "SalesforceServiceCloud_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "SalesforceServiceCloud_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, { - "columnName": "User", - "identifier": "FullName" + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } } ], - "entityType": "Account" - } - ], - "customDetails": { - "EventStartTime": "FailureStartTime", - "EventEndTime": "SuccessEndTime", - "IPAddresses": "IpAddresses" + "customs": [ + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "**Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** is required for REST API. [See the documentation to learn more about API](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm)." + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to the Salesforce Lightning Platform REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://aka.ms/sentinel-SalesforceServiceCloud-parser). The function usually takes 10-15 minutes to activate after solution installation/update." + }, + { + "description": "**STEP 1 - Configuration steps for the Salesforce Lightning Platform REST API**\n\n1. See the [link](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm) and follow the instructions for obtaining Salesforce API Authorization credentials. \n2. On the **Set Up Authorization** step choose **Session ID Authorization** method.\n3. You must provide your client id, client secret, username, and password with user security token." + }, + { + "description": ">**NOTE:** Ingesting data from on an hourly interval may require additional licensing based on the edition of the Salesforce Service Cloud being used. Please refer to [Salesforce documentation](https://www.salesforce.com/editions-pricing/service-cloud/) and/or support for more details." + }, + { + "description": "**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Salesforce Service Cloud data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Salesforce API Authorization credentials, readily available.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Workspace ID" + }, + "type": "CopyableLabel" + }, + { + "parameters": { + "fillWith": [ + "PrimaryKey" + ], + "label": "Primary Key" + }, + "type": "CopyableLabel" + } + ] + }, + { + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Option 1 - Azure Resource Manager (ARM) Template", + "description": "Use this method for automated deployment of the Salesforce Service Cloud data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SalesforceServiceCloud-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." + }, + { + "title": "Option 2 - Manual Deployment of Azure Functions", + "description": "Use the following step-by-step instructions to deploy the Salesforce Service Cloud data connector manually with Azure Functions (Deployment via Visual Studio Code).", + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Step 1 - Deploy a Function App", + "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Follow the [function app manual deployment instructions](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AzureFunctionsManualDeployment.md#function-app-manual-deployment-instructions) to deploy the Azure Functions app using VSCode.\n3. After successful deployment of the function app, follow next steps for configuring it." + }, + { + "title": "Step 2 - Configure the Function App", + "description": "1. Go to Azure Portal for the Function App configuration.\n2. In the Function App, select the Function App Name and select **Configuration**.\n3. In the **Application settings** tab, select **+ New application setting**.\n4. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tSalesforceUser\n\t\tSalesforcePass\n\t\tSalesforceSecurityToken\n\t\tSalesforceConsumerKey\n\t\tSalesforceConsumerSecret\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n5. Once all application settings have been entered, click **Save**." + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { - "description": "Salesforce Service Cloud Analytics Rule 1", - "parentId": "[variables('analyticRuleId1')]", - "contentId": "[variables('_analyticRulecontentId1')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion1')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", "name": "Salesforce Service Cloud", @@ -194,199 +290,240 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "Salesforce Service Cloud (using Azure Functions)", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('analyticRuleTemplateSpecName2')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId1')]" + ], "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "properties": { - "description": "Salesforce Service Cloud Analytics Rule 2 with template", - "displayName": "Salesforce Service Cloud Analytics Rule template" + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", + "source": { + "kind": "Solution", + "name": "Salesforce Service Cloud", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com/" + } } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName2'),'/',variables('analyticRuleVersion2'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName2'))]" - ], + "kind": "GenericUI", "properties": { - "description": "Salesforce-PasswordSpray_AnalyticalRules Analytics Rule with template version 2.0.4", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion2')]", - "parameters": {}, - "variables": {}, - "resources": [ + "connectorUiConfig": { + "title": "Salesforce Service Cloud (using Azure Functions)", + "publisher": "Salesforce", + "descriptionMarkdown": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get [event log files](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/event_log_file_hourly_overview.htm) in hourly increments for recent activity.", + "graphQueries": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId2')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack.", - "displayName": "Potential Password Spray Attack", - "enabled": false, - "query": "let FailureThreshold = 15; \nSalesforceServiceCloud\n| where EventType =~ 'Login' and LoginStatus != 'LOGIN_NO_ERROR'\n| where LoginStatus in~ ('LOGIN_ERROR_INVALID_PASSWORD', 'LOGIN_ERROR_SSO_PWD_INVALID')\n| summarize UserCount=dcount(UserId), Users = make_set(UserId,100) by ClientIp, bin(TimeGenerated, 5m)\n| where UserCount > FailureThreshold\n", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "SalesforceServiceCloud" - ], - "connectorId": "SalesforceServiceCloud" - } - ], - "tactics": [ - "CredentialAccess" - ], - "techniques": [ - "T1110" - ], - "entityMappings": [ - { - "fieldMappings": [ - { - "columnName": "ClientIp", - "identifier": "Address" - } - ], - "entityType": "IP" - } - ], - "customDetails": { - "Users": "Users" + "metricName": "Total data received", + "legend": "SalesforceServiceCloud_CL", + "baseQuery": "SalesforceServiceCloud_CL" + } + ], + "dataTypes": [ + { + "name": "SalesforceServiceCloud_CL", + "lastDataReceivedQuery": "SalesforceServiceCloud_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "SalesforceServiceCloud_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Last Salesforce Service Cloud EventLogFile Events", + "query": "SalesforceServiceCloud\n | sort by TimeGenerated desc" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true } } + ], + "customs": [ + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "**Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** is required for REST API. [See the documentation to learn more about API](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm)." + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to the Salesforce Lightning Platform REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", - "properties": { - "description": "Salesforce Service Cloud Analytics Rule 2", - "parentId": "[variables('analyticRuleId2')]", - "contentId": "[variables('_analyticRulecontentId2')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion2')]", - "source": { - "kind": "Solution", - "name": "Salesforce Service Cloud", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://aka.ms/sentinel-SalesforceServiceCloud-parser). The function usually takes 10-15 minutes to activate after solution installation/update." + }, + { + "description": "**STEP 1 - Configuration steps for the Salesforce Lightning Platform REST API**\n\n1. See the [link](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm) and follow the instructions for obtaining Salesforce API Authorization credentials. \n2. On the **Set Up Authorization** step choose **Session ID Authorization** method.\n3. You must provide your client id, client secret, username, and password with user security token." + }, + { + "description": ">**NOTE:** Ingesting data from on an hourly interval may require additional licensing based on the edition of the Salesforce Service Cloud being used. Please refer to [Salesforce documentation](https://www.salesforce.com/editions-pricing/service-cloud/) and/or support for more details." + }, + { + "description": "**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Salesforce Service Cloud data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Salesforce API Authorization credentials, readily available.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Workspace ID" + }, + "type": "CopyableLabel" }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com/" + { + "parameters": { + "fillWith": [ + "PrimaryKey" + ], + "label": "Primary Key" + }, + "type": "CopyableLabel" } - } + ] + }, + { + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Option 1 - Azure Resource Manager (ARM) Template", + "description": "Use this method for automated deployment of the Salesforce Service Cloud data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SalesforceServiceCloud-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." + }, + { + "title": "Option 2 - Manual Deployment of Azure Functions", + "description": "Use the following step-by-step instructions to deploy the Salesforce Service Cloud data connector manually with Azure Functions (Deployment via Visual Studio Code).", + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Step 1 - Deploy a Function App", + "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Follow the [function app manual deployment instructions](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AzureFunctionsManualDeployment.md#function-app-manual-deployment-instructions) to deploy the Azure Functions app using VSCode.\n3. After successful deployment of the function app, follow next steps for configuring it." + }, + { + "title": "Step 2 - Configure the Function App", + "description": "1. Go to Azure Portal for the Function App configuration.\n2. In the Function App, select the Function App Name and select **Configuration**.\n3. In the **Application settings** tab, select **+ New application setting**.\n4. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tSalesforceUser\n\t\tSalesforcePass\n\t\tSalesforceSecurityToken\n\t\tSalesforceConsumerKey\n\t\tSalesforceConsumerSecret\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n5. Once all application settings have been entered, click **Save**." + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] } - ] + ], + "id": "[variables('_uiConfigId1')]", + "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution." } } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('analyticRuleTemplateSpecName3')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Salesforce Service Cloud Analytics Rule 3 with template", - "displayName": "Salesforce Service Cloud Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName3'),'/',variables('analyticRuleVersion3'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName3'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Salesforce-SigninsMultipleCountries_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "SalesforceServiceCloud Data Parser with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion3')]", + "contentVersion": "[variables('parserVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId3')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "name": "[variables('_parserName1')]", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { - "description": "This query searches for successful user logins from different countries within 30min.", - "displayName": "User Sign in from different countries", - "enabled": false, - "query": "let threshold = 2;\nlet Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\n[@\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\"];\nlet UsersLocation = SalesforceServiceCloud\n| where EventType =~ 'Login' and LoginStatus=~'LOGIN_NO_ERROR'\n| project TimeGenerated, ClientIp, UserId, User, UserType ;\nUsersLocation\n| extend Dummy=1\n| summarize count() by Hour=bin(TimeGenerated,30m), ClientIp,User, Dummy\n| partition by Hour(\n lookup (Countrydb|extend Dummy=1) on Dummy\n | where ipv4_is_match(ClientIp, Network)\n )\n| summarize NumOfCountries = dcount(country_name) by User, Hour\n| where NumOfCountries >= threshold\n", - "queryFrequency": "PT30M", - "queryPeriod": "PT30M", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "SalesforceServiceCloud" - ], - "connectorId": "SalesforceServiceCloud" - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1078" - ], - "entityMappings": [ + "eTag": "*", + "displayName": "SalesforceServiceCloud", + "category": "Microsoft Sentinel Parser", + "functionAlias": "SalesforceServiceCloud", + "query": "SalesforceServiceCloud_CL \n| extend \n\t\tRequestSize=column_ifexists('request_size_s',''),\n\t\tExecTime=column_ifexists('exec_time_s',''),\n\t\tAction=column_ifexists('action_s',''),\n\t\tPlatformType=column_ifexists('platform_type_s',''),\n\t\tOsName=column_ifexists('os_name_s',''),\n\t\tOsVersion=column_ifexists('os_version_s',''),\n\t\tTimestamp=column_ifexists('timestamp_s',''),\n\t\tStatusCode=column_ifexists('status_code_s',''),\n\t\tEventType=column_ifexists('event_type_s',''),\n\t\tReferrerUri=column_ifexists('referrer_uri_s',''),\n\t\tUserAgent=column_ifexists('user_agent_s',''),\n\t\tBrowserType=column_ifexists('browser_type_s',''),\n\t\tTime=column_ifexists('time_s',''),\n\t\tResponseSize=column_ifexists('response_size_s',''),\n\t\tDeviceId=column_ifexists('device_id_s',''),\n\t\tDeviceModel=column_ifexists('device_model_s',''),\n\t\tSourceIp=column_ifexists('source_ip_s',''),\n\t\tClientIp=column_ifexists('client_ip_s',''),\n\t\tSuccess=column_ifexists('success_s',''),\n\t\tUri=column_ifexists('uri_s',''),\n\t\tUrl=column_ifexists('url_s',''),\n\t\tClientName=column_ifexists('client_name_s',''),\n\t\tUserType=column_ifexists('user_type_s',''),\n\t\tUserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\n\t\tUserIdDerived=column_ifexists('user_id_derived_s',''),\n\t\tUserId=column_ifexists('user_id_s',''),\n\t\tUserEmail=column_ifexists('user_email_s',''),\n\t\tUser=column_ifexists('user_name_s',''),\n\t\tUriIdDerived=column_ifexists('uri_id_derived_s',''),\n\t\tUiEventType=column_ifexists('ui_event_type_s',''),\n\t\tUiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\n\t\tUiEventSource=column_ifexists('ui_event_source_s',''),\n\t\tUiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\n\t\tUiEventId=column_ifexists('ui_event_id_s',''),\n\t\tTlsProtocol=column_ifexists('tls_protocol_s',''),\n\t\tTimestampDerived=column_ifexists('timestamp_derived_t',''),\n\t\tTargetUiElement=column_ifexists('target_ui_element_s',''),\n\t\tSort=column_ifexists('sort_s',''),\n\t\tSessionType=column_ifexists('session_type_s',''),\n\t\tSessionLevel=column_ifexists('session_level_s',''),\n\t\tSessionKey=column_ifexists('session_key_s',''),\n\t\tSearchQuery=column_ifexists('search_query_s',''),\n\t\tSdkVersion=column_ifexists('sdk_version_s',''),\n\t\tSdkAppVersion=column_ifexists('sdk_app_version_s',''),\n\t\tSdkAppType=column_ifexists('sdk_app_type_s',''),\n\t\tRunTime=column_ifexists('run_time_s',''),\n\t\tRowsProcessed=column_ifexists('rows_processed_s',''),\n\t\tRowCount=column_ifexists('row_count_s',''),\n\t\tResolutionType=column_ifexists('resolution_type_s',''),\n\t\tRequestStatus=column_ifexists('request_status_s',''),\n\t\tRequestId=column_ifexists('request_id_s',''),\n\t\tReportIdDerived=column_ifexists('report_id_derived_s',''),\n\t\tReportId=column_ifexists('report_id_s',''),\n\t\tRenderingType=column_ifexists('rendering_type_s',''),\n\t\tRelatedList=column_ifexists('related_list_s',''),\n\t\tRecordType=column_ifexists('record_type_s',''),\n\t\tRecordId=column_ifexists('record_id_s',''),\n\t\tQuiddity=column_ifexists('quiddity_s',''),\n\t\tQueryId=column_ifexists('query_id_s',''),\n\t\tPrevpageUrl=column_ifexists('prevpage_url_s',''),\n\t\tPrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\n\t\tPrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\n\t\tPrevpageContext=column_ifexists('prevpage_context_s',''),\n\t\tPrevpageAppName=column_ifexists('prevpage_app_name_s',''),\n\t\tPrefixesSearched=column_ifexists('prefixes_searched_s',''),\n\t\tParentUiElement=column_ifexists('parent_ui_element_s',''),\n\t\tPageUrl=column_ifexists('page_url_s',''),\n\t\tPageStartTime=column_ifexists('page_start_time_s',''),\n\t\tPageEntityType=column_ifexists('page_entity_type_s',''),\n\t\tPageEntityId=column_ifexists('page_entity_id_s',''),\n\t\tPageContext=column_ifexists('page_context_s',''),\n\t\tPageAppName=column_ifexists('page_app_name_s',''),\n\t\tOrigin=column_ifexists('origin_s',''),\n\t\tOrganizationId=column_ifexists('organization_id_s',''),\n\t\tNumResults=column_ifexists('num_results_s',''),\n\t\tNumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\n\t\tNumberFields=column_ifexists('number_fields_s',''),\n\t\tNumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\n\t\tNumberColumns=column_ifexists('number_columns_s',''),\n\t\tNumberBuckets=column_ifexists('number_buckets_s',''),\n\t\tMethodName=column_ifexists('method_name_s',''),\n\t\tMethod=column_ifexists('method_s',''),\n\t\tMediaType=column_ifexists('media_type_s',''),\n\t\tLoginStatus=column_ifexists('login_status_s',''),\n\t\tLoginKey=column_ifexists('login_key_s',''),\n\t\tHttpMethod=column_ifexists('http_method_s',''),\n\t\tGrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\n\t\tEntryPoint=column_ifexists('entry_point_s',''),\n\t\tEntityName=column_ifexists('entity_name_s',''),\n\t\tEntity=column_ifexists('entity_s',''),\n\t\tEffectivePageTime=column_ifexists('effective_page_time_s',''),\n\t\tDuration=column_ifexists('duration_s',''),\n\t\tDisplayType=column_ifexists('display_type_s',''),\n\t\tDeviceSessionId=column_ifexists('device_session_id_s',''),\n\t\tDevicePlatform=column_ifexists('device_platform_s',''),\n\t\tDbTotalTime=column_ifexists('db_total_time_s',''),\n\t\tDbCpuTime=column_ifexists('db_cpu_time_s',''),\n\t\tDbBlocks=column_ifexists('db_blocks_s',''),\n\t\tCpuTime=column_ifexists('cpu_time_s',''),\n\t\tConnectionType=column_ifexists('connection_type_s',''),\n\t\tComponentName=column_ifexists('component_name_s',''),\n\t\tClientVersion=column_ifexists('client_version_s',''),\n\t\tClientId=column_ifexists('client_id_s',''),\n\t\tCipherSuite=column_ifexists('cipher_suite_s',''),\n\t\tCalloutTime=column_ifexists('callout_time_s',''),\n\t\tBrowserVersion=column_ifexists('browser_version_s',''),\n\t\tBrowserName=column_ifexists('browser_name_s',''),\n\t\tAverageRowSize=column_ifexists('average_row_size_s',''),\n\t\tAppType=column_ifexists('app_type_s',''),\n\t\tAppName=column_ifexists('app_name_s',''),\n\t\tApiVersion=column_ifexists('api_version_s',''),\n\t\tApiType=column_ifexists('api_type_s',''),\n ArticleVersionId=column_ifexists('article_version_id_s',''),\n\t\tArticleVersion=column_ifexists('article_version_s',''),\n\t\tArticleStatus=column_ifexists('article_status_s',''),\n\t\tArticleId=column_ifexists('article_id_s',''),\n AnalyticsMode=column_ifexists('analytics_mode_s',''),\n BatchId=column_ifexists('batch_id_s',''),\n ClickedRecordId=column_ifexists('clicked_record_id_s',''),\n\t\tClassName=column_ifexists('class_name_s',''),\n ComponentIdDerived=column_ifexists('component_id_derived_s',''),\n\t\tComponentId=column_ifexists('component_id_s',''),\n ControllerType=column_ifexists('controller_type_s',''),\n\t\tContext=column_ifexists('context_s',''),\n\t\tConsoleIdDerived=column_ifexists('console_id_derived_s',''),\n\t\tConsoleId=column_ifexists('console_id_s',''), \n ClientInfo=column_ifexists('client_info_s',''),\n DstBytes=column_ifexists('request_size_s',''),\n\t\tDstUser=column_ifexists('delegated_user_name_s',''),\n DstUserSid=column_ifexists('delegated_user_id_s',''),\n\t\tDstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\n Data=column_ifexists('data_s',''),\n\t\tDashboardType=column_ifexists('dashboard_type_s',''),\n\t\tDashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\n\t\tDashboardId=column_ifexists('dashboard_id_s',''),\n\t\tDashboardComponentId=column_ifexists('dashboard_component_id_s',''),\n\t\tDvcAction=column_ifexists('action_s',''),\n\t\tDvcOS=column_ifexists('platform_type_s',''),\n\t\tDvcOSName=column_ifexists('os_name_s',''),\n\t\tDvcOSVersion=column_ifexists('os_version_s',''),\n DeliveryLocation=column_ifexists('delivery_location_s',''),\n\t\tDeliveryId=column_ifexists('delivery_id_s',''),\n DocumentIdDerived=column_ifexists('document_id_derived_s',''),\n\t\tDocumentId=column_ifexists('document_id_s',''),\n EntityType=column_ifexists('entity_type_s',''),\n EntityId=column_ifexists('entity_id_s',''),\n FileType=column_ifexists('file_type_s',''),\n\t\tFilePreviewType=column_ifexists('file_preview_type_s',''),\n\t\tExceptionType=column_ifexists('exception_type_s',''),\n\t\tExceptionMessage=column_ifexists('exception_message_s',''),\n\t\tEpt=column_ifexists('ept_s',''),\n EventCount=column_ifexists('number_of_records_s',''),\n\t\tEventEndTime=column_ifexists('timestamp_s',''),\n\t\tEventResult=column_ifexists('status_code_s',''),\n\t\tFileSize=column_ifexists('size_bytes_s',''),\n HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\n\t\tHttpUserAgentOriginal=column_ifexists('user_agent_s',''),\n\t\tHttpUserAgent=column_ifexists('browser_type_s',''),\n LogGroupId=column_ifexists('log_group_id_s',''),\n\t\tLimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\n\t\tLicenseContext=column_ifexists('license_context_s',''),\n\t\tLastVersion=column_ifexists('last_version_s',''),\n\t\tLanguage=column_ifexists('language_s',''),\n\t\tJobId=column_ifexists('job_id_s',''),\n\t\tIsSuccess=column_ifexists('is_success_s',''),\n\t\tIsSecure=column_ifexists('is_secure_s',''),\n\t\tIsScheduled=column_ifexists('is_scheduled_s',''),\n\t\tIsNew=column_ifexists('is_new_s',''),\n\t\tIsMobile=column_ifexists('is_mobile_s',''),\n\t\tIsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\n\t\tIsGuest=column_ifexists('is_guest_s',''),\n\t\tIsFirstRequest=column_ifexists('is_first_request_s',''),\n\t\tIsError=column_ifexists('is_error_s',''),\n\t\tIsApi=column_ifexists('is_api_s',''),\n\t\tIsAjaxRequest=column_ifexists('is_ajax_request_s',''),\n ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\n HttpHeaders=column_ifexists('http_headers_s',''),\n\t\tNetworkDuration=column_ifexists('time_s',''),\n Name=column_ifexists('name_s',''),\n NumberFailures=column_ifexists('number_failures_s',''),\n NumClicks=column_ifexists('num_clicks_s',''),\n OperationType=column_ifexists('operation_type_s',''),\n\t\tNumSessions=column_ifexists('num_sessions_s',''),\n PageName=column_ifexists('page_name_s',''),\n Query=column_ifexists('query_s',''),\n RequestType=column_ifexists('request_type_s',''),\n ReportDescription=column_ifexists('report_description_s',''),\n\t\tReopenCount=column_ifexists('reopen_count_s',''),\n RelatedEntityId=column_ifexists('related_entity_id_s',''),\n RecordIdDerived=column_ifexists('record_id_derived_s',''),\n ReadTime=column_ifexists('read_time_s',''),\n\t\tRank=column_ifexists('rank_s',''),\n\t\tSrcBytes=column_ifexists('response_size_s',''),\n\t\tSrcDvcId=column_ifexists('device_id_s',''),\n\t\tSrcDvcModelName=column_ifexists('device_model_s',''),\n\t\tSrcIpAddr=column_ifexists('source_ip_s',''),\n\t\tSrcNatIpAddr=column_ifexists('client_ip_s',''),\n SessionId=column_ifexists('session_id_s',''),\n SiteId=column_ifexists('site_id_s',''),\n\t\tSharingPermission=column_ifexists('sharing_permission_s',''),\n\t\tSharingOperation=column_ifexists('sharing_operation_s',''),\n\t\tSharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\n\t\tUrlOriginal=column_ifexists('url_s',''),\n\t\tWaveTimestamp=column_ifexists('wave_timestamp_s',''),\n\t\tWaveSessionId=column_ifexists('wave_session_id_g',''),\n\t\tViewStateSize=column_ifexists('view_state_size_s',''),\n\t\tVersionIdDerived=column_ifexists('version_id_derived_s',''),\n\t\tVersionId=column_ifexists('version_id_s',''),\n TriggerType=column_ifexists('trigger_type_s',''),\n\t\tTriggerName=column_ifexists('trigger_name_s',''),\n\t\tTriggerId=column_ifexists('trigger_id_s',''),\n\t\tTransactionType=column_ifexists('transaction_type_s',''),\n\t\tTotalTime=column_ifexists('total_time_s',''),\n TabId=column_ifexists('tab_id_s',''),\n\t\tStackTrace=column_ifexists('stack_trace_s','')\n| project-away *_s\n", + "functionParameters": "", + "version": 2, + "tags": [ { - "fieldMappings": [ - { - "columnName": "User", - "identifier": "AadUserId" - } - ], - "entityType": "Account" + "name": "description", + "value": "" } ] } @@ -394,16 +531,18 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "dependsOn": [ + "[variables('_parserName1')]" + ], "properties": { - "description": "Salesforce Service Cloud Analytics Rule 3", - "parentId": "[variables('analyticRuleId3')]", - "contentId": "[variables('_analyticRulecontentId3')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion3')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", + "contentId": "[variables('_parserContentId1')]", + "kind": "Parser", + "version": "[variables('parserVersion1')]", "source": { - "kind": "Solution", "name": "Salesforce Service Cloud", + "kind": "Solution", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -419,187 +558,114 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_parserContentId1')]", + "contentKind": "Parser", + "displayName": "SalesforceServiceCloud", + "contentProductId": "[variables('_parsercontentProductId1')]", + "id": "[variables('_parsercontentProductId1')]", + "version": "[variables('parserVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('dataConnectorTemplateSpecName1')]", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2022-10-01", + "name": "[variables('_parserName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "properties": { - "description": "Salesforce Service Cloud data connector with template", - "displayName": "Salesforce Service Cloud template" + "eTag": "*", + "displayName": "SalesforceServiceCloud", + "category": "Microsoft Sentinel Parser", + "functionAlias": "SalesforceServiceCloud", + "query": "SalesforceServiceCloud_CL \n| extend \n\t\tRequestSize=column_ifexists('request_size_s',''),\n\t\tExecTime=column_ifexists('exec_time_s',''),\n\t\tAction=column_ifexists('action_s',''),\n\t\tPlatformType=column_ifexists('platform_type_s',''),\n\t\tOsName=column_ifexists('os_name_s',''),\n\t\tOsVersion=column_ifexists('os_version_s',''),\n\t\tTimestamp=column_ifexists('timestamp_s',''),\n\t\tStatusCode=column_ifexists('status_code_s',''),\n\t\tEventType=column_ifexists('event_type_s',''),\n\t\tReferrerUri=column_ifexists('referrer_uri_s',''),\n\t\tUserAgent=column_ifexists('user_agent_s',''),\n\t\tBrowserType=column_ifexists('browser_type_s',''),\n\t\tTime=column_ifexists('time_s',''),\n\t\tResponseSize=column_ifexists('response_size_s',''),\n\t\tDeviceId=column_ifexists('device_id_s',''),\n\t\tDeviceModel=column_ifexists('device_model_s',''),\n\t\tSourceIp=column_ifexists('source_ip_s',''),\n\t\tClientIp=column_ifexists('client_ip_s',''),\n\t\tSuccess=column_ifexists('success_s',''),\n\t\tUri=column_ifexists('uri_s',''),\n\t\tUrl=column_ifexists('url_s',''),\n\t\tClientName=column_ifexists('client_name_s',''),\n\t\tUserType=column_ifexists('user_type_s',''),\n\t\tUserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\n\t\tUserIdDerived=column_ifexists('user_id_derived_s',''),\n\t\tUserId=column_ifexists('user_id_s',''),\n\t\tUserEmail=column_ifexists('user_email_s',''),\n\t\tUser=column_ifexists('user_name_s',''),\n\t\tUriIdDerived=column_ifexists('uri_id_derived_s',''),\n\t\tUiEventType=column_ifexists('ui_event_type_s',''),\n\t\tUiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\n\t\tUiEventSource=column_ifexists('ui_event_source_s',''),\n\t\tUiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\n\t\tUiEventId=column_ifexists('ui_event_id_s',''),\n\t\tTlsProtocol=column_ifexists('tls_protocol_s',''),\n\t\tTimestampDerived=column_ifexists('timestamp_derived_t',''),\n\t\tTargetUiElement=column_ifexists('target_ui_element_s',''),\n\t\tSort=column_ifexists('sort_s',''),\n\t\tSessionType=column_ifexists('session_type_s',''),\n\t\tSessionLevel=column_ifexists('session_level_s',''),\n\t\tSessionKey=column_ifexists('session_key_s',''),\n\t\tSearchQuery=column_ifexists('search_query_s',''),\n\t\tSdkVersion=column_ifexists('sdk_version_s',''),\n\t\tSdkAppVersion=column_ifexists('sdk_app_version_s',''),\n\t\tSdkAppType=column_ifexists('sdk_app_type_s',''),\n\t\tRunTime=column_ifexists('run_time_s',''),\n\t\tRowsProcessed=column_ifexists('rows_processed_s',''),\n\t\tRowCount=column_ifexists('row_count_s',''),\n\t\tResolutionType=column_ifexists('resolution_type_s',''),\n\t\tRequestStatus=column_ifexists('request_status_s',''),\n\t\tRequestId=column_ifexists('request_id_s',''),\n\t\tReportIdDerived=column_ifexists('report_id_derived_s',''),\n\t\tReportId=column_ifexists('report_id_s',''),\n\t\tRenderingType=column_ifexists('rendering_type_s',''),\n\t\tRelatedList=column_ifexists('related_list_s',''),\n\t\tRecordType=column_ifexists('record_type_s',''),\n\t\tRecordId=column_ifexists('record_id_s',''),\n\t\tQuiddity=column_ifexists('quiddity_s',''),\n\t\tQueryId=column_ifexists('query_id_s',''),\n\t\tPrevpageUrl=column_ifexists('prevpage_url_s',''),\n\t\tPrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\n\t\tPrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\n\t\tPrevpageContext=column_ifexists('prevpage_context_s',''),\n\t\tPrevpageAppName=column_ifexists('prevpage_app_name_s',''),\n\t\tPrefixesSearched=column_ifexists('prefixes_searched_s',''),\n\t\tParentUiElement=column_ifexists('parent_ui_element_s',''),\n\t\tPageUrl=column_ifexists('page_url_s',''),\n\t\tPageStartTime=column_ifexists('page_start_time_s',''),\n\t\tPageEntityType=column_ifexists('page_entity_type_s',''),\n\t\tPageEntityId=column_ifexists('page_entity_id_s',''),\n\t\tPageContext=column_ifexists('page_context_s',''),\n\t\tPageAppName=column_ifexists('page_app_name_s',''),\n\t\tOrigin=column_ifexists('origin_s',''),\n\t\tOrganizationId=column_ifexists('organization_id_s',''),\n\t\tNumResults=column_ifexists('num_results_s',''),\n\t\tNumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\n\t\tNumberFields=column_ifexists('number_fields_s',''),\n\t\tNumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\n\t\tNumberColumns=column_ifexists('number_columns_s',''),\n\t\tNumberBuckets=column_ifexists('number_buckets_s',''),\n\t\tMethodName=column_ifexists('method_name_s',''),\n\t\tMethod=column_ifexists('method_s',''),\n\t\tMediaType=column_ifexists('media_type_s',''),\n\t\tLoginStatus=column_ifexists('login_status_s',''),\n\t\tLoginKey=column_ifexists('login_key_s',''),\n\t\tHttpMethod=column_ifexists('http_method_s',''),\n\t\tGrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\n\t\tEntryPoint=column_ifexists('entry_point_s',''),\n\t\tEntityName=column_ifexists('entity_name_s',''),\n\t\tEntity=column_ifexists('entity_s',''),\n\t\tEffectivePageTime=column_ifexists('effective_page_time_s',''),\n\t\tDuration=column_ifexists('duration_s',''),\n\t\tDisplayType=column_ifexists('display_type_s',''),\n\t\tDeviceSessionId=column_ifexists('device_session_id_s',''),\n\t\tDevicePlatform=column_ifexists('device_platform_s',''),\n\t\tDbTotalTime=column_ifexists('db_total_time_s',''),\n\t\tDbCpuTime=column_ifexists('db_cpu_time_s',''),\n\t\tDbBlocks=column_ifexists('db_blocks_s',''),\n\t\tCpuTime=column_ifexists('cpu_time_s',''),\n\t\tConnectionType=column_ifexists('connection_type_s',''),\n\t\tComponentName=column_ifexists('component_name_s',''),\n\t\tClientVersion=column_ifexists('client_version_s',''),\n\t\tClientId=column_ifexists('client_id_s',''),\n\t\tCipherSuite=column_ifexists('cipher_suite_s',''),\n\t\tCalloutTime=column_ifexists('callout_time_s',''),\n\t\tBrowserVersion=column_ifexists('browser_version_s',''),\n\t\tBrowserName=column_ifexists('browser_name_s',''),\n\t\tAverageRowSize=column_ifexists('average_row_size_s',''),\n\t\tAppType=column_ifexists('app_type_s',''),\n\t\tAppName=column_ifexists('app_name_s',''),\n\t\tApiVersion=column_ifexists('api_version_s',''),\n\t\tApiType=column_ifexists('api_type_s',''),\n ArticleVersionId=column_ifexists('article_version_id_s',''),\n\t\tArticleVersion=column_ifexists('article_version_s',''),\n\t\tArticleStatus=column_ifexists('article_status_s',''),\n\t\tArticleId=column_ifexists('article_id_s',''),\n AnalyticsMode=column_ifexists('analytics_mode_s',''),\n BatchId=column_ifexists('batch_id_s',''),\n ClickedRecordId=column_ifexists('clicked_record_id_s',''),\n\t\tClassName=column_ifexists('class_name_s',''),\n ComponentIdDerived=column_ifexists('component_id_derived_s',''),\n\t\tComponentId=column_ifexists('component_id_s',''),\n ControllerType=column_ifexists('controller_type_s',''),\n\t\tContext=column_ifexists('context_s',''),\n\t\tConsoleIdDerived=column_ifexists('console_id_derived_s',''),\n\t\tConsoleId=column_ifexists('console_id_s',''), \n ClientInfo=column_ifexists('client_info_s',''),\n DstBytes=column_ifexists('request_size_s',''),\n\t\tDstUser=column_ifexists('delegated_user_name_s',''),\n DstUserSid=column_ifexists('delegated_user_id_s',''),\n\t\tDstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\n Data=column_ifexists('data_s',''),\n\t\tDashboardType=column_ifexists('dashboard_type_s',''),\n\t\tDashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\n\t\tDashboardId=column_ifexists('dashboard_id_s',''),\n\t\tDashboardComponentId=column_ifexists('dashboard_component_id_s',''),\n\t\tDvcAction=column_ifexists('action_s',''),\n\t\tDvcOS=column_ifexists('platform_type_s',''),\n\t\tDvcOSName=column_ifexists('os_name_s',''),\n\t\tDvcOSVersion=column_ifexists('os_version_s',''),\n DeliveryLocation=column_ifexists('delivery_location_s',''),\n\t\tDeliveryId=column_ifexists('delivery_id_s',''),\n DocumentIdDerived=column_ifexists('document_id_derived_s',''),\n\t\tDocumentId=column_ifexists('document_id_s',''),\n EntityType=column_ifexists('entity_type_s',''),\n EntityId=column_ifexists('entity_id_s',''),\n FileType=column_ifexists('file_type_s',''),\n\t\tFilePreviewType=column_ifexists('file_preview_type_s',''),\n\t\tExceptionType=column_ifexists('exception_type_s',''),\n\t\tExceptionMessage=column_ifexists('exception_message_s',''),\n\t\tEpt=column_ifexists('ept_s',''),\n EventCount=column_ifexists('number_of_records_s',''),\n\t\tEventEndTime=column_ifexists('timestamp_s',''),\n\t\tEventResult=column_ifexists('status_code_s',''),\n\t\tFileSize=column_ifexists('size_bytes_s',''),\n HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\n\t\tHttpUserAgentOriginal=column_ifexists('user_agent_s',''),\n\t\tHttpUserAgent=column_ifexists('browser_type_s',''),\n LogGroupId=column_ifexists('log_group_id_s',''),\n\t\tLimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\n\t\tLicenseContext=column_ifexists('license_context_s',''),\n\t\tLastVersion=column_ifexists('last_version_s',''),\n\t\tLanguage=column_ifexists('language_s',''),\n\t\tJobId=column_ifexists('job_id_s',''),\n\t\tIsSuccess=column_ifexists('is_success_s',''),\n\t\tIsSecure=column_ifexists('is_secure_s',''),\n\t\tIsScheduled=column_ifexists('is_scheduled_s',''),\n\t\tIsNew=column_ifexists('is_new_s',''),\n\t\tIsMobile=column_ifexists('is_mobile_s',''),\n\t\tIsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\n\t\tIsGuest=column_ifexists('is_guest_s',''),\n\t\tIsFirstRequest=column_ifexists('is_first_request_s',''),\n\t\tIsError=column_ifexists('is_error_s',''),\n\t\tIsApi=column_ifexists('is_api_s',''),\n\t\tIsAjaxRequest=column_ifexists('is_ajax_request_s',''),\n ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\n HttpHeaders=column_ifexists('http_headers_s',''),\n\t\tNetworkDuration=column_ifexists('time_s',''),\n Name=column_ifexists('name_s',''),\n NumberFailures=column_ifexists('number_failures_s',''),\n NumClicks=column_ifexists('num_clicks_s',''),\n OperationType=column_ifexists('operation_type_s',''),\n\t\tNumSessions=column_ifexists('num_sessions_s',''),\n PageName=column_ifexists('page_name_s',''),\n Query=column_ifexists('query_s',''),\n RequestType=column_ifexists('request_type_s',''),\n ReportDescription=column_ifexists('report_description_s',''),\n\t\tReopenCount=column_ifexists('reopen_count_s',''),\n RelatedEntityId=column_ifexists('related_entity_id_s',''),\n RecordIdDerived=column_ifexists('record_id_derived_s',''),\n ReadTime=column_ifexists('read_time_s',''),\n\t\tRank=column_ifexists('rank_s',''),\n\t\tSrcBytes=column_ifexists('response_size_s',''),\n\t\tSrcDvcId=column_ifexists('device_id_s',''),\n\t\tSrcDvcModelName=column_ifexists('device_model_s',''),\n\t\tSrcIpAddr=column_ifexists('source_ip_s',''),\n\t\tSrcNatIpAddr=column_ifexists('client_ip_s',''),\n SessionId=column_ifexists('session_id_s',''),\n SiteId=column_ifexists('site_id_s',''),\n\t\tSharingPermission=column_ifexists('sharing_permission_s',''),\n\t\tSharingOperation=column_ifexists('sharing_operation_s',''),\n\t\tSharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\n\t\tUrlOriginal=column_ifexists('url_s',''),\n\t\tWaveTimestamp=column_ifexists('wave_timestamp_s',''),\n\t\tWaveSessionId=column_ifexists('wave_session_id_g',''),\n\t\tViewStateSize=column_ifexists('view_state_size_s',''),\n\t\tVersionIdDerived=column_ifexists('version_id_derived_s',''),\n\t\tVersionId=column_ifexists('version_id_s',''),\n TriggerType=column_ifexists('trigger_type_s',''),\n\t\tTriggerName=column_ifexists('trigger_name_s',''),\n\t\tTriggerId=column_ifexists('trigger_id_s',''),\n\t\tTransactionType=column_ifexists('transaction_type_s',''),\n\t\tTotalTime=column_ifexists('total_time_s',''),\n TabId=column_ifexists('tab_id_s',''),\n\t\tStackTrace=column_ifexists('stack_trace_s','')\n| project-away *_s\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[variables('_parserId1')]" ], "properties": { - "description": "Salesforce Service Cloud data connector with template version 2.0.4", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", + "contentId": "[variables('_parserContentId1')]", + "kind": "Parser", + "version": "[variables('parserVersion1')]", + "source": { + "kind": "Solution", + "name": "Salesforce Service Cloud", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com/" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "SalesforceServiceCloudWorkbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion1')]", + "contentVersion": "[variables('workbookVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "Sets the time name for analysis." + }, "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId1')]", - "title": "Salesforce Service Cloud (using Azure Function)", - "publisher": "Salesforce", - "descriptionMarkdown": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get [event log files](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/event_log_file_hourly_overview.htm) in hourly increments for recent activity.", - "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "SalesforceServiceCloud_CL", - "baseQuery": "SalesforceServiceCloud_CL" - } - ], - "sampleQueries": [ - { - "description": "Last Salesforce Service Cloud EventLogFile Events", - "query": "SalesforceServiceCloud\n | sort by TimeGenerated desc" - } - ], - "dataTypes": [ - { - "name": "SalesforceServiceCloud_CL", - "lastDataReceivedQuery": "SalesforceServiceCloud_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "SalesforceServiceCloud_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "**Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** is required for REST API. [See the documentation to learn more about API](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm)." - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This connector uses Azure Functions to connect to the Salesforce Lightning Platform REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." - }, - { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." - }, - { - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce%20Service%20Cloud/Parsers/SalesforceServiceCloud.txt). The function usually takes 10-15 minutes to activate after solution installation/update." - }, - { - "description": "**STEP 1 - Configuration steps for the Salesforce Lightning Platform REST API**\n\n1. See the [link](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm) and follow the instructions for obtaining Salesforce API Authorization credentials. \n2. On the **Set Up Authorization** step choose **Session ID Authorization** method.\n3. You must provide your client id, client secret, username, and password with user security token." - }, - { - "description": ">**NOTE:** Ingesting data from on an hourly interval may require additional licensing based on the edition of the Salesforce Service Cloud being used. Please refer to [Salesforce documentation](https://www.salesforce.com/editions-pricing/service-cloud/) and/or support for more details." - }, - { - "description": "**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Salesforce Service Cloud data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Salesforce API Authorization credentials, readily available.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Workspace ID" - }, - "type": "CopyableLabel" - }, - { - "parameters": { - "fillWith": [ - "PrimaryKey" - ], - "label": "Primary Key" - }, - "type": "CopyableLabel" - } - ] - }, - { - "description": "Use this method for automated deployment of the Salesforce Service Cloud data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SalesforceServiceCloud-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Option 1 - Azure Resource Manager (ARM) Template" - }, - { - "description": "Use the following step-by-step instructions to deploy the Salesforce Service Cloud data connector manually with Azure Functions (Deployment via Visual Studio Code).", - "title": "Option 2 - Manual Deployment of Azure Functions" - }, - { - "description": "**1. Deploy a Function App**\n\n> NOTE:You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. SalesforceXXXXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration." - }, - { - "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tSalesforceUser\n\t\tSalesforcePass\n\t\tSalesforceSecurityToken\n\t\tSalesforceConsumerKey\n\t\tSalesforceConsumerSecret\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n3. Once all application settings have been entered, click **Save**." - } - ] - } + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Salesforce Service Cloud Workbook\\n---\\n\\nThis workbook brings together queries and visualizations to assist you in identifying potential threats in your Salesforce Service cloud audit data. Visualizations may not appear if no data is present.\\n\\nTo begin select the desired TimeRange to filter the data to the timeframe you want to focus on. Note if you have a large amount of salesforce service cloud data, queries may timeout with a large time range, if this is the case simply select a smaller time range.: \",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"412a09a0-64ae-4614-aec6-cbfc9273b82b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 32\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ae90d1dc-20da-4948-80da-127b210bf152\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"User Logins\",\"subTarget\":\"1\",\"style\":\"link\"},{\"id\":\"af58b4d9-a888-43ed-91a9-6e9f539a61d4\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"API Usage\",\"subTarget\":\"2\",\"style\":\"link\"}]},\"name\":\"links - 34\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"User login locations\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"];\\nlet UsersLocation = SalesforceServiceCloud\\n| where EventType == \\\"Login\\\"\\n| project TimeGenerated, SourceIp;\\nUsersLocation\\n| extend Dummy=1\\n| summarize count() by Hour=bin(TimeGenerated,24h), SourceIp,Dummy\\n| partition by Hour(\\n lookup (Countrydb|extend Dummy=1) on Dummy\\n | where ipv4_is_match(SourceIp, Network)\\n )\\n| summarize sum(count_) by country_name\",\"size\":3,\"title\":\"Heat Map- Geographical - {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"TimeGenerated\",\"parameterName\":\"RetTime\"},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"chartSettings\":{\"showLegend\":true},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"country_name\",\"sizeSettings\":\"sum_count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"sum_count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"sum_count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"70\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize AvgLogintime = avg(toint(RunTime)), MaxLoginTime = max(toint(RunTime)), TotalLoginRequests = count() by EventType\\r\\n| project-away EventType\",\"size\":1,\"title\":\"Overview - User login requests\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AvgLogintime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaxLoginTime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalLoginRequests\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"rowLimit\":1},\"tileSettings\":{\"showBorder\":false}},\"customWidth\":\"30\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize count() by bin(TimeGenerated, 1h),User, ClientIp \\r\\n| top 10 by count_\",\"size\":0,\"title\":\"Top 10 users with maximun logins - {TimeRange:label}\",\"exportFieldName\":\"UserId\",\"exportParameterName\":\"RetUser\",\"exportDefaultValue\":\"all users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"user_name_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TimeGenerated\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"To leverage infomation about Malicious IP, Threat Indicator solution should be configured and ThreatIntelligenceIndicator table should have information of malicious IP.\",\"style\":\"info\"},\"customWidth\":\"10\",\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\" let malicious_ips =\\r\\n ThreatIntelligenceIndicator\\r\\n | where isnotempty(NetworkIP)\\r\\n | summarize make_list(NetworkIP); \\r\\n SalesforceServiceCloud\\r\\n | where EventType == 'Login'\\r\\n | distinct User,ClientIp\\r\\n | where ClientIp in (malicious_ips)\\r\\n | project UserName = User, MaliciousIP = ClientIp\\r\\n\",\"size\":1,\"title\":\"Malicious IP- User Login\",\"noDataMessage\":\"No Malicious IP found\",\"timeBrushParameterName\":\"TimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaliciousIP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}]},\"graphSettings\":{\"type\":0},\"chartSettings\":{\"showMetrics\":false}},\"customWidth\":\"30\",\"name\":\"query - 23\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAS'\\r\\n| project UserID = UserId,DerivedUSerID = UserIdDerived,EventType = EventType, IPAddress = ClientIp, LoginKey = LoginKey, OrgID = OrganizationId, RequestID = RequestId, SessionKey = SessionKey\\r\\n| limit 10\",\"size\":0,\"title\":\"User Activity- LoginAS(Top 10)\",\"noDataMessage\":\"No user impersonation found\",\"exportFieldName\":\"IPAddress\",\"exportParameterName\":\"RetIP\",\"exportDefaultValue\":\"all IP addresses\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"IPAddress\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalRecords\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"60\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAs'\\r\\n| where isnotempty(User)\\r\\n| summarize count() by User,UserIdDerived,ClientIp\\r\\n| project UserName = User,DerivedUSerID = UserIdDerived,IPAddress = ClientIp, count_\",\"size\":1,\"title\":\"User Impersonation from different IP Addresses\",\"color\":\"blue\",\"noDataMessage\":\"No user impersonation found\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"DerivedUSerID\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IPAddress\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"DerivedUSerID\",\"label\":\"Impersonated ID\"},{\"columnId\":\"IPAddress\",\"label\":\"IP Address\"},{\"columnId\":\"count_\",\"label\":\"Total Login\"}]},\"chartSettings\":{\"xAxis\":\"IPAddress\",\"yAxis\":[\"count_\"],\"showLegend\":true}},\"customWidth\":\"40\",\"name\":\"query - 24\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| project UserName= User,APIType= ApiType, Browser= BrowserType, CipherSuite =CipherSuite, IP =ClientIp, CPUTime=CpuTime, UserType = UserType\\r\\n| take 200\",\"size\":0,\"title\":\"User Successful Login Activity\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"60\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| where LoginStatus !has('LOGIN_NO_ERROR')\\r\\n| summarize count() by User, ClientIp\\r\\n| project UserName = User, IP = ClientIp, Count = count_\",\"size\":1,\"title\":\"User Unsuccessful Logins by IP\",\"noDataMessage\":\"No Unsucessful Login found\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"IP\",\"label\":\"IP Address\"},{\"columnId\":\"Count\",\"label\":\"Count\"}]},\"chartSettings\":{\"xAxis\":\"UserName\",\"yAxis\":[\"Count\"],\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"30\",\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Retrieval Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"API Usage\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| summarize count() by EventType\",\"size\":0,\"title\":\"Most fired events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":50,\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by IPAddress = ClientIp,Entity = EntityName\\r\\n| order by Entity\",\"size\":0,\"title\":\"Most accessed entities by IP Address\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"user_id_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"entity_name_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"client_ip_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Count\"}]}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"30%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by EntityName\",\"size\":0,\"title\":\"Most accessed Entities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"APIUsage\"}],\"fromTemplateId\":\"sentinel-SalesforceServiceCloudWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", + "description": "@{workbookKey=SalesforceServiceCloudWorkbook; logoFileName=salesforce_logo.svg; description=Sets the time name for analysis.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Salesforce Service Cloud; templateRelativePath=SalesforceServiceCloud.json; subtitle=; provider=Salesforce}.description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", "source": { "kind": "Solution", "name": "Salesforce Service Cloud", @@ -614,247 +680,224 @@ "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com/" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "SalesforceServiceCloud", + "kind": "DataType" + }, + { + "contentId": "SalesforceServiceCloud_CL", + "kind": "DataConnector" + } + ] } } } ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId1')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "Salesforce Service Cloud", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com/" - } + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "connectorUiConfig": { - "title": "Salesforce Service Cloud (using Azure Function)", - "publisher": "Salesforce", - "descriptionMarkdown": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get [event log files](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/event_log_file_hourly_overview.htm) in hourly increments for recent activity.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "SalesforceServiceCloud_CL", - "baseQuery": "SalesforceServiceCloud_CL" - } - ], - "dataTypes": [ - { - "name": "SalesforceServiceCloud_CL", - "lastDataReceivedQuery": "SalesforceServiceCloud_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "SalesforceServiceCloud_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ + "description": "Salesforce-BruteForce_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ { - "description": "Last Salesforce Service Cloud EventLogFile Events", - "query": "SalesforceServiceCloud\n | sort by TimeGenerated desc" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId1')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Identifies evidence of brute force activity against a user based on multiple authentication failures \nand at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses\nThe default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.", + "displayName": "Brute force attack against user credentials", + "enabled": false, + "query": "let failureCountThreshold = 10;\nlet successCountThreshold = 1;\nlet Failures =\nSalesforceServiceCloud\n| where EventType == \"Login\" and LoginStatus != \"LOGIN_NO_ERROR\"\n| summarize\n FailureStartTime = min(TimeGenerated),\n FailureEndTime = max(TimeGenerated),\n IpAddresses = make_set (ClientIp, 100),\n FailureCount = count() by User, UserId, UserType;\n SalesforceServiceCloud\n | where EventType == \"Login\" and LoginStatus == \"LOGIN_NO_ERROR\"\n | summarize\n SuccessStartTime = min(TimeGenerated),\n SuccessEndTime = max(TimeGenerated),\n IpAddresses = make_set (ClientIp, 100),\n SuccessCount = count() by User, UserId, UserType\n | join kind=leftouter Failures on UserId\n | where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold\n | where FailureEndTime < SuccessStartTime\n | project User, EventStartTime = FailureStartTime, EventEndTime = SuccessEndTime, IpAddresses\n", + "queryFrequency": "PT20M", + "queryPeriod": "PT20M", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "SalesforceServiceCloud" + ], + "connectorId": "SalesforceServiceCloud" + } + ], + "tactics": [ + "CredentialAccess" + ], + "techniques": [ + "T1110" + ], + "entityMappings": [ + { + "fieldMappings": [ + { + "identifier": "FullName", + "columnName": "User" + } + ], + "entityType": "Account" + } + ], + "customDetails": { + "EventStartTime": "FailureStartTime", + "IPAddresses": "IpAddresses", + "EventEndTime": "SuccessEndTime" } } - ], - "customs": [ - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "**Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** is required for REST API. [See the documentation to learn more about API](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm)." - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This connector uses Azure Functions to connect to the Salesforce Lightning Platform REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." - }, - { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." - }, - { - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce%20Service%20Cloud/Parsers/SalesforceServiceCloud.txt). The function usually takes 10-15 minutes to activate after solution installation/update." - }, - { - "description": "**STEP 1 - Configuration steps for the Salesforce Lightning Platform REST API**\n\n1. See the [link](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm) and follow the instructions for obtaining Salesforce API Authorization credentials. \n2. On the **Set Up Authorization** step choose **Session ID Authorization** method.\n3. You must provide your client id, client secret, username, and password with user security token." }, { - "description": ">**NOTE:** Ingesting data from on an hourly interval may require additional licensing based on the edition of the Salesforce Service Cloud being used. Please refer to [Salesforce documentation](https://www.salesforce.com/editions-pricing/service-cloud/) and/or support for more details." - }, - { - "description": "**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Salesforce Service Cloud data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Salesforce API Authorization credentials, readily available.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Workspace ID" - }, - "type": "CopyableLabel" + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", + "properties": { + "description": "Salesforce Service Cloud Analytics Rule 1", + "parentId": "[variables('analyticRuleId1')]", + "contentId": "[variables('_analyticRulecontentId1')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion1')]", + "source": { + "kind": "Solution", + "name": "Salesforce Service Cloud", + "sourceId": "[variables('_solutionId')]" }, - { - "parameters": { - "fillWith": [ - "PrimaryKey" - ], - "label": "Primary Key" - }, - "type": "CopyableLabel" + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com/" } - ] - }, - { - "description": "Use this method for automated deployment of the Salesforce Service Cloud data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SalesforceServiceCloud-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Option 1 - Azure Resource Manager (ARM) Template" - }, - { - "description": "Use the following step-by-step instructions to deploy the Salesforce Service Cloud data connector manually with Azure Functions (Deployment via Visual Studio Code).", - "title": "Option 2 - Manual Deployment of Azure Functions" - }, - { - "description": "**1. Deploy a Function App**\n\n> NOTE:You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. SalesforceXXXXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration." - }, - { - "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tSalesforceUser\n\t\tSalesforcePass\n\t\tSalesforceSecurityToken\n\t\tSalesforceConsumerKey\n\t\tSalesforceConsumerSecret\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n3. Once all application settings have been entered, click **Save**." + } } - ], - "id": "[variables('_uiConfigId1')]", - "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution." - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('parserTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, - "properties": { - "description": "SalesforceServiceCloud Data Parser with template", - "displayName": "SalesforceServiceCloud Data Parser template" + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId1')]", + "contentKind": "AnalyticsRule", + "displayName": "Brute force attack against user credentials", + "contentProductId": "[variables('_analyticRulecontentProductId1')]", + "id": "[variables('_analyticRulecontentProductId1')]", + "version": "[variables('analyticRuleVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('parserTemplateSpecName1'),'/',variables('parserVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('parserTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SalesforceServiceCloud Data Parser with template version 2.0.4", + "description": "Salesforce-PasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserVersion1')]", + "contentVersion": "[variables('analyticRuleVersion2')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[variables('_parserName1')]", - "apiVersion": "2020-08-01", - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId2')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "SalesforceServiceCloud", - "category": "Samples", - "functionAlias": "SalesforceServiceCloud", - "query": "\nSalesforceServiceCloud_CL \r\n| extend \r\n\t\tRequestSize=column_ifexists('request_size_s',''),\r\n\t\tExecTime=column_ifexists('exec_time_s',''),\r\n\t\tAction=column_ifexists('action_s',''),\r\n\t\tPlatformType=column_ifexists('platform_type_s',''),\r\n\t\tOsName=column_ifexists('os_name_s',''),\r\n\t\tOsVersion=column_ifexists('os_version_s',''),\r\n\t\tTimestamp=column_ifexists('timestamp_s',''),\r\n\t\tStatusCode=column_ifexists('status_code_s',''),\r\n\t\tEventType=column_ifexists('event_type_s',''),\r\n\t\tReferrerUri=column_ifexists('referrer_uri_s',''),\r\n\t\tUserAgent=column_ifexists('user_agent_s',''),\r\n\t\tBrowserType=column_ifexists('browser_type_s',''),\r\n\t\tTime=column_ifexists('time_s',''),\r\n\t\tResponseSize=column_ifexists('response_size_s',''),\r\n\t\tDeviceId=column_ifexists('device_id_s',''),\r\n\t\tDeviceModel=column_ifexists('device_model_s',''),\r\n\t\tSourceIp=column_ifexists('source_ip_s',''),\r\n\t\tClientIp=column_ifexists('client_ip_s',''),\r\n\t\tSuccess=column_ifexists('success_s',''),\r\n\t\tUri=column_ifexists('uri_s',''),\r\n\t\tUrl=column_ifexists('url_s',''),\r\n\t\tClientName=column_ifexists('client_name_s',''),\r\n\t\tUserType=column_ifexists('user_type_s',''),\r\n\t\tUserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\r\n\t\tUserIdDerived=column_ifexists('user_id_derived_s',''),\r\n\t\tUserId=column_ifexists('user_id_s',''),\r\n\t\tUserEmail=column_ifexists('user_email_s',''),\r\n\t\tUser=column_ifexists('user_name_s',''),\r\n\t\tUriIdDerived=column_ifexists('uri_id_derived_s',''),\r\n\t\tUiEventType=column_ifexists('ui_event_type_s',''),\r\n\t\tUiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\r\n\t\tUiEventSource=column_ifexists('ui_event_source_s',''),\r\n\t\tUiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\r\n\t\tUiEventId=column_ifexists('ui_event_id_s',''),\r\n\t\tTlsProtocol=column_ifexists('tls_protocol_s',''),\r\n\t\tTimestampDerived=column_ifexists('timestamp_derived_t',''),\r\n\t\tTargetUiElement=column_ifexists('target_ui_element_s',''),\r\n\t\tSort=column_ifexists('sort_s',''),\r\n\t\tSessionType=column_ifexists('session_type_s',''),\r\n\t\tSessionLevel=column_ifexists('session_level_s',''),\r\n\t\tSessionKey=column_ifexists('session_key_s',''),\r\n\t\tSearchQuery=column_ifexists('search_query_s',''),\r\n\t\tSdkVersion=column_ifexists('sdk_version_s',''),\r\n\t\tSdkAppVersion=column_ifexists('sdk_app_version_s',''),\r\n\t\tSdkAppType=column_ifexists('sdk_app_type_s',''),\r\n\t\tRunTime=column_ifexists('run_time_s',''),\r\n\t\tRowsProcessed=column_ifexists('rows_processed_s',''),\r\n\t\tRowCount=column_ifexists('row_count_s',''),\r\n\t\tResolutionType=column_ifexists('resolution_type_s',''),\r\n\t\tRequestStatus=column_ifexists('request_status_s',''),\r\n\t\tRequestId=column_ifexists('request_id_s',''),\r\n\t\tReportIdDerived=column_ifexists('report_id_derived_s',''),\r\n\t\tReportId=column_ifexists('report_id_s',''),\r\n\t\tRenderingType=column_ifexists('rendering_type_s',''),\r\n\t\tRelatedList=column_ifexists('related_list_s',''),\r\n\t\tRecordType=column_ifexists('record_type_s',''),\r\n\t\tRecordId=column_ifexists('record_id_s',''),\r\n\t\tQuiddity=column_ifexists('quiddity_s',''),\r\n\t\tQueryId=column_ifexists('query_id_s',''),\r\n\t\tPrevpageUrl=column_ifexists('prevpage_url_s',''),\r\n\t\tPrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\r\n\t\tPrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\r\n\t\tPrevpageContext=column_ifexists('prevpage_context_s',''),\r\n\t\tPrevpageAppName=column_ifexists('prevpage_app_name_s',''),\r\n\t\tPrefixesSearched=column_ifexists('prefixes_searched_s',''),\r\n\t\tParentUiElement=column_ifexists('parent_ui_element_s',''),\r\n\t\tPageUrl=column_ifexists('page_url_s',''),\r\n\t\tPageStartTime=column_ifexists('page_start_time_s',''),\r\n\t\tPageEntityType=column_ifexists('page_entity_type_s',''),\r\n\t\tPageEntityId=column_ifexists('page_entity_id_s',''),\r\n\t\tPageContext=column_ifexists('page_context_s',''),\r\n\t\tPageAppName=column_ifexists('page_app_name_s',''),\r\n\t\tOrigin=column_ifexists('origin_s',''),\r\n\t\tOrganizationId=column_ifexists('organization_id_s',''),\r\n\t\tNumResults=column_ifexists('num_results_s',''),\r\n\t\tNumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\r\n\t\tNumberFields=column_ifexists('number_fields_s',''),\r\n\t\tNumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\r\n\t\tNumberColumns=column_ifexists('number_columns_s',''),\r\n\t\tNumberBuckets=column_ifexists('number_buckets_s',''),\r\n\t\tMethodName=column_ifexists('method_name_s',''),\r\n\t\tMethod=column_ifexists('method_s',''),\r\n\t\tMediaType=column_ifexists('media_type_s',''),\r\n\t\tLoginStatus=column_ifexists('login_status_s',''),\r\n\t\tLoginKey=column_ifexists('login_key_s',''),\r\n\t\tHttpMethod=column_ifexists('http_method_s',''),\r\n\t\tGrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\r\n\t\tEntryPoint=column_ifexists('entry_point_s',''),\r\n\t\tEntityName=column_ifexists('entity_name_s',''),\r\n\t\tEntity=column_ifexists('entity_s',''),\r\n\t\tEffectivePageTime=column_ifexists('effective_page_time_s',''),\r\n\t\tDuration=column_ifexists('duration_s',''),\r\n\t\tDisplayType=column_ifexists('display_type_s',''),\r\n\t\tDeviceSessionId=column_ifexists('device_session_id_s',''),\r\n\t\tDevicePlatform=column_ifexists('device_platform_s',''),\r\n\t\tDbTotalTime=column_ifexists('db_total_time_s',''),\r\n\t\tDbCpuTime=column_ifexists('db_cpu_time_s',''),\r\n\t\tDbBlocks=column_ifexists('db_blocks_s',''),\r\n\t\tCpuTime=column_ifexists('cpu_time_s',''),\r\n\t\tConnectionType=column_ifexists('connection_type_s',''),\r\n\t\tComponentName=column_ifexists('component_name_s',''),\r\n\t\tClientVersion=column_ifexists('client_version_s',''),\r\n\t\tClientId=column_ifexists('client_id_s',''),\r\n\t\tCipherSuite=column_ifexists('cipher_suite_s',''),\r\n\t\tCalloutTime=column_ifexists('callout_time_s',''),\r\n\t\tBrowserVersion=column_ifexists('browser_version_s',''),\r\n\t\tBrowserName=column_ifexists('browser_name_s',''),\r\n\t\tAverageRowSize=column_ifexists('average_row_size_s',''),\r\n\t\tAppType=column_ifexists('app_type_s',''),\r\n\t\tAppName=column_ifexists('app_name_s',''),\r\n\t\tApiVersion=column_ifexists('api_version_s',''),\r\n\t\tApiType=column_ifexists('api_type_s',''),\r\n ArticleVersionId=column_ifexists('article_version_id_s',''),\r\n\t\tArticleVersion=column_ifexists('article_version_s',''),\r\n\t\tArticleStatus=column_ifexists('article_status_s',''),\r\n\t\tArticleId=column_ifexists('article_id_s',''),\r\n AnalyticsMode=column_ifexists('analytics_mode_s',''),\r\n BatchId=column_ifexists('batch_id_s',''),\r\n ClickedRecordId=column_ifexists('clicked_record_id_s',''),\r\n\t\tClassName=column_ifexists('class_name_s',''),\r\n ComponentIdDerived=column_ifexists('component_id_derived_s',''),\r\n\t\tComponentId=column_ifexists('component_id_s',''),\r\n ControllerType=column_ifexists('controller_type_s',''),\r\n\t\tContext=column_ifexists('context_s',''),\r\n\t\tConsoleIdDerived=column_ifexists('console_id_derived_s',''),\r\n\t\tConsoleId=column_ifexists('console_id_s',''), \r\n ClientInfo=column_ifexists('client_info_s',''),\r\n DstBytes=column_ifexists('request_size_s',''),\r\n\t\tDstUser=column_ifexists('delegated_user_name_s',''),\r\n DstUserSid=column_ifexists('delegated_user_id_s',''),\r\n\t\tDstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\r\n Data=column_ifexists('data_s',''),\r\n\t\tDashboardType=column_ifexists('dashboard_type_s',''),\r\n\t\tDashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\r\n\t\tDashboardId=column_ifexists('dashboard_id_s',''),\r\n\t\tDashboardComponentId=column_ifexists('dashboard_component_id_s',''),\r\n\t\tDvcAction=column_ifexists('action_s',''),\r\n\t\tDvcOS=column_ifexists('platform_type_s',''),\r\n\t\tDvcOSName=column_ifexists('os_name_s',''),\r\n\t\tDvcOSVersion=column_ifexists('os_version_s',''),\r\n DeliveryLocation=column_ifexists('delivery_location_s',''),\r\n\t\tDeliveryId=column_ifexists('delivery_id_s',''),\r\n DocumentIdDerived=column_ifexists('document_id_derived_s',''),\r\n\t\tDocumentId=column_ifexists('document_id_s',''),\r\n EntityType=column_ifexists('entity_type_s',''),\r\n EntityId=column_ifexists('entity_id_s',''),\r\n FileType=column_ifexists('file_type_s',''),\r\n\t\tFilePreviewType=column_ifexists('file_preview_type_s',''),\r\n\t\tExceptionType=column_ifexists('exception_type_s',''),\r\n\t\tExceptionMessage=column_ifexists('exception_message_s',''),\r\n\t\tEpt=column_ifexists('ept_s',''),\r\n EventCount=column_ifexists('number_of_records_s',''),\r\n\t\tEventEndTime=column_ifexists('timestamp_s',''),\r\n\t\tEventResult=column_ifexists('status_code_s',''),\r\n\t\tFileSize=column_ifexists('size_bytes_s',''),\r\n HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\r\n\t\tHttpUserAgentOriginal=column_ifexists('user_agent_s',''),\r\n\t\tHttpUserAgent=column_ifexists('browser_type_s',''),\r\n LogGroupId=column_ifexists('log_group_id_s',''),\r\n\t\tLimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\r\n\t\tLicenseContext=column_ifexists('license_context_s',''),\r\n\t\tLastVersion=column_ifexists('last_version_s',''),\r\n\t\tLanguage=column_ifexists('language_s',''),\r\n\t\tJobId=column_ifexists('job_id_s',''),\r\n\t\tIsSuccess=column_ifexists('is_success_s',''),\r\n\t\tIsSecure=column_ifexists('is_secure_s',''),\r\n\t\tIsScheduled=column_ifexists('is_scheduled_s',''),\r\n\t\tIsNew=column_ifexists('is_new_s',''),\r\n\t\tIsMobile=column_ifexists('is_mobile_s',''),\r\n\t\tIsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\r\n\t\tIsGuest=column_ifexists('is_guest_s',''),\r\n\t\tIsFirstRequest=column_ifexists('is_first_request_s',''),\r\n\t\tIsError=column_ifexists('is_error_s',''),\r\n\t\tIsApi=column_ifexists('is_api_s',''),\r\n\t\tIsAjaxRequest=column_ifexists('is_ajax_request_s',''),\r\n ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\r\n HttpHeaders=column_ifexists('http_headers_s',''),\r\n\t\tNetworkDuration=column_ifexists('time_s',''),\r\n Name=column_ifexists('name_s',''),\r\n NumberFailures=column_ifexists('number_failures_s',''),\r\n NumClicks=column_ifexists('num_clicks_s',''),\r\n OperationType=column_ifexists('operation_type_s',''),\r\n\t\tNumSessions=column_ifexists('num_sessions_s',''),\r\n PageName=column_ifexists('page_name_s',''),\r\n Query=column_ifexists('query_s',''),\r\n RequestType=column_ifexists('request_type_s',''),\r\n ReportDescription=column_ifexists('report_description_s',''),\r\n\t\tReopenCount=column_ifexists('reopen_count_s',''),\r\n RelatedEntityId=column_ifexists('related_entity_id_s',''),\r\n RecordIdDerived=column_ifexists('record_id_derived_s',''),\r\n ReadTime=column_ifexists('read_time_s',''),\r\n\t\tRank=column_ifexists('rank_s',''),\r\n\t\tSrcBytes=column_ifexists('response_size_s',''),\r\n\t\tSrcDvcId=column_ifexists('device_id_s',''),\r\n\t\tSrcDvcModelName=column_ifexists('device_model_s',''),\r\n\t\tSrcIpAddr=column_ifexists('source_ip_s',''),\r\n\t\tSrcNatIpAddr=column_ifexists('client_ip_s',''),\r\n SessionId=column_ifexists('session_id_s',''),\r\n SiteId=column_ifexists('site_id_s',''),\r\n\t\tSharingPermission=column_ifexists('sharing_permission_s',''),\r\n\t\tSharingOperation=column_ifexists('sharing_operation_s',''),\r\n\t\tSharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\r\n\t\tUrlOriginal=column_ifexists('url_s',''),\r\n\t\tWaveTimestamp=column_ifexists('wave_timestamp_s',''),\r\n\t\tWaveSessionId=column_ifexists('wave_session_id_g',''),\r\n\t\tViewStateSize=column_ifexists('view_state_size_s',''),\r\n\t\tVersionIdDerived=column_ifexists('version_id_derived_s',''),\r\n\t\tVersionId=column_ifexists('version_id_s',''),\r\n TriggerType=column_ifexists('trigger_type_s',''),\r\n\t\tTriggerName=column_ifexists('trigger_name_s',''),\r\n\t\tTriggerId=column_ifexists('trigger_id_s',''),\r\n\t\tTransactionType=column_ifexists('transaction_type_s',''),\r\n\t\tTotalTime=column_ifexists('total_time_s',''),\r\n TabId=column_ifexists('tab_id_s',''),\r\n\t\tStackTrace=column_ifexists('stack_trace_s','')\r\n| project-away *_s", - "version": 1, - "tags": [ + "description": "This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack.", + "displayName": "Potential Password Spray Attack", + "enabled": false, + "query": "let FailureThreshold = 15; \nSalesforceServiceCloud\n| where EventType =~ 'Login' and LoginStatus != 'LOGIN_NO_ERROR'\n| where LoginStatus in~ ('LOGIN_ERROR_INVALID_PASSWORD', 'LOGIN_ERROR_SSO_PWD_INVALID')\n| summarize UserCount=dcount(UserId), Users = make_set(UserId,100) by ClientIp, bin(TimeGenerated, 5m)\n| where UserCount > FailureThreshold\n", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "SalesforceServiceCloud" + "dataTypes": [ + "SalesforceServiceCloud" + ], + "connectorId": "SalesforceServiceCloud" } - ] + ], + "tactics": [ + "CredentialAccess" + ], + "techniques": [ + "T1110" + ], + "entityMappings": [ + { + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "ClientIp" + } + ], + "entityType": "IP" + } + ], + "customDetails": { + "Users": "Users" + } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", - "dependsOn": [ - "[variables('_parserName1')]" - ], + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", - "kind": "Parser", - "version": "[variables('parserVersion1')]", + "description": "Salesforce Service Cloud Analytics Rule 2", + "parentId": "[variables('analyticRuleId2')]", + "contentId": "[variables('_analyticRulecontentId2')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion2')]", "source": { - "name": "Salesforce Service Cloud", "kind": "Solution", + "name": "Salesforce Service Cloud", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -870,114 +913,92 @@ } } ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2021-06-01", - "name": "[variables('_parserName1')]", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "SalesforceServiceCloud", - "category": "Samples", - "functionAlias": "SalesforceServiceCloud", - "query": "\nSalesforceServiceCloud_CL \r\n| extend \r\n\t\tRequestSize=column_ifexists('request_size_s',''),\r\n\t\tExecTime=column_ifexists('exec_time_s',''),\r\n\t\tAction=column_ifexists('action_s',''),\r\n\t\tPlatformType=column_ifexists('platform_type_s',''),\r\n\t\tOsName=column_ifexists('os_name_s',''),\r\n\t\tOsVersion=column_ifexists('os_version_s',''),\r\n\t\tTimestamp=column_ifexists('timestamp_s',''),\r\n\t\tStatusCode=column_ifexists('status_code_s',''),\r\n\t\tEventType=column_ifexists('event_type_s',''),\r\n\t\tReferrerUri=column_ifexists('referrer_uri_s',''),\r\n\t\tUserAgent=column_ifexists('user_agent_s',''),\r\n\t\tBrowserType=column_ifexists('browser_type_s',''),\r\n\t\tTime=column_ifexists('time_s',''),\r\n\t\tResponseSize=column_ifexists('response_size_s',''),\r\n\t\tDeviceId=column_ifexists('device_id_s',''),\r\n\t\tDeviceModel=column_ifexists('device_model_s',''),\r\n\t\tSourceIp=column_ifexists('source_ip_s',''),\r\n\t\tClientIp=column_ifexists('client_ip_s',''),\r\n\t\tSuccess=column_ifexists('success_s',''),\r\n\t\tUri=column_ifexists('uri_s',''),\r\n\t\tUrl=column_ifexists('url_s',''),\r\n\t\tClientName=column_ifexists('client_name_s',''),\r\n\t\tUserType=column_ifexists('user_type_s',''),\r\n\t\tUserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\r\n\t\tUserIdDerived=column_ifexists('user_id_derived_s',''),\r\n\t\tUserId=column_ifexists('user_id_s',''),\r\n\t\tUserEmail=column_ifexists('user_email_s',''),\r\n\t\tUser=column_ifexists('user_name_s',''),\r\n\t\tUriIdDerived=column_ifexists('uri_id_derived_s',''),\r\n\t\tUiEventType=column_ifexists('ui_event_type_s',''),\r\n\t\tUiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\r\n\t\tUiEventSource=column_ifexists('ui_event_source_s',''),\r\n\t\tUiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\r\n\t\tUiEventId=column_ifexists('ui_event_id_s',''),\r\n\t\tTlsProtocol=column_ifexists('tls_protocol_s',''),\r\n\t\tTimestampDerived=column_ifexists('timestamp_derived_t',''),\r\n\t\tTargetUiElement=column_ifexists('target_ui_element_s',''),\r\n\t\tSort=column_ifexists('sort_s',''),\r\n\t\tSessionType=column_ifexists('session_type_s',''),\r\n\t\tSessionLevel=column_ifexists('session_level_s',''),\r\n\t\tSessionKey=column_ifexists('session_key_s',''),\r\n\t\tSearchQuery=column_ifexists('search_query_s',''),\r\n\t\tSdkVersion=column_ifexists('sdk_version_s',''),\r\n\t\tSdkAppVersion=column_ifexists('sdk_app_version_s',''),\r\n\t\tSdkAppType=column_ifexists('sdk_app_type_s',''),\r\n\t\tRunTime=column_ifexists('run_time_s',''),\r\n\t\tRowsProcessed=column_ifexists('rows_processed_s',''),\r\n\t\tRowCount=column_ifexists('row_count_s',''),\r\n\t\tResolutionType=column_ifexists('resolution_type_s',''),\r\n\t\tRequestStatus=column_ifexists('request_status_s',''),\r\n\t\tRequestId=column_ifexists('request_id_s',''),\r\n\t\tReportIdDerived=column_ifexists('report_id_derived_s',''),\r\n\t\tReportId=column_ifexists('report_id_s',''),\r\n\t\tRenderingType=column_ifexists('rendering_type_s',''),\r\n\t\tRelatedList=column_ifexists('related_list_s',''),\r\n\t\tRecordType=column_ifexists('record_type_s',''),\r\n\t\tRecordId=column_ifexists('record_id_s',''),\r\n\t\tQuiddity=column_ifexists('quiddity_s',''),\r\n\t\tQueryId=column_ifexists('query_id_s',''),\r\n\t\tPrevpageUrl=column_ifexists('prevpage_url_s',''),\r\n\t\tPrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\r\n\t\tPrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\r\n\t\tPrevpageContext=column_ifexists('prevpage_context_s',''),\r\n\t\tPrevpageAppName=column_ifexists('prevpage_app_name_s',''),\r\n\t\tPrefixesSearched=column_ifexists('prefixes_searched_s',''),\r\n\t\tParentUiElement=column_ifexists('parent_ui_element_s',''),\r\n\t\tPageUrl=column_ifexists('page_url_s',''),\r\n\t\tPageStartTime=column_ifexists('page_start_time_s',''),\r\n\t\tPageEntityType=column_ifexists('page_entity_type_s',''),\r\n\t\tPageEntityId=column_ifexists('page_entity_id_s',''),\r\n\t\tPageContext=column_ifexists('page_context_s',''),\r\n\t\tPageAppName=column_ifexists('page_app_name_s',''),\r\n\t\tOrigin=column_ifexists('origin_s',''),\r\n\t\tOrganizationId=column_ifexists('organization_id_s',''),\r\n\t\tNumResults=column_ifexists('num_results_s',''),\r\n\t\tNumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\r\n\t\tNumberFields=column_ifexists('number_fields_s',''),\r\n\t\tNumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\r\n\t\tNumberColumns=column_ifexists('number_columns_s',''),\r\n\t\tNumberBuckets=column_ifexists('number_buckets_s',''),\r\n\t\tMethodName=column_ifexists('method_name_s',''),\r\n\t\tMethod=column_ifexists('method_s',''),\r\n\t\tMediaType=column_ifexists('media_type_s',''),\r\n\t\tLoginStatus=column_ifexists('login_status_s',''),\r\n\t\tLoginKey=column_ifexists('login_key_s',''),\r\n\t\tHttpMethod=column_ifexists('http_method_s',''),\r\n\t\tGrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\r\n\t\tEntryPoint=column_ifexists('entry_point_s',''),\r\n\t\tEntityName=column_ifexists('entity_name_s',''),\r\n\t\tEntity=column_ifexists('entity_s',''),\r\n\t\tEffectivePageTime=column_ifexists('effective_page_time_s',''),\r\n\t\tDuration=column_ifexists('duration_s',''),\r\n\t\tDisplayType=column_ifexists('display_type_s',''),\r\n\t\tDeviceSessionId=column_ifexists('device_session_id_s',''),\r\n\t\tDevicePlatform=column_ifexists('device_platform_s',''),\r\n\t\tDbTotalTime=column_ifexists('db_total_time_s',''),\r\n\t\tDbCpuTime=column_ifexists('db_cpu_time_s',''),\r\n\t\tDbBlocks=column_ifexists('db_blocks_s',''),\r\n\t\tCpuTime=column_ifexists('cpu_time_s',''),\r\n\t\tConnectionType=column_ifexists('connection_type_s',''),\r\n\t\tComponentName=column_ifexists('component_name_s',''),\r\n\t\tClientVersion=column_ifexists('client_version_s',''),\r\n\t\tClientId=column_ifexists('client_id_s',''),\r\n\t\tCipherSuite=column_ifexists('cipher_suite_s',''),\r\n\t\tCalloutTime=column_ifexists('callout_time_s',''),\r\n\t\tBrowserVersion=column_ifexists('browser_version_s',''),\r\n\t\tBrowserName=column_ifexists('browser_name_s',''),\r\n\t\tAverageRowSize=column_ifexists('average_row_size_s',''),\r\n\t\tAppType=column_ifexists('app_type_s',''),\r\n\t\tAppName=column_ifexists('app_name_s',''),\r\n\t\tApiVersion=column_ifexists('api_version_s',''),\r\n\t\tApiType=column_ifexists('api_type_s',''),\r\n ArticleVersionId=column_ifexists('article_version_id_s',''),\r\n\t\tArticleVersion=column_ifexists('article_version_s',''),\r\n\t\tArticleStatus=column_ifexists('article_status_s',''),\r\n\t\tArticleId=column_ifexists('article_id_s',''),\r\n AnalyticsMode=column_ifexists('analytics_mode_s',''),\r\n BatchId=column_ifexists('batch_id_s',''),\r\n ClickedRecordId=column_ifexists('clicked_record_id_s',''),\r\n\t\tClassName=column_ifexists('class_name_s',''),\r\n ComponentIdDerived=column_ifexists('component_id_derived_s',''),\r\n\t\tComponentId=column_ifexists('component_id_s',''),\r\n ControllerType=column_ifexists('controller_type_s',''),\r\n\t\tContext=column_ifexists('context_s',''),\r\n\t\tConsoleIdDerived=column_ifexists('console_id_derived_s',''),\r\n\t\tConsoleId=column_ifexists('console_id_s',''), \r\n ClientInfo=column_ifexists('client_info_s',''),\r\n DstBytes=column_ifexists('request_size_s',''),\r\n\t\tDstUser=column_ifexists('delegated_user_name_s',''),\r\n DstUserSid=column_ifexists('delegated_user_id_s',''),\r\n\t\tDstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\r\n Data=column_ifexists('data_s',''),\r\n\t\tDashboardType=column_ifexists('dashboard_type_s',''),\r\n\t\tDashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\r\n\t\tDashboardId=column_ifexists('dashboard_id_s',''),\r\n\t\tDashboardComponentId=column_ifexists('dashboard_component_id_s',''),\r\n\t\tDvcAction=column_ifexists('action_s',''),\r\n\t\tDvcOS=column_ifexists('platform_type_s',''),\r\n\t\tDvcOSName=column_ifexists('os_name_s',''),\r\n\t\tDvcOSVersion=column_ifexists('os_version_s',''),\r\n DeliveryLocation=column_ifexists('delivery_location_s',''),\r\n\t\tDeliveryId=column_ifexists('delivery_id_s',''),\r\n DocumentIdDerived=column_ifexists('document_id_derived_s',''),\r\n\t\tDocumentId=column_ifexists('document_id_s',''),\r\n EntityType=column_ifexists('entity_type_s',''),\r\n EntityId=column_ifexists('entity_id_s',''),\r\n FileType=column_ifexists('file_type_s',''),\r\n\t\tFilePreviewType=column_ifexists('file_preview_type_s',''),\r\n\t\tExceptionType=column_ifexists('exception_type_s',''),\r\n\t\tExceptionMessage=column_ifexists('exception_message_s',''),\r\n\t\tEpt=column_ifexists('ept_s',''),\r\n EventCount=column_ifexists('number_of_records_s',''),\r\n\t\tEventEndTime=column_ifexists('timestamp_s',''),\r\n\t\tEventResult=column_ifexists('status_code_s',''),\r\n\t\tFileSize=column_ifexists('size_bytes_s',''),\r\n HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\r\n\t\tHttpUserAgentOriginal=column_ifexists('user_agent_s',''),\r\n\t\tHttpUserAgent=column_ifexists('browser_type_s',''),\r\n LogGroupId=column_ifexists('log_group_id_s',''),\r\n\t\tLimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\r\n\t\tLicenseContext=column_ifexists('license_context_s',''),\r\n\t\tLastVersion=column_ifexists('last_version_s',''),\r\n\t\tLanguage=column_ifexists('language_s',''),\r\n\t\tJobId=column_ifexists('job_id_s',''),\r\n\t\tIsSuccess=column_ifexists('is_success_s',''),\r\n\t\tIsSecure=column_ifexists('is_secure_s',''),\r\n\t\tIsScheduled=column_ifexists('is_scheduled_s',''),\r\n\t\tIsNew=column_ifexists('is_new_s',''),\r\n\t\tIsMobile=column_ifexists('is_mobile_s',''),\r\n\t\tIsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\r\n\t\tIsGuest=column_ifexists('is_guest_s',''),\r\n\t\tIsFirstRequest=column_ifexists('is_first_request_s',''),\r\n\t\tIsError=column_ifexists('is_error_s',''),\r\n\t\tIsApi=column_ifexists('is_api_s',''),\r\n\t\tIsAjaxRequest=column_ifexists('is_ajax_request_s',''),\r\n ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\r\n HttpHeaders=column_ifexists('http_headers_s',''),\r\n\t\tNetworkDuration=column_ifexists('time_s',''),\r\n Name=column_ifexists('name_s',''),\r\n NumberFailures=column_ifexists('number_failures_s',''),\r\n NumClicks=column_ifexists('num_clicks_s',''),\r\n OperationType=column_ifexists('operation_type_s',''),\r\n\t\tNumSessions=column_ifexists('num_sessions_s',''),\r\n PageName=column_ifexists('page_name_s',''),\r\n Query=column_ifexists('query_s',''),\r\n RequestType=column_ifexists('request_type_s',''),\r\n ReportDescription=column_ifexists('report_description_s',''),\r\n\t\tReopenCount=column_ifexists('reopen_count_s',''),\r\n RelatedEntityId=column_ifexists('related_entity_id_s',''),\r\n RecordIdDerived=column_ifexists('record_id_derived_s',''),\r\n ReadTime=column_ifexists('read_time_s',''),\r\n\t\tRank=column_ifexists('rank_s',''),\r\n\t\tSrcBytes=column_ifexists('response_size_s',''),\r\n\t\tSrcDvcId=column_ifexists('device_id_s',''),\r\n\t\tSrcDvcModelName=column_ifexists('device_model_s',''),\r\n\t\tSrcIpAddr=column_ifexists('source_ip_s',''),\r\n\t\tSrcNatIpAddr=column_ifexists('client_ip_s',''),\r\n SessionId=column_ifexists('session_id_s',''),\r\n SiteId=column_ifexists('site_id_s',''),\r\n\t\tSharingPermission=column_ifexists('sharing_permission_s',''),\r\n\t\tSharingOperation=column_ifexists('sharing_operation_s',''),\r\n\t\tSharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\r\n\t\tUrlOriginal=column_ifexists('url_s',''),\r\n\t\tWaveTimestamp=column_ifexists('wave_timestamp_s',''),\r\n\t\tWaveSessionId=column_ifexists('wave_session_id_g',''),\r\n\t\tViewStateSize=column_ifexists('view_state_size_s',''),\r\n\t\tVersionIdDerived=column_ifexists('version_id_derived_s',''),\r\n\t\tVersionId=column_ifexists('version_id_s',''),\r\n TriggerType=column_ifexists('trigger_type_s',''),\r\n\t\tTriggerName=column_ifexists('trigger_name_s',''),\r\n\t\tTriggerId=column_ifexists('trigger_id_s',''),\r\n\t\tTransactionType=column_ifexists('transaction_type_s',''),\r\n\t\tTotalTime=column_ifexists('total_time_s',''),\r\n TabId=column_ifexists('tab_id_s',''),\r\n\t\tStackTrace=column_ifexists('stack_trace_s','')\r\n| project-away *_s", - "version": 1 - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", - "dependsOn": [ - "[variables('_parserId1')]" - ], - "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", - "kind": "Parser", - "version": "[variables('parserVersion1')]", - "source": { - "kind": "Solution", - "name": "Salesforce Service Cloud", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com/" - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('workbookTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "properties": { - "description": "Salesforce Service Cloud Workbook with template", - "displayName": "Salesforce Service Cloud workbook template" + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId2')]", + "contentKind": "AnalyticsRule", + "displayName": "Potential Password Spray Attack", + "contentProductId": "[variables('_analyticRulecontentProductId2')]", + "id": "[variables('_analyticRulecontentProductId2')]", + "version": "[variables('analyticRuleVersion2')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName3')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SalesforceServiceCloudWorkbook with template version 2.0.4", + "description": "Salesforce-SigninsMultipleCountries_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('workbookVersion1')]", + "contentVersion": "[variables('analyticRuleVersion3')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.Insights/workbooks", - "name": "[variables('workbookContentId1')]", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId3')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", - "kind": "shared", - "apiVersion": "2021-08-01", - "metadata": { - "description": "Sets the time name for analysis." - }, "properties": { - "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Salesforce Service Cloud Workbook\\n---\\n\\nThis workbook brings together queries and visualizations to assist you in identifying potential threats in your Salesforce Service cloud audit data. Visualizations may not appear if no data is present.\\n\\nTo begin select the desired TimeRange to filter the data to the timeframe you want to focus on. Note if you have a large amount of salesforce service cloud data, queries may timeout with a large time range, if this is the case simply select a smaller time range.: \",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"412a09a0-64ae-4614-aec6-cbfc9273b82b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 32\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ae90d1dc-20da-4948-80da-127b210bf152\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"User Logins\",\"subTarget\":\"1\",\"style\":\"link\"},{\"id\":\"af58b4d9-a888-43ed-91a9-6e9f539a61d4\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"API Usage\",\"subTarget\":\"2\",\"style\":\"link\"}]},\"name\":\"links - 34\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"User login locations\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"];\\nlet UsersLocation = SalesforceServiceCloud\\n| where EventType == \\\"Login\\\"\\n| project TimeGenerated, SourceIp;\\nUsersLocation\\n| extend Dummy=1\\n| summarize count() by Hour=bin(TimeGenerated,24h), SourceIp,Dummy\\n| partition by Hour(\\n lookup (Countrydb|extend Dummy=1) on Dummy\\n | where ipv4_is_match(SourceIp, Network)\\n )\\n| summarize sum(count_) by country_name\",\"size\":3,\"title\":\"Heat Map- Geographical - {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"TimeGenerated\",\"parameterName\":\"RetTime\"},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"chartSettings\":{\"showLegend\":true},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"country_name\",\"sizeSettings\":\"sum_count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"sum_count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"sum_count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"70\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize AvgLogintime = avg(toint(RunTime)), MaxLoginTime = max(toint(RunTime)), TotalLoginRequests = count() by EventType\\r\\n| project-away EventType\",\"size\":1,\"title\":\"Overview - User login requests\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AvgLogintime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaxLoginTime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalLoginRequests\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"rowLimit\":1},\"tileSettings\":{\"showBorder\":false}},\"customWidth\":\"30\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize count() by bin(TimeGenerated, 1h),User, ClientIp \\r\\n| top 10 by count_\",\"size\":0,\"title\":\"Top 10 users with maximun logins - {TimeRange:label}\",\"exportFieldName\":\"UserId\",\"exportParameterName\":\"RetUser\",\"exportDefaultValue\":\"all users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"user_name_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TimeGenerated\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"To leverage infomation about Malicious IP, Threat Indicator solution should be configured and ThreatIntelligenceIndicator table should have information of malicious IP.\",\"style\":\"info\"},\"customWidth\":\"10\",\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\" let malicious_ips =\\r\\n ThreatIntelligenceIndicator\\r\\n | where isnotempty(NetworkIP)\\r\\n | summarize make_list(NetworkIP); \\r\\n SalesforceServiceCloud\\r\\n | where EventType == 'Login'\\r\\n | distinct User,ClientIp\\r\\n | where ClientIp in (malicious_ips)\\r\\n | project UserName = User, MaliciousIP = ClientIp\\r\\n\",\"size\":1,\"title\":\"Malicious IP- User Login\",\"noDataMessage\":\"No Malicious IP found\",\"timeBrushParameterName\":\"TimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaliciousIP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}]},\"graphSettings\":{\"type\":0},\"chartSettings\":{\"showMetrics\":false}},\"customWidth\":\"30\",\"name\":\"query - 23\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAS'\\r\\n| project UserID = UserId,DerivedUSerID = UserIdDerived,EventType = EventType, IPAddress = ClientIp, LoginKey = LoginKey, OrgID = OrganizationId, RequestID = RequestId, SessionKey = SessionKey\\r\\n| limit 10\",\"size\":0,\"title\":\"User Activity- LoginAS(Top 10)\",\"noDataMessage\":\"No user impersonation found\",\"exportFieldName\":\"IPAddress\",\"exportParameterName\":\"RetIP\",\"exportDefaultValue\":\"all IP addresses\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"IPAddress\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalRecords\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"60\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAs'\\r\\n| where isnotempty(User)\\r\\n| summarize count() by User,UserIdDerived,ClientIp\\r\\n| project UserName = User,DerivedUSerID = UserIdDerived,IPAddress = ClientIp, count_\",\"size\":1,\"title\":\"User Impersonation from different IP Addresses\",\"color\":\"blue\",\"noDataMessage\":\"No user impersonation found\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"DerivedUSerID\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IPAddress\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"DerivedUSerID\",\"label\":\"Impersonated ID\"},{\"columnId\":\"IPAddress\",\"label\":\"IP Address\"},{\"columnId\":\"count_\",\"label\":\"Total Login\"}]},\"chartSettings\":{\"xAxis\":\"IPAddress\",\"yAxis\":[\"count_\"],\"showLegend\":true}},\"customWidth\":\"40\",\"name\":\"query - 24\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| project UserName= User,APIType= ApiType, Browser= BrowserType, CipherSuite =CipherSuite, IP =ClientIp, CPUTime=CpuTime, UserType = UserType\\r\\n| take 200\",\"size\":0,\"title\":\"User Successful Login Activity\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"60\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| where LoginStatus !has('LOGIN_NO_ERROR')\\r\\n| summarize count() by User, ClientIp\\r\\n| project UserName = User, IP = ClientIp, Count = count_\",\"size\":1,\"title\":\"User Unsuccessful Logins by IP\",\"noDataMessage\":\"No Unsucessful Login found\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"IP\",\"label\":\"IP Address\"},{\"columnId\":\"Count\",\"label\":\"Count\"}]},\"chartSettings\":{\"xAxis\":\"UserName\",\"yAxis\":[\"Count\"],\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"30\",\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Retrieval Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"API Usage\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| summarize count() by EventType\",\"size\":0,\"title\":\"Most fired events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":50,\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by IPAddress = ClientIp,Entity = EntityName\\r\\n| order by Entity\",\"size\":0,\"title\":\"Most accessed entities by IP Address\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"user_id_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"entity_name_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"client_ip_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Count\"}]}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"30%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by EntityName\",\"size\":0,\"title\":\"Most accessed Entities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"APIUsage\"}],\"fromTemplateId\":\"sentinel-SalesforceServiceCloudWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", - "version": "1.0", - "sourceId": "[variables('workspaceResourceId')]", - "category": "sentinel" + "description": "This query searches for successful user logins from different countries within 30min.", + "displayName": "User Sign in from different countries", + "enabled": false, + "query": "let threshold = 2;\nlet Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\n[@\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\"];\nlet UsersLocation = SalesforceServiceCloud\n| where EventType =~ 'Login' and LoginStatus=~'LOGIN_NO_ERROR'\n| project TimeGenerated, ClientIp, UserId, User, UserType ;\nUsersLocation\n| extend Dummy=1\n| summarize count() by Hour=bin(TimeGenerated,30m), ClientIp,User, Dummy\n| partition by Hour(\n lookup (Countrydb|extend Dummy=1) on Dummy\n | where ipv4_is_match(ClientIp, Network)\n )\n| summarize NumOfCountries = dcount(country_name) by User, Hour\n| where NumOfCountries >= threshold\n", + "queryFrequency": "PT30M", + "queryPeriod": "PT30M", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "SalesforceServiceCloud" + ], + "connectorId": "SalesforceServiceCloud" + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1078" + ], + "entityMappings": [ + { + "fieldMappings": [ + { + "identifier": "AadUserId", + "columnName": "User" + } + ], + "entityType": "Account" + } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId3'),'/'))))]", "properties": { - "description": "@{workbookKey=SalesforceServiceCloudWorkbook; logoFileName=salesforce_logo.svg; description=Sets the time name for analysis.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Salesforce Service Cloud; templateRelativePath=SalesforceServiceCloud.json; subtitle=; provider=Salesforce}.description", - "parentId": "[variables('workbookId1')]", - "contentId": "[variables('_workbookContentId1')]", - "kind": "Workbook", - "version": "[variables('workbookVersion1')]", + "description": "Salesforce Service Cloud Analytics Rule 3", + "parentId": "[variables('analyticRuleId3')]", + "contentId": "[variables('_analyticRulecontentId3')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion3')]", "source": { "kind": "Solution", "name": "Salesforce Service Cloud", @@ -992,34 +1013,39 @@ "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com/" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "contentId": "SalesforceServiceCloud", - "kind": "DataType" - }, - { - "contentId": "SalesforceServiceCloud_CL", - "kind": "DataConnector" - } - ] } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId3')]", + "contentKind": "AnalyticsRule", + "displayName": "User Sign in from different countries", + "contentProductId": "[variables('_analyticRulecontentProductId3')]", + "id": "[variables('_analyticRulecontentProductId3')]", + "version": "[variables('analyticRuleVersion3')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.4", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "Salesforce Service Cloud", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Salesforce Service Cloud solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor HTTP Data Collector API

    \n
    2. \n

  2. Azure Functions.

    \n
    3. \n
\n

Data Connectors: 1, Parsers: 1, Workbooks: 1, Analytic Rules: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { @@ -1040,21 +1066,6 @@ "dependencies": { "operator": "AND", "criteria": [ - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId1')]", - "version": "[variables('analyticRuleVersion1')]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId2')]", - "version": "[variables('analyticRuleVersion2')]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId3')]", - "version": "[variables('analyticRuleVersion3')]" - }, { "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentId1')]", @@ -1069,6 +1080,21 @@ "kind": "Workbook", "contentId": "[variables('_workbookContentId1')]", "version": "[variables('workbookVersion1')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId1')]", + "version": "[variables('analyticRuleVersion1')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId2')]", + "version": "[variables('analyticRuleVersion2')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId3')]", + "version": "[variables('analyticRuleVersion3')]" } ] }, diff --git a/Solutions/Salesforce Service Cloud/Parsers/SalesforceServiceCloud.txt b/Solutions/Salesforce Service Cloud/Parsers/SalesforceServiceCloud.txt deleted file mode 100644 index 36527634a05..00000000000 --- a/Solutions/Salesforce Service Cloud/Parsers/SalesforceServiceCloud.txt +++ /dev/null @@ -1,218 +0,0 @@ -SalesforceServiceCloud_CL -| extend - RequestSize=column_ifexists('request_size_s',''), - ExecTime=column_ifexists('exec_time_s',''), - Action=column_ifexists('action_s',''), - PlatformType=column_ifexists('platform_type_s',''), - OsName=column_ifexists('os_name_s',''), - OsVersion=column_ifexists('os_version_s',''), - Timestamp=column_ifexists('timestamp_s',''), - StatusCode=column_ifexists('status_code_s',''), - EventType=column_ifexists('event_type_s',''), - ReferrerUri=column_ifexists('referrer_uri_s',''), - UserAgent=column_ifexists('user_agent_s',''), - BrowserType=column_ifexists('browser_type_s',''), - Time=column_ifexists('time_s',''), - ResponseSize=column_ifexists('response_size_s',''), - DeviceId=column_ifexists('device_id_s',''), - DeviceModel=column_ifexists('device_model_s',''), - SourceIp=column_ifexists('source_ip_s',''), - ClientIp=column_ifexists('client_ip_s',''), - Success=column_ifexists('success_s',''), - Uri=column_ifexists('uri_s',''), - Url=column_ifexists('url_s',''), - ClientName=column_ifexists('client_name_s',''), - UserType=column_ifexists('user_type_s',''), - UserInitiatedLogout=column_ifexists('user_initiated_logout_s',''), - UserIdDerived=column_ifexists('user_id_derived_s',''), - UserId=column_ifexists('user_id_s',''), - UserEmail=column_ifexists('user_email_s',''), - User=column_ifexists('user_name_s',''), - UriIdDerived=column_ifexists('uri_id_derived_s',''), - UiEventType=column_ifexists('ui_event_type_s',''), - UiEventTimestamp=column_ifexists('ui_event_timestamp_s',''), - UiEventSource=column_ifexists('ui_event_source_s',''), - UiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''), - UiEventId=column_ifexists('ui_event_id_s',''), - TlsProtocol=column_ifexists('tls_protocol_s',''), - TimestampDerived=column_ifexists('timestamp_derived_t',''), - TargetUiElement=column_ifexists('target_ui_element_s',''), - Sort=column_ifexists('sort_s',''), - SessionType=column_ifexists('session_type_s',''), - SessionLevel=column_ifexists('session_level_s',''), - SessionKey=column_ifexists('session_key_s',''), - SearchQuery=column_ifexists('search_query_s',''), - SdkVersion=column_ifexists('sdk_version_s',''), - SdkAppVersion=column_ifexists('sdk_app_version_s',''), - SdkAppType=column_ifexists('sdk_app_type_s',''), - RunTime=column_ifexists('run_time_s',''), - RowsProcessed=column_ifexists('rows_processed_s',''), - RowCount=column_ifexists('row_count_s',''), - ResolutionType=column_ifexists('resolution_type_s',''), - RequestStatus=column_ifexists('request_status_s',''), - RequestId=column_ifexists('request_id_s',''), - ReportIdDerived=column_ifexists('report_id_derived_s',''), - ReportId=column_ifexists('report_id_s',''), - RenderingType=column_ifexists('rendering_type_s',''), - RelatedList=column_ifexists('related_list_s',''), - RecordType=column_ifexists('record_type_s',''), - RecordId=column_ifexists('record_id_s',''), - Quiddity=column_ifexists('quiddity_s',''), - QueryId=column_ifexists('query_id_s',''), - PrevpageUrl=column_ifexists('prevpage_url_s',''), - PrevpageEntityType=column_ifexists('prevpage_entity_type_s',''), - PrevpageEntityId=column_ifexists('prevpage_entity_id_s',''), - PrevpageContext=column_ifexists('prevpage_context_s',''), - PrevpageAppName=column_ifexists('prevpage_app_name_s',''), - PrefixesSearched=column_ifexists('prefixes_searched_s',''), - ParentUiElement=column_ifexists('parent_ui_element_s',''), - PageUrl=column_ifexists('page_url_s',''), - PageStartTime=column_ifexists('page_start_time_s',''), - PageEntityType=column_ifexists('page_entity_type_s',''), - PageEntityId=column_ifexists('page_entity_id_s',''), - PageContext=column_ifexists('page_context_s',''), - PageAppName=column_ifexists('page_app_name_s',''), - Origin=column_ifexists('origin_s',''), - OrganizationId=column_ifexists('organization_id_s',''), - NumResults=column_ifexists('num_results_s',''), - NumberSoqlQueries=column_ifexists('number_soql_queries_s',''), - NumberFields=column_ifexists('number_fields_s',''), - NumberExceptionFilters=column_ifexists('number_exception_filters_s',''), - NumberColumns=column_ifexists('number_columns_s',''), - NumberBuckets=column_ifexists('number_buckets_s',''), - MethodName=column_ifexists('method_name_s',''), - Method=column_ifexists('method_s',''), - MediaType=column_ifexists('media_type_s',''), - LoginStatus=column_ifexists('login_status_s',''), - LoginKey=column_ifexists('login_key_s',''), - HttpMethod=column_ifexists('http_method_s',''), - GrandparentUiElement=column_ifexists('grandparent_ui_element_s',''), - EntryPoint=column_ifexists('entry_point_s',''), - EntityName=column_ifexists('entity_name_s',''), - Entity=column_ifexists('entity_s',''), - EffectivePageTime=column_ifexists('effective_page_time_s',''), - Duration=column_ifexists('duration_s',''), - DisplayType=column_ifexists('display_type_s',''), - DeviceSessionId=column_ifexists('device_session_id_s',''), - DevicePlatform=column_ifexists('device_platform_s',''), - DbTotalTime=column_ifexists('db_total_time_s',''), - DbCpuTime=column_ifexists('db_cpu_time_s',''), - DbBlocks=column_ifexists('db_blocks_s',''), - CpuTime=column_ifexists('cpu_time_s',''), - ConnectionType=column_ifexists('connection_type_s',''), - ComponentName=column_ifexists('component_name_s',''), - ClientVersion=column_ifexists('client_version_s',''), - ClientId=column_ifexists('client_id_s',''), - CipherSuite=column_ifexists('cipher_suite_s',''), - CalloutTime=column_ifexists('callout_time_s',''), - BrowserVersion=column_ifexists('browser_version_s',''), - BrowserName=column_ifexists('browser_name_s',''), - AverageRowSize=column_ifexists('average_row_size_s',''), - AppType=column_ifexists('app_type_s',''), - AppName=column_ifexists('app_name_s',''), - ApiVersion=column_ifexists('api_version_s',''), - ApiType=column_ifexists('api_type_s',''), - ArticleVersionId=column_ifexists('article_version_id_s',''), - ArticleVersion=column_ifexists('article_version_s',''), - ArticleStatus=column_ifexists('article_status_s',''), - ArticleId=column_ifexists('article_id_s',''), - AnalyticsMode=column_ifexists('analytics_mode_s',''), - BatchId=column_ifexists('batch_id_s',''), - ClickedRecordId=column_ifexists('clicked_record_id_s',''), - ClassName=column_ifexists('class_name_s',''), - ComponentIdDerived=column_ifexists('component_id_derived_s',''), - ComponentId=column_ifexists('component_id_s',''), - ControllerType=column_ifexists('controller_type_s',''), - Context=column_ifexists('context_s',''), - ConsoleIdDerived=column_ifexists('console_id_derived_s',''), - ConsoleId=column_ifexists('console_id_s',''), - ClientInfo=column_ifexists('client_info_s',''), - DstBytes=column_ifexists('request_size_s',''), - DstUser=column_ifexists('delegated_user_name_s',''), - DstUserSid=column_ifexists('delegated_user_id_s',''), - DstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''), - Data=column_ifexists('data_s',''), - DashboardType=column_ifexists('dashboard_type_s',''), - DashboardIdDerived=column_ifexists('dashboard_id_derived_s',''), - DashboardId=column_ifexists('dashboard_id_s',''), - DashboardComponentId=column_ifexists('dashboard_component_id_s',''), - DvcAction=column_ifexists('action_s',''), - DvcOS=column_ifexists('platform_type_s',''), - DvcOSName=column_ifexists('os_name_s',''), - DvcOSVersion=column_ifexists('os_version_s',''), - DeliveryLocation=column_ifexists('delivery_location_s',''), - DeliveryId=column_ifexists('delivery_id_s',''), - DocumentIdDerived=column_ifexists('document_id_derived_s',''), - DocumentId=column_ifexists('document_id_s',''), - EntityType=column_ifexists('entity_type_s',''), - EntityId=column_ifexists('entity_id_s',''), - FileType=column_ifexists('file_type_s',''), - FilePreviewType=column_ifexists('file_preview_type_s',''), - ExceptionType=column_ifexists('exception_type_s',''), - ExceptionMessage=column_ifexists('exception_message_s',''), - Ept=column_ifexists('ept_s',''), - EventCount=column_ifexists('number_of_records_s',''), - EventEndTime=column_ifexists('timestamp_s',''), - EventResult=column_ifexists('status_code_s',''), - FileSize=column_ifexists('size_bytes_s',''), - HttpReferrerOriginal=column_ifexists('referrer_uri_s',''), - HttpUserAgentOriginal=column_ifexists('user_agent_s',''), - HttpUserAgent=column_ifexists('browser_type_s',''), - LogGroupId=column_ifexists('log_group_id_s',''), - LimitUsagePercent=column_ifexists('limit_usage_percent_s',''), - LicenseContext=column_ifexists('license_context_s',''), - LastVersion=column_ifexists('last_version_s',''), - Language=column_ifexists('language_s',''), - JobId=column_ifexists('job_id_s',''), - IsSuccess=column_ifexists('is_success_s',''), - IsSecure=column_ifexists('is_secure_s',''), - IsScheduled=column_ifexists('is_scheduled_s',''), - IsNew=column_ifexists('is_new_s',''), - IsMobile=column_ifexists('is_mobile_s',''), - IsLongRunningRequest=column_ifexists('is_long_running_request_s',''), - IsGuest=column_ifexists('is_guest_s',''), - IsFirstRequest=column_ifexists('is_first_request_s',''), - IsError=column_ifexists('is_error_s',''), - IsApi=column_ifexists('is_api_s',''), - IsAjaxRequest=column_ifexists('is_ajax_request_s',''), - ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''), - HttpHeaders=column_ifexists('http_headers_s',''), - NetworkDuration=column_ifexists('time_s',''), - Name=column_ifexists('name_s',''), - NumberFailures=column_ifexists('number_failures_s',''), - NumClicks=column_ifexists('num_clicks_s',''), - OperationType=column_ifexists('operation_type_s',''), - NumSessions=column_ifexists('num_sessions_s',''), - PageName=column_ifexists('page_name_s',''), - Query=column_ifexists('query_s',''), - RequestType=column_ifexists('request_type_s',''), - ReportDescription=column_ifexists('report_description_s',''), - ReopenCount=column_ifexists('reopen_count_s',''), - RelatedEntityId=column_ifexists('related_entity_id_s',''), - RecordIdDerived=column_ifexists('record_id_derived_s',''), - ReadTime=column_ifexists('read_time_s',''), - Rank=column_ifexists('rank_s',''), - SrcBytes=column_ifexists('response_size_s',''), - SrcDvcId=column_ifexists('device_id_s',''), - SrcDvcModelName=column_ifexists('device_model_s',''), - SrcIpAddr=column_ifexists('source_ip_s',''), - SrcNatIpAddr=column_ifexists('client_ip_s',''), - SessionId=column_ifexists('session_id_s',''), - SiteId=column_ifexists('site_id_s',''), - SharingPermission=column_ifexists('sharing_permission_s',''), - SharingOperation=column_ifexists('sharing_operation_s',''), - SharedWithEntityId=column_ifexists('shared_with_entity_id_s',''), - UrlOriginal=column_ifexists('url_s',''), - WaveTimestamp=column_ifexists('wave_timestamp_s',''), - WaveSessionId=column_ifexists('wave_session_id_g',''), - ViewStateSize=column_ifexists('view_state_size_s',''), - VersionIdDerived=column_ifexists('version_id_derived_s',''), - VersionId=column_ifexists('version_id_s',''), - TriggerType=column_ifexists('trigger_type_s',''), - TriggerName=column_ifexists('trigger_name_s',''), - TriggerId=column_ifexists('trigger_id_s',''), - TransactionType=column_ifexists('transaction_type_s',''), - TotalTime=column_ifexists('total_time_s',''), - TabId=column_ifexists('tab_id_s',''), - StackTrace=column_ifexists('stack_trace_s','') -| project-away *_s \ No newline at end of file diff --git a/Solutions/Salesforce Service Cloud/ReleaseNotes.md b/Solutions/Salesforce Service Cloud/ReleaseNotes.md new file mode 100644 index 00000000000..6c1f40e5e37 --- /dev/null +++ b/Solutions/Salesforce Service Cloud/ReleaseNotes.md @@ -0,0 +1,4 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------| +| 3.0.0 | 05-09-2023 | Manual deployment instructions updated for **Data Connector** | + diff --git a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneAttackDiscoveryDetectionRisks.yaml b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneAttackDiscoveryDetectionRisks.yaml index 915bd1b4995..c8f882aa86a 100644 --- a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneAttackDiscoveryDetectionRisks.yaml +++ b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneAttackDiscoveryDetectionRisks.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -29,5 +32,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: AccountCustomEntity -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandLineSuspiciousRequests.yaml b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandLineSuspiciousRequests.yaml index 8e796ae4a87..b9167b7ba37 100644 --- a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandLineSuspiciousRequests.yaml +++ b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandLineSuspiciousRequests.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -30,5 +33,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: AccountCustomEntity -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandsInRequest.yaml b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandsInRequest.yaml index abcedf6f0be..ea63cca3155 100644 --- a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandsInRequest.yaml +++ b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandsInRequest.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -27,5 +30,5 @@ entityMappings: fieldMappings: - identifier: Url columnName: UrlCustomEntity -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneDvcAccessPermissionWasChanged.yaml b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneDvcAccessPermissionWasChanged.yaml index 6495f7de254..7ae5bd1488b 100644 --- a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneDvcAccessPermissionWasChanged.yaml +++ b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneDvcAccessPermissionWasChanged.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -42,5 +45,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: AccountCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled diff --git a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneInboundRemoteAccess.yaml b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneInboundRemoteAccess.yaml index 54fd4a5001e..c6e1dc3c8a5 100644 --- a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneInboundRemoteAccess.yaml +++ b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneInboundRemoteAccess.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -31,5 +34,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: AccountCustomEntity -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml index ce846544659..fce5f9c224d 100644 --- a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml +++ b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -29,5 +32,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOnePossibleExploitOrExecuteOperation.yaml b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOnePossibleExploitOrExecuteOperation.yaml index 78803f0d511..4dd6755b05b 100644 --- a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOnePossibleExploitOrExecuteOperation.yaml +++ b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOnePossibleExploitOrExecuteOperation.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -32,5 +35,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: AccountCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled diff --git a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneRiskCnCEvents.yaml b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneRiskCnCEvents.yaml index ed17b2d9d75..d019c9cb462 100644 --- a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneRiskCnCEvents.yaml +++ b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneRiskCnCEvents.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -29,5 +32,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: AccountCustomEntity -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneSpywareWithFailedResponse.yaml b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneSpywareWithFailedResponse.yaml index d9a09de7778..2f093d7beec 100644 --- a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneSpywareWithFailedResponse.yaml +++ b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneSpywareWithFailedResponse.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -30,5 +33,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: AccountCustomEntity -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneSuspiciousConnections.yaml b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneSuspiciousConnections.yaml index 19916ee2c25..949e1aad44a 100644 --- a/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneSuspiciousConnections.yaml +++ b/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneSuspiciousConnections.yaml @@ -8,6 +8,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -31,5 +34,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: AccountCustomEntity -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Trend Micro Apex One/Data Connectors/TrendMicro_ApexOne.json b/Solutions/Trend Micro Apex One/Data Connectors/TrendMicro_ApexOne.json index 11fd4fe3f00..bb926294e58 100644 --- a/Solutions/Trend Micro Apex One/Data Connectors/TrendMicro_ApexOne.json +++ b/Solutions/Trend Micro Apex One/Data Connectors/TrendMicro_ApexOne.json @@ -1,6 +1,6 @@ { "id": "TrendMicroApexOne", - "title": "Trend Micro Apex One", + "title": "[Deprecated] Trend Micro Apex One via Legacy Agent", "publisher": "Trend Micro", "descriptionMarkdown": "The [Trend Micro Apex One](https://www.trendmicro.com/en_us/business/products/user-protection/sps/endpoint.html) data connector provides the capability to ingest [Trend Micro Apex One events](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/appendices/syslog-mapping-cef.aspx) into Microsoft Sentinel. Refer to [Trend Micro Apex Central](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/preface_001.aspx) for more information.", "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected [**TMApexOneEvent**](https://aka.ms/sentinel-TMApexOneEvent-parser) which is deployed with the Microsoft Sentinel Solution.", diff --git a/Solutions/Trend Micro Apex One/Data Connectors/template_TrendMicro_ApexOneAMA.json b/Solutions/Trend Micro Apex One/Data Connectors/template_TrendMicro_ApexOneAMA.json new file mode 100644 index 00000000000..375127fbba0 --- /dev/null +++ b/Solutions/Trend Micro Apex One/Data Connectors/template_TrendMicro_ApexOneAMA.json @@ -0,0 +1,118 @@ +{ + "id": "TrendMicroApexOneAma", + "title": "[Recommended] Trend Micro Apex One via AMA", + "publisher": "Trend Micro", + "descriptionMarkdown": "The [Trend Micro Apex One](https://www.trendmicro.com/en_us/business/products/user-protection/sps/endpoint.html) data connector provides the capability to ingest [Trend Micro Apex One events](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/appendices/syslog-mapping-cef.aspx) into Microsoft Sentinel. Refer to [Trend Micro Apex Central](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/preface_001.aspx) for more information.", + "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected [**TMApexOneEvent**](https://aka.ms/sentinel-TMApexOneEvent-parser) which is deployed with the Microsoft Sentinel Solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "TrendMicroApexOne", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Trend Micro'\n |where DeviceProduct =~ 'Apex Central'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description" : "All logs", + "query": "\nTMApexOneEvent\n| sort by TimeGenerated" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (TrendMicroApexOne)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Trend Micro'\n |where DeviceProduct =~ 'Apex Central'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Trend Micro'\n |where DeviceProduct =~ 'Apex Central'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "title": "", + "description": ">This data connector depends on a parser based on a Kusto Function to work as expected [**TMApexOneEvent**](https://aka.ms/sentinel-TMApexOneEvent-parser) which is deployed with the Microsoft Sentinel Solution.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine", + "instructions": [ + ] + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "[Follow these steps](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/detections/logs_001/syslog-forwarding.aspx) to configure Apex Central sending alerts via syslog. While configuring, on step 6, select the log format **CEF**.", + "instructions": [ + ] + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + + + + { + "title": "2. Secure your machine ", + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)" + } + ] +} diff --git a/Solutions/Trend Micro Apex One/Data/Solution_Trend Micro Apex One.json b/Solutions/Trend Micro Apex One/Data/Solution_Trend Micro Apex One.json index 2dd0d03e0ed..b783819eda4 100644 --- a/Solutions/Trend Micro Apex One/Data/Solution_Trend Micro Apex One.json +++ b/Solutions/Trend Micro Apex One/Data/Solution_Trend Micro Apex One.json @@ -2,12 +2,13 @@ "Name": "Trend Micro Apex One", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [Trend Micro Apex One](https://www.trendmicro.com/business/products/user-protection/sps/endpoint.htmlhttps:/www.trendmicro.com/business/products/user-protection/sps/endpoint.html) solution for Microsoft Sentinel enables ingestion of [Trend Micro Apex One events](https://docs.trendmicro.com/enterprise/trend-micro-apex-central-2019-online-help/appendices/syslog-mapping-cef.aspx) into Microsoft Sentinel. Refer to [Trend Micro Apex Central](https://docs.trendmicro.com/enterprise/trend-micro-apex-central-2019-online-help/preface_001.aspx) for more information. \r\n \r\n **Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n a. [Agent-based log collection (CEF over Syslog) ](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)", + "Description": "The [Trend Micro Apex One](https://www.trendmicro.com/business/products/user-protection/sps/endpoint.htmlhttps:/www.trendmicro.com/business/products/user-protection/sps/endpoint.html) solution for Microsoft Sentinel enables ingestion of [Trend Micro Apex One events](https://docs.trendmicro.com/enterprise/trend-micro-apex-central-2019-online-help/appendices/syslog-mapping-cef.aspx) into Microsoft Sentinel. Refer to [Trend Micro Apex Central](https://docs.trendmicro.com/enterprise/trend-micro-apex-central-2019-online-help/preface_001.aspx) for more information. \n\r\n1. **Trend Micro Apex One via AMA** - This data connector helps in ingesting Trend Micro Apex One logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Trend Micro Apex One via Legacy Agent** - This data connector helps in ingesting Trend Micro Apex One logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Trend Micro Apex One via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", "Data Connectors": [ - "Data Connectors/TrendMicro_ApexOne.json" + "Data Connectors/TrendMicro_ApexOne.json", + "Data Connectors/template_TrendMicro_ApexOneAMA.json" ], "Parsers": [ - "Parsers/TMApexOneEvent.txt" + "Parsers/TMApexOneEvent.yaml" ], "Workbooks": [ "Workbooks/TrendMicroApexOne.json" diff --git a/Solutions/Trend Micro Apex One/Data/system_generated_metadata.json b/Solutions/Trend Micro Apex One/Data/system_generated_metadata.json new file mode 100644 index 00000000000..f2ddb6407f2 --- /dev/null +++ b/Solutions/Trend Micro Apex One/Data/system_generated_metadata.json @@ -0,0 +1,34 @@ +{ + "Name": "Trend Micro Apex One", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "The [Trend Micro Apex One](https://www.trendmicro.com/business/products/user-protection/sps/endpoint.htmlhttps:/www.trendmicro.com/business/products/user-protection/sps/endpoint.html) solution for Microsoft Sentinel enables ingestion of [Trend Micro Apex One events](https://docs.trendmicro.com/enterprise/trend-micro-apex-central-2019-online-help/appendices/syslog-mapping-cef.aspx) into Microsoft Sentinel. Refer to [Trend Micro Apex Central](https://docs.trendmicro.com/enterprise/trend-micro-apex-central-2019-online-help/preface_001.aspx) for more information. \n\r\n1. **Trend Micro Apex One via AMA** - This data connector helps in ingesting Trend Micro Apex One logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Trend Micro Apex One via Legacy Agent** - This data connector helps in ingesting Trend Micro Apex One logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Trend Micro Apex One via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Trend Micro Apex One", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false, + "Version": "3.0.0", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-trendmicroapexone", + "providers": [ + "TrendMicro" + ], + "categories": { + "domains": [ + "Security - Threat Protection" + ] + }, + "firstPublishDate": "2021-07-06", + "lastPublishDate": "2022-03-24", + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "Data Connectors": "[\n \"Data Connectors/TrendMicro_ApexOne.json\",\n \"Data Connectors/template_TrendMicro_ApexOneAMA.json\"\n]", + "Parsers": "[\n \"TMApexOneEvent.txt\"\n]", + "Workbooks": "[\n \"Workbooks/TrendMicroApexOne.json\"\n]", + "Analytic Rules": "[\n \"TMApexOneAttackDiscoveryDetectionRisks.yaml\",\n \"TMApexOneCommandLineSuspiciousRequests.yaml\",\n \"TMApexOneCommandsInRequest.yaml\",\n \"TMApexOneDvcAccessPermissionWasChanged.yaml\",\n \"TMApexOneInboundRemoteAccess.yaml\",\n \"TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml\",\n \"TMApexOnePossibleExploitOrExecuteOperation.yaml\",\n \"TMApexOneRiskCnCEvents.yaml\",\n \"TMApexOneSpywareWithFailedResponse.yaml\",\n \"TMApexOneSuspiciousConnections.yaml\"\n]", + "Hunting Queries": "[\n \"TMApexOneBehaviorMonitoringTranslatedAction.yaml\",\n \"TMApexOneBehaviorMonitoringTranslatedOperation.yaml\",\n \"TMApexOneBehaviorMonitoringTriggeredPolicy.yaml\",\n \"TMApexOneBehaviorMonitoringTypesOfEvent.yaml\",\n \"TMApexOneChannelType.yaml\",\n \"TMApexOneDataLossPreventionAction.yaml\",\n \"TMApexOneRareAppProtocolByIP.yaml\",\n \"TMApexOneSpywareDetection.yaml\",\n \"TMApexOneSuspiciousFiles.yaml\",\n \"TMApexOneTopSources.yaml\"\n]" +} diff --git a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTranslatedAction.yaml b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTranslatedAction.yaml index 0a281615745..651177aea5f 100644 --- a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTranslatedAction.yaml +++ b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTranslatedAction.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent tactics: - Execution relevantTechniques: diff --git a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTranslatedOperation.yaml b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTranslatedOperation.yaml index a80218ffc4f..bf248a910ba 100644 --- a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTranslatedOperation.yaml +++ b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTranslatedOperation.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent tactics: - Execution relevantTechniques: diff --git a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTriggeredPolicy.yaml b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTriggeredPolicy.yaml index 16f0dac96f8..dd6825d0292 100644 --- a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTriggeredPolicy.yaml +++ b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTriggeredPolicy.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent tactics: - Execution relevantTechniques: diff --git a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTypesOfEvent.yaml b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTypesOfEvent.yaml index dda2e4c76eb..a6dc53e85a7 100644 --- a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTypesOfEvent.yaml +++ b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTypesOfEvent.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent tactics: - Privilege Escalation - Persistence diff --git a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneChannelType.yaml b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneChannelType.yaml index 065e4e2b227..8afccce98ea 100644 --- a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneChannelType.yaml +++ b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneChannelType.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent tactics: - CommandandControl relevantTechniques: diff --git a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneDataLossPreventionAction.yaml b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneDataLossPreventionAction.yaml index ab894e13254..c04718c33f0 100644 --- a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneDataLossPreventionAction.yaml +++ b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneDataLossPreventionAction.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent tactics: - Collection relevantTechniques: diff --git a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneRareAppProtocolByIP.yaml b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneRareAppProtocolByIP.yaml index 95d085848b3..ac8baab99b9 100644 --- a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneRareAppProtocolByIP.yaml +++ b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneRareAppProtocolByIP.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneSpywareDetection.yaml b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneSpywareDetection.yaml index 9f95ca89d52..e07985ea22c 100644 --- a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneSpywareDetection.yaml +++ b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneSpywareDetection.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent tactics: - Execution relevantTechniques: diff --git a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneSuspiciousFiles.yaml b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneSuspiciousFiles.yaml index 4185b05a0d9..5d4d8d9106b 100644 --- a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneSuspiciousFiles.yaml +++ b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneSuspiciousFiles.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent tactics: - Execution relevantTechniques: diff --git a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneTopSources.yaml b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneTopSources.yaml index 809150881cb..1b64e59f4f0 100644 --- a/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneTopSources.yaml +++ b/Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneTopSources.yaml @@ -7,6 +7,9 @@ requiredDataConnectors: - connectorId: TrendMicroApexOne dataTypes: - TMApexOneEvent + - connectorId: TrendMicroApexOneAma + dataTypes: + - TMApexOneEvent tactics: - Execution - InitialAccess diff --git a/Solutions/Trend Micro Apex One/Package/3.0.0.zip b/Solutions/Trend Micro Apex One/Package/3.0.0.zip new file mode 100644 index 00000000000..494c7fda49a Binary files /dev/null and b/Solutions/Trend Micro Apex One/Package/3.0.0.zip differ diff --git a/Solutions/Trend Micro Apex One/Package/createUiDefinition.json b/Solutions/Trend Micro Apex One/Package/createUiDefinition.json index a03fdbe3e4f..7a5b9ba1ada 100644 --- a/Solutions/Trend Micro Apex One/Package/createUiDefinition.json +++ b/Solutions/Trend Micro Apex One/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Trend Micro Apex One](https://www.trendmicro.com/business/products/user-protection/sps/endpoint.htmlhttps:/www.trendmicro.com/business/products/user-protection/sps/endpoint.html) solution for Microsoft Sentinel enables ingestion of [Trend Micro Apex One events](https://docs.trendmicro.com/enterprise/trend-micro-apex-central-2019-online-help/appendices/syslog-mapping-cef.aspx) into Microsoft Sentinel. Refer to [Trend Micro Apex Central](https://docs.trendmicro.com/enterprise/trend-micro-apex-central-2019-online-help/preface_001.aspx) for more information. \r\n \r\n **Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n a. [Agent-based log collection (CEF over Syslog) ](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Trend%20Micro%20Apex%20One/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Trend Micro Apex One](https://www.trendmicro.com/business/products/user-protection/sps/endpoint.htmlhttps:/www.trendmicro.com/business/products/user-protection/sps/endpoint.html) solution for Microsoft Sentinel enables ingestion of [Trend Micro Apex One events](https://docs.trendmicro.com/enterprise/trend-micro-apex-central-2019-online-help/appendices/syslog-mapping-cef.aspx) into Microsoft Sentinel. Refer to [Trend Micro Apex Central](https://docs.trendmicro.com/enterprise/trend-micro-apex-central-2019-online-help/preface_001.aspx) for more information. \n\r\n1. **Trend Micro Apex One via AMA** - This data connector helps in ingesting Trend Micro Apex One logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Trend Micro Apex One via Legacy Agent** - This data connector helps in ingesting Trend Micro Apex One logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Trend Micro Apex One via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -63,6 +63,7 @@ "text": "The Trend Micro Apex One connector allows you to easily connect your Trend Micro Apex One events logs with Microsoft Sentinel. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, + { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", @@ -107,6 +108,20 @@ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data" } } + }, + { + "name": "workbook1", + "type": "Microsoft.Common.Section", + "label": "Trend Micro Apex One", + "elements": [ + { + "name": "workbook1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Sets the time name for analysis." + } + } + ] } ] }, @@ -309,7 +324,7 @@ "name": "huntingquery1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Shows behavior monitoring actions taken for files. It depends on the TrendMicroApexOne data connector and TMApexOneEvent data type and TrendMicroApexOne parser." + "text": "Shows behavior monitoring actions taken for files. This hunting query depends on TrendMicroApexOne data connector (TMApexOneEvent Parser or Table)" } } ] @@ -323,7 +338,7 @@ "name": "huntingquery2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Shows behavior monitoring operations by users. It depends on the TrendMicroApexOne data connector and TMApexOneEvent data type and TrendMicroApexOne parser." + "text": "Shows behavior monitoring operations by users. This hunting query depends on TrendMicroApexOne data connector (TMApexOneEvent Parser or Table)" } } ] @@ -337,7 +352,7 @@ "name": "huntingquery3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Shows behavior monitoring triggered policy by command line. It depends on the TrendMicroApexOne data connector and TMApexOneEvent data type and TrendMicroApexOne parser." + "text": "Shows behavior monitoring triggered policy by command line. This hunting query depends on TrendMicroApexOne data connector (TMApexOneEvent Parser or Table)" } } ] @@ -351,7 +366,7 @@ "name": "huntingquery4-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Shows behavior monitoring event types. It depends on the TrendMicroApexOne data connector and TMApexOneEvent data type and TrendMicroApexOne parser." + "text": "Shows behavior monitoring event types. This hunting query depends on TrendMicroApexOne data connector (TMApexOneEvent Parser or Table)" } } ] @@ -365,7 +380,7 @@ "name": "huntingquery5-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Shows channel type. It depends on the TrendMicroApexOne data connector and TMApexOneEvent data type and TrendMicroApexOne parser." + "text": "Shows channel type. This hunting query depends on TrendMicroApexOne data connector (TMApexOneEvent Parser or Table)" } } ] @@ -379,7 +394,7 @@ "name": "huntingquery6-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Shows data loss prevention action by IP address. It depends on the TrendMicroApexOne data connector and TMApexOneEvent data type and TrendMicroApexOne parser." + "text": "Shows data loss prevention action by IP address. This hunting query depends on TrendMicroApexOne data connector (TMApexOneEvent Parser or Table)" } } ] @@ -393,7 +408,7 @@ "name": "huntingquery7-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches rare application protocols by Ip address. It depends on the TrendMicroApexOne data connector and TMApexOneEvent data type and TrendMicroApexOne parser." + "text": "Query searches rare application protocols by Ip address. This hunting query depends on TrendMicroApexOne data connector (TMApexOneEvent Parser or Table)" } } ] @@ -407,7 +422,7 @@ "name": "huntingquery8-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches spyware detection events. It depends on the TrendMicroApexOne data connector and TMApexOneEvent data type and TrendMicroApexOne parser." + "text": "Query searches spyware detection events. This hunting query depends on TrendMicroApexOne data connector (TMApexOneEvent Parser or Table)" } } ] @@ -421,7 +436,7 @@ "name": "huntingquery9-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches suspicious files events. It depends on the TrendMicroApexOne data connector and TMApexOneEvent data type and TrendMicroApexOne parser." + "text": "Query searches suspicious files events. This hunting query depends on TrendMicroApexOne data connector (TMApexOneEvent Parser or Table)" } } ] @@ -435,7 +450,7 @@ "name": "huntingquery10-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query shows list of top sources with alerts. It depends on the TrendMicroApexOne data connector and TMApexOneEvent data type and TrendMicroApexOne parser." + "text": "Query shows list of top sources with alerts. This hunting query depends on TrendMicroApexOne data connector (TMApexOneEvent Parser or Table)" } } ] diff --git a/Solutions/Trend Micro Apex One/Package/mainTemplate.json b/Solutions/Trend Micro Apex One/Package/mainTemplate.json index f4584a96e5e..d1557a5c99a 100644 --- a/Solutions/Trend Micro Apex One/Package/mainTemplate.json +++ b/Solutions/Trend Micro Apex One/Package/mainTemplate.json @@ -38,162 +38,179 @@ } }, "variables": { - "solutionId": "azuresentinel.azure-sentinel-solution-trendmicroapexone", - "_solutionId": "[variables('solutionId')]", "email": "support@microsoft.com", "_email": "[variables('email')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_solutionName": "Trend Micro Apex One", + "_solutionVersion": "3.0.0", + "solutionId": "azuresentinel.azure-sentinel-solution-trendmicroapexone", + "_solutionId": "[variables('solutionId')]", "uiConfigId1": "TrendMicroApexOne", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "TrendMicroApexOne", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", - "parserVersion1": "1.0.0", - "parserContentId1": "TMApexOneEvent-Parser", - "_parserContentId1": "[variables('parserContentId1')]", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "uiConfigId2": "TrendMicroApexOneAma", + "_uiConfigId2": "[variables('uiConfigId2')]", + "dataConnectorContentId2": "TrendMicroApexOneAma", + "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", + "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "_dataConnectorId2": "[variables('dataConnectorId2')]", + "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", + "dataConnectorVersion2": "1.0.0", + "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "parserName1": "Trend Micro Apex One Data Parser", "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1')))]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", + "parserVersion1": "1.0.0", + "parserContentId1": "TMApexOneEvent-Parser", + "_parserContentId1": "[variables('parserContentId1')]", + "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", "workbookVersion1": "1.0.0", "workbookContentId1": "TrendMicroApexOneWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", - "analyticRuleVersion1": "1.0.0", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "analyticRuleVersion1": "1.0.1", "analyticRulecontentId1": "7a3193b8-67b7-11ec-90d6-0242ac120003", "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1')))]", - "analyticRuleVersion2": "1.0.0", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId1'),'-', variables('analyticRuleVersion1'))))]", + "analyticRuleVersion2": "1.0.1", "analyticRulecontentId2": "4d7199b2-67b8-11ec-90d6-0242ac120003", "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", - "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2')))]", - "analyticRuleVersion3": "1.0.0", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2'))))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId2'),'-', variables('analyticRuleVersion2'))))]", + "analyticRuleVersion3": "1.0.1", "analyticRulecontentId3": "4a9a5900-67b7-11ec-90d6-0242ac120003", "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", - "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3')))]", - "analyticRuleVersion4": "1.0.1", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3'))))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId3'),'-', variables('analyticRuleVersion3'))))]", + "analyticRuleVersion4": "1.0.2", "analyticRulecontentId4": "b463b952-67b8-11ec-90d6-0242ac120003", "_analyticRulecontentId4": "[variables('analyticRulecontentId4')]", "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId4'))]", - "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId4')))]", - "analyticRuleVersion5": "1.0.0", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId4'))))]", + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId4'),'-', variables('analyticRuleVersion4'))))]", + "analyticRuleVersion5": "1.0.1", "analyticRulecontentId5": "6303235a-ee70-42a4-b969-43e7b969b916", "_analyticRulecontentId5": "[variables('analyticRulecontentId5')]", "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId5'))]", - "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId5')))]", - "analyticRuleVersion6": "1.0.0", + "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId5'))))]", + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId5'),'-', variables('analyticRuleVersion5'))))]", + "analyticRuleVersion6": "1.0.1", "analyticRulecontentId6": "cd94e078-67b7-11ec-90d6-0242ac120003", "_analyticRulecontentId6": "[variables('analyticRulecontentId6')]", "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId6'))]", - "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId6')))]", - "analyticRuleVersion7": "1.0.2", + "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId6'))))]", + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId6'),'-', variables('analyticRuleVersion6'))))]", + "analyticRuleVersion7": "1.0.3", "analyticRulecontentId7": "e289d762-6cc2-11ec-90d6-0242ac120003", "_analyticRulecontentId7": "[variables('analyticRulecontentId7')]", "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId7'))]", - "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId7')))]", - "analyticRuleVersion8": "1.0.0", + "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId7'))))]", + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId7'),'-', variables('analyticRuleVersion7'))))]", + "analyticRuleVersion8": "1.0.1", "analyticRulecontentId8": "1a87cd10-67b7-11ec-90d6-0242ac120003", "_analyticRulecontentId8": "[variables('analyticRulecontentId8')]", "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId8'))]", - "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId8')))]", - "analyticRuleVersion9": "1.0.0", + "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId8'))))]", + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId8'),'-', variables('analyticRuleVersion8'))))]", + "analyticRuleVersion9": "1.0.1", "analyticRulecontentId9": "c92d9fe4-67b6-11ec-90d6-0242ac120003", "_analyticRulecontentId9": "[variables('analyticRulecontentId9')]", "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId9'))]", - "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId9')))]", - "analyticRuleVersion10": "1.0.0", + "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId9'))))]", + "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId9'),'-', variables('analyticRuleVersion9'))))]", + "analyticRuleVersion10": "1.0.1", "analyticRulecontentId10": "9e3dc038-67b7-11ec-90d6-0242ac120003", "_analyticRulecontentId10": "[variables('analyticRulecontentId10')]", "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId10'))]", - "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId10')))]", + "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId10'))))]", + "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId10'),'-', variables('analyticRuleVersion10'))))]", "huntingQueryVersion1": "1.0.0", "huntingQuerycontentId1": "96451e96-67b5-11ec-90d6-0242ac120003", "_huntingQuerycontentId1": "[variables('huntingQuerycontentId1')]", "huntingQueryId1": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId1'))]", - "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId1')))]", + "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId1'))))]", + "_huntingQuerycontentProductId1": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId1'),'-', variables('huntingQueryVersion1'))))]", "huntingQueryVersion2": "1.0.0", "huntingQuerycontentId2": "0caa3472-67b6-11ec-90d6-0242ac120003", "_huntingQuerycontentId2": "[variables('huntingQuerycontentId2')]", "huntingQueryId2": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId2'))]", - "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId2')))]", + "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId2'))))]", + "_huntingQuerycontentProductId2": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId2'),'-', variables('huntingQueryVersion2'))))]", "huntingQueryVersion3": "1.0.0", "huntingQuerycontentId3": "14a4a824-67b6-11ec-90d6-0242ac120003", "_huntingQuerycontentId3": "[variables('huntingQuerycontentId3')]", "huntingQueryId3": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId3'))]", - "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId3')))]", + "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId3'))))]", + "_huntingQuerycontentProductId3": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId3'),'-', variables('huntingQueryVersion3'))))]", "huntingQueryVersion4": "1.0.0", "huntingQuerycontentId4": "433ccdb0-67b6-11ec-90d6-0242ac120003", "_huntingQuerycontentId4": "[variables('huntingQuerycontentId4')]", "huntingQueryId4": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId4'))]", - "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId4')))]", + "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId4'))))]", + "_huntingQuerycontentProductId4": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId4'),'-', variables('huntingQueryVersion4'))))]", "huntingQueryVersion5": "1.0.0", "huntingQuerycontentId5": "40d8ad3e-67b4-11ec-90d6-0242ac120003", "_huntingQuerycontentId5": "[variables('huntingQuerycontentId5')]", "huntingQueryId5": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId5'))]", - "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId5')))]", + "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId5'))))]", + "_huntingQuerycontentProductId5": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId5'),'-', variables('huntingQueryVersion5'))))]", "huntingQueryVersion6": "1.0.0", "huntingQuerycontentId6": "6c7f9bfe-67b5-11ec-90d6-0242ac120003", "_huntingQuerycontentId6": "[variables('huntingQuerycontentId6')]", "huntingQueryId6": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId6'))]", - "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId6')))]", + "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId6'))))]", + "_huntingQuerycontentProductId6": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId6'),'-', variables('huntingQueryVersion6'))))]", "huntingQueryVersion7": "1.0.0", "huntingQuerycontentId7": "be89944e-4e75-4d0a-b2d6-ae757d22ed43", "_huntingQuerycontentId7": "[variables('huntingQuerycontentId7')]", "huntingQueryId7": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId7'))]", - "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId7')))]", + "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId7'))))]", + "_huntingQuerycontentProductId7": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId7'),'-', variables('huntingQueryVersion7'))))]", "huntingQueryVersion8": "1.0.0", "huntingQuerycontentId8": "506955be-648f-11ec-90d6-0242ac120003", "_huntingQuerycontentId8": "[variables('huntingQuerycontentId8')]", "huntingQueryId8": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId8'))]", - "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId8')))]", + "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId8'))))]", + "_huntingQuerycontentProductId8": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId8'),'-', variables('huntingQueryVersion8'))))]", "huntingQueryVersion9": "1.0.0", "huntingQuerycontentId9": "7bf0f260-61a0-11ec-90d6-0242ac120003", "_huntingQuerycontentId9": "[variables('huntingQuerycontentId9')]", "huntingQueryId9": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId9'))]", - "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId9')))]", + "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId9'))))]", + "_huntingQuerycontentProductId9": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId9'),'-', variables('huntingQueryVersion9'))))]", "huntingQueryVersion10": "1.0.0", "huntingQuerycontentId10": "8bb86556-67b4-11ec-90d6-0242ac120003", "_huntingQuerycontentId10": "[variables('huntingQuerycontentId10')]", "huntingQueryId10": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId10'))]", - "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId10')))]" + "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId10'))))]", + "_huntingQuerycontentProductId10": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId10'),'-', variables('huntingQueryVersion10'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "Trend Micro Apex One data connector with template", - "displayName": "Trend Micro Apex One template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Trend Micro Apex One data connector with template version 2.0.3", + "description": "Trend Micro Apex One data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -209,7 +226,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId1')]", - "title": "Trend Micro Apex One", + "title": "[Deprecated] Trend Micro Apex One via Legacy Agent", "publisher": "Trend Micro", "descriptionMarkdown": "The [Trend Micro Apex One](https://www.trendmicro.com/en_us/business/products/user-protection/sps/endpoint.html) data connector provides the capability to ingest [Trend Micro Apex One events](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/appendices/syslog-mapping-cef.aspx) into Microsoft Sentinel. Refer to [Trend Micro Apex Central](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/preface_001.aspx) for more information.", "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected [**TMApexOneEvent**](https://aka.ms/sentinel-TMApexOneEvent-parser) which is deployed with the Microsoft Sentinel Solution.", @@ -332,7 +349,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -357,12 +374,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "[Deprecated] Trend Micro Apex One via Legacy Agent", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -398,7 +426,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Trend Micro Apex One", + "title": "[Deprecated] Trend Micro Apex One via Legacy Agent", "publisher": "Trend Micro", "descriptionMarkdown": "The [Trend Micro Apex One](https://www.trendmicro.com/en_us/business/products/user-protection/sps/endpoint.html) data connector provides the capability to ingest [Trend Micro Apex One events](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/appendices/syslog-mapping-cef.aspx) into Microsoft Sentinel. Refer to [Trend Micro Apex Central](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/preface_001.aspx) for more information.", "graphQueries": [ @@ -521,33 +549,344 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('parserTemplateSpecName1')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "description": "TMApexOneEvent Data Parser with template", - "displayName": "TMApexOneEvent Data Parser template" + "description": "Trend Micro Apex One data connector with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion2')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId2')]", + "title": "[Recommended] Trend Micro Apex One via AMA", + "publisher": "Trend Micro", + "descriptionMarkdown": "The [Trend Micro Apex One](https://www.trendmicro.com/en_us/business/products/user-protection/sps/endpoint.html) data connector provides the capability to ingest [Trend Micro Apex One events](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/appendices/syslog-mapping-cef.aspx) into Microsoft Sentinel. Refer to [Trend Micro Apex Central](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/preface_001.aspx) for more information.", + "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected [**TMApexOneEvent**](https://aka.ms/sentinel-TMApexOneEvent-parser) which is deployed with the Microsoft Sentinel Solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "TrendMicroApexOne", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Trend Micro'\n |where DeviceProduct =~ 'Apex Central'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description": "All logs", + "query": "\nTMApexOneEvent\n| sort by TimeGenerated" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (TrendMicroApexOne)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Trend Micro'\n |where DeviceProduct =~ 'Apex Central'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Trend Micro'\n |where DeviceProduct =~ 'Apex Central'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "description": ">This data connector depends on a parser based on a Kusto Function to work as expected [**TMApexOneEvent**](https://aka.ms/sentinel-TMApexOneEvent-parser) which is deployed with the Microsoft Sentinel Solution.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "[Follow these steps](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/detections/logs_001/syslog-forwarding.aspx) to configure Apex Central sending alerts via syslog. While configuring, on step 6, select the log format **CEF**." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "Trend Micro Apex One", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId2')]", + "contentKind": "DataConnector", + "displayName": "[Recommended] Trend Micro Apex One via AMA", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", + "version": "[variables('dataConnectorVersion2')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('parserTemplateSpecName1'),'/',variables('parserVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId2')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "Trend Micro Apex One", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "[Recommended] Trend Micro Apex One via AMA", + "publisher": "Trend Micro", + "descriptionMarkdown": "The [Trend Micro Apex One](https://www.trendmicro.com/en_us/business/products/user-protection/sps/endpoint.html) data connector provides the capability to ingest [Trend Micro Apex One events](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/appendices/syslog-mapping-cef.aspx) into Microsoft Sentinel. Refer to [Trend Micro Apex Central](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/preface_001.aspx) for more information.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "TrendMicroApexOne", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Trend Micro'\n |where DeviceProduct =~ 'Apex Central'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (TrendMicroApexOne)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Trend Micro'\n |where DeviceProduct =~ 'Apex Central'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Trend Micro'\n |where DeviceProduct =~ 'Apex Central'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "All logs", + "query": "\nTMApexOneEvent\n| sort by TimeGenerated" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "description": ">This data connector depends on a parser based on a Kusto Function to work as expected [**TMApexOneEvent**](https://aka.ms/sentinel-TMApexOneEvent-parser) which is deployed with the Microsoft Sentinel Solution.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "[Follow these steps](https://docs.trendmicro.com/en-us/enterprise/trend-micro-apex-central-2019-online-help/detections/logs_001/syslog-forwarding.aspx) to configure Apex Central sending alerts via syslog. While configuring, on step 6, select the log format **CEF**." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ], + "id": "[variables('_uiConfigId2')]", + "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected [**TMApexOneEvent**](https://aka.ms/sentinel-TMApexOneEvent-parser) which is deployed with the Microsoft Sentinel Solution." + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('parserTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneEvent Data Parser with template version 2.0.3", + "description": "TMApexOneEvent Data Parser with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserVersion1')]", @@ -556,20 +895,21 @@ "resources": [ { "name": "[variables('_parserName1')]", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Trend Micro Apex One Data Parser", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "TMApexOneEvent", - "query": "\nCommonSecurityLog\r\n| where DeviceVendor == \"Trend Micro\"\r\n| where DeviceProduct == \"Apex Central\"\r\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\r\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\r\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3),\r\n ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID))\r\n| extend packed = pack (DeviceCustomNumber1Label, DeviceCustomNumber1,\r\n DeviceCustomNumber2Label, DeviceCustomNumber2,\r\n DeviceCustomString1Label, DeviceCustomString1,\r\n DeviceCustomString2Label, DeviceCustomString2,\r\n DeviceCustomString3Label, DeviceCustomString3,\r\n DeviceCustomString4Label, DeviceCustomString4,\r\n DeviceCustomString5Label, DeviceCustomString5,\r\n DeviceCustomString6Label, DeviceCustomString6,\r\n DeviceCustomDate1Label, DeviceCustomDate1,\r\n DeviceCustomDate2Label, DeviceCustomDate2)\r\n| evaluate bag_unpack(packed)\r\n| project-rename EventVendor=DeviceVendor,\r\n EventProduct=DeviceProduct,\r\n EventProductVersion=DeviceVersion,\r\n EventSubType=DeviceEventClassID,\r\n EventMessage=Activity,\r\n EventSeverity=LogSeverity,\r\n EventOriginalUid=DeviceExternalID,\r\n EventEndTime=ReceiptTime,\r\n DstDvcHostname=DestinationHostName,\r\n DstIpAddr=DestinationIP,\r\n DstUserName=DestinationUserName,\r\n DstPortNumber=DestinationPort,\r\n DstServiceName=DestinationServiceName,\r\n SrcPortNumber=SourcePort,\r\n SrcIpAddr=SourceIP,\r\n SrcDvcHostname=SourceHostName,\r\n SrcServiceName=SourceServiceName,\r\n SrcUserName=SourceUserName,\r\n SrcProcessName=SourceProcessName,\r\n SrcMacAddr=SourceMACAddress,\r\n DvcAction=DeviceAction,\r\n DvcHostname=DeviceName,\r\n DvcProcessName=ProcessName,\r\n FileHashSha1=FileHash,\r\n UrlOriginal=RequestURL,\r\n NetworkDirection=CommunicationDirection\r\n| extend Command = iif(DeviceCustomString3Label == \"Command\", DeviceCustomString3, \"\")\r\n| extend ActionResult = iif(DeviceCustomString5Label == \"ActionResult\", DeviceCustomString5, \"\")\r\n| extend Event_Type = iif(DeviceCustomNumber2Label == \"Event_Type\", DeviceCustomNumber2, long(null))\r\n| extend VirusName = iif(DeviceCustomString1Label == \"VirusName\", DeviceCustomString1, \"\")\r\n| extend Policy = iif(DeviceCustomString2Label == \"Policy\", DeviceCustomString2, \"\")\r\n| extend ProcessCommandLine = iif(DeviceCustomString4Label == \"ProcessCommandLine\", DeviceCustomString4, \"\")\r\n| project-away DeviceCustomNumber1Label,\r\n DeviceCustomNumber1,\r\n DeviceCustomNumber2Label,\r\n DeviceCustomNumber2,\r\n DeviceCustomString1Label,\r\n DeviceCustomString1,\r\n DeviceCustomString2Label,\r\n DeviceCustomString2,\r\n DeviceCustomString3Label,\r\n DeviceCustomString3,\r\n DeviceCustomString4Label,\r\n DeviceCustomString4,\r\n DeviceCustomString5Label,\r\n DeviceCustomString5,\r\n DeviceCustomString6Label,\r\n DeviceCustomString6,\r\n DeviceCustomDate1Label,\r\n DeviceCustomDate1,\r\n DeviceCustomDate2Label,\r\n DeviceCustomDate2\r\n", - "version": 1, + "query": "CommonSecurityLog\n| where DeviceVendor == \"Trend Micro\"\n| where DeviceProduct == \"Apex Central\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3),\n ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID))\n| extend packed = pack (DeviceCustomNumber1Label, DeviceCustomNumber1,\n DeviceCustomNumber2Label, DeviceCustomNumber2,\n DeviceCustomString1Label, DeviceCustomString1,\n DeviceCustomString2Label, DeviceCustomString2,\n DeviceCustomString3Label, DeviceCustomString3,\n DeviceCustomString4Label, DeviceCustomString4,\n DeviceCustomString5Label, DeviceCustomString5,\n DeviceCustomString6Label, DeviceCustomString6,\n DeviceCustomDate1Label, DeviceCustomDate1,\n DeviceCustomDate2Label, DeviceCustomDate2)\n| evaluate bag_unpack(packed)\n| project-rename EventVendor=DeviceVendor,\n EventProduct=DeviceProduct,\n EventProductVersion=DeviceVersion,\n EventSubType=DeviceEventClassID,\n EventMessage=Activity,\n EventSeverity=LogSeverity,\n EventOriginalUid=DeviceExternalID,\n EventEndTime=ReceiptTime,\n DstDvcHostname=DestinationHostName,\n DstIpAddr=DestinationIP,\n DstUserName=DestinationUserName,\n DstPortNumber=DestinationPort,\n DstServiceName=DestinationServiceName,\n SrcPortNumber=SourcePort,\n SrcIpAddr=SourceIP,\n SrcDvcHostname=SourceHostName,\n SrcServiceName=SourceServiceName,\n SrcUserName=SourceUserName,\n SrcProcessName=SourceProcessName,\n SrcMacAddr=SourceMACAddress,\n DvcAction=DeviceAction,\n DvcHostname=DeviceName,\n DvcProcessName=ProcessName,\n FileHashSha1=FileHash,\n UrlOriginal=RequestURL,\n NetworkDirection=CommunicationDirection\n| extend Command = iif(DeviceCustomString3Label == \"Command\", DeviceCustomString3, \"\")\n| extend ActionResult = iif(DeviceCustomString5Label == \"ActionResult\", DeviceCustomString5, \"\")\n| extend Event_Type = iif(DeviceCustomNumber2Label == \"Event_Type\", DeviceCustomNumber2, long(null))\n| extend VirusName = iif(DeviceCustomString1Label == \"VirusName\", DeviceCustomString1, \"\")\n| extend Policy = iif(DeviceCustomString2Label == \"Policy\", DeviceCustomString2, \"\")\n| extend ProcessCommandLine = iif(DeviceCustomString4Label == \"ProcessCommandLine\", DeviceCustomString4, \"\")\n| project-away DeviceCustomNumber1Label,\n DeviceCustomNumber1,\n DeviceCustomNumber2Label,\n DeviceCustomNumber2,\n DeviceCustomString1Label,\n DeviceCustomString1,\n DeviceCustomString2Label,\n DeviceCustomString2,\n DeviceCustomString3Label,\n DeviceCustomString3,\n DeviceCustomString4Label,\n DeviceCustomString4,\n DeviceCustomString5Label,\n DeviceCustomString5,\n DeviceCustomString6Label,\n DeviceCustomString6,\n DeviceCustomDate1Label,\n DeviceCustomDate1,\n DeviceCustomDate2Label,\n DeviceCustomDate2\n", + "functionParameters": "", + "version": 2, "tags": [ { "name": "description", - "value": "Trend Micro Apex One Data Parser" + "value": "" } ] } @@ -579,7 +919,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", "dependsOn": [ - "[variables('_parserName1')]" + "[variables('_parserId1')]" ], "properties": { "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", @@ -604,21 +944,39 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_parserContentId1')]", + "contentKind": "Parser", + "displayName": "Trend Micro Apex One Data Parser", + "contentProductId": "[variables('_parsercontentProductId1')]", + "id": "[variables('_parsercontentProductId1')]", + "version": "[variables('parserVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2021-06-01", + "apiVersion": "2022-10-01", "name": "[variables('_parserName1')]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Trend Micro Apex One Data Parser", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "TMApexOneEvent", - "query": "\nCommonSecurityLog\r\n| where DeviceVendor == \"Trend Micro\"\r\n| where DeviceProduct == \"Apex Central\"\r\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\r\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\r\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3),\r\n ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID))\r\n| extend packed = pack (DeviceCustomNumber1Label, DeviceCustomNumber1,\r\n DeviceCustomNumber2Label, DeviceCustomNumber2,\r\n DeviceCustomString1Label, DeviceCustomString1,\r\n DeviceCustomString2Label, DeviceCustomString2,\r\n DeviceCustomString3Label, DeviceCustomString3,\r\n DeviceCustomString4Label, DeviceCustomString4,\r\n DeviceCustomString5Label, DeviceCustomString5,\r\n DeviceCustomString6Label, DeviceCustomString6,\r\n DeviceCustomDate1Label, DeviceCustomDate1,\r\n DeviceCustomDate2Label, DeviceCustomDate2)\r\n| evaluate bag_unpack(packed)\r\n| project-rename EventVendor=DeviceVendor,\r\n EventProduct=DeviceProduct,\r\n EventProductVersion=DeviceVersion,\r\n EventSubType=DeviceEventClassID,\r\n EventMessage=Activity,\r\n EventSeverity=LogSeverity,\r\n EventOriginalUid=DeviceExternalID,\r\n EventEndTime=ReceiptTime,\r\n DstDvcHostname=DestinationHostName,\r\n DstIpAddr=DestinationIP,\r\n DstUserName=DestinationUserName,\r\n DstPortNumber=DestinationPort,\r\n DstServiceName=DestinationServiceName,\r\n SrcPortNumber=SourcePort,\r\n SrcIpAddr=SourceIP,\r\n SrcDvcHostname=SourceHostName,\r\n SrcServiceName=SourceServiceName,\r\n SrcUserName=SourceUserName,\r\n SrcProcessName=SourceProcessName,\r\n SrcMacAddr=SourceMACAddress,\r\n DvcAction=DeviceAction,\r\n DvcHostname=DeviceName,\r\n DvcProcessName=ProcessName,\r\n FileHashSha1=FileHash,\r\n UrlOriginal=RequestURL,\r\n NetworkDirection=CommunicationDirection\r\n| extend Command = iif(DeviceCustomString3Label == \"Command\", DeviceCustomString3, \"\")\r\n| extend ActionResult = iif(DeviceCustomString5Label == \"ActionResult\", DeviceCustomString5, \"\")\r\n| extend Event_Type = iif(DeviceCustomNumber2Label == \"Event_Type\", DeviceCustomNumber2, long(null))\r\n| extend VirusName = iif(DeviceCustomString1Label == \"VirusName\", DeviceCustomString1, \"\")\r\n| extend Policy = iif(DeviceCustomString2Label == \"Policy\", DeviceCustomString2, \"\")\r\n| extend ProcessCommandLine = iif(DeviceCustomString4Label == \"ProcessCommandLine\", DeviceCustomString4, \"\")\r\n| project-away DeviceCustomNumber1Label,\r\n DeviceCustomNumber1,\r\n DeviceCustomNumber2Label,\r\n DeviceCustomNumber2,\r\n DeviceCustomString1Label,\r\n DeviceCustomString1,\r\n DeviceCustomString2Label,\r\n DeviceCustomString2,\r\n DeviceCustomString3Label,\r\n DeviceCustomString3,\r\n DeviceCustomString4Label,\r\n DeviceCustomString4,\r\n DeviceCustomString5Label,\r\n DeviceCustomString5,\r\n DeviceCustomString6Label,\r\n DeviceCustomString6,\r\n DeviceCustomDate1Label,\r\n DeviceCustomDate1,\r\n DeviceCustomDate2Label,\r\n DeviceCustomDate2\r\n", - "version": 1 + "query": "CommonSecurityLog\n| where DeviceVendor == \"Trend Micro\"\n| where DeviceProduct == \"Apex Central\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3),\n ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID))\n| extend packed = pack (DeviceCustomNumber1Label, DeviceCustomNumber1,\n DeviceCustomNumber2Label, DeviceCustomNumber2,\n DeviceCustomString1Label, DeviceCustomString1,\n DeviceCustomString2Label, DeviceCustomString2,\n DeviceCustomString3Label, DeviceCustomString3,\n DeviceCustomString4Label, DeviceCustomString4,\n DeviceCustomString5Label, DeviceCustomString5,\n DeviceCustomString6Label, DeviceCustomString6,\n DeviceCustomDate1Label, DeviceCustomDate1,\n DeviceCustomDate2Label, DeviceCustomDate2)\n| evaluate bag_unpack(packed)\n| project-rename EventVendor=DeviceVendor,\n EventProduct=DeviceProduct,\n EventProductVersion=DeviceVersion,\n EventSubType=DeviceEventClassID,\n EventMessage=Activity,\n EventSeverity=LogSeverity,\n EventOriginalUid=DeviceExternalID,\n EventEndTime=ReceiptTime,\n DstDvcHostname=DestinationHostName,\n DstIpAddr=DestinationIP,\n DstUserName=DestinationUserName,\n DstPortNumber=DestinationPort,\n DstServiceName=DestinationServiceName,\n SrcPortNumber=SourcePort,\n SrcIpAddr=SourceIP,\n SrcDvcHostname=SourceHostName,\n SrcServiceName=SourceServiceName,\n SrcUserName=SourceUserName,\n SrcProcessName=SourceProcessName,\n SrcMacAddr=SourceMACAddress,\n DvcAction=DeviceAction,\n DvcHostname=DeviceName,\n DvcProcessName=ProcessName,\n FileHashSha1=FileHash,\n UrlOriginal=RequestURL,\n NetworkDirection=CommunicationDirection\n| extend Command = iif(DeviceCustomString3Label == \"Command\", DeviceCustomString3, \"\")\n| extend ActionResult = iif(DeviceCustomString5Label == \"ActionResult\", DeviceCustomString5, \"\")\n| extend Event_Type = iif(DeviceCustomNumber2Label == \"Event_Type\", DeviceCustomNumber2, long(null))\n| extend VirusName = iif(DeviceCustomString1Label == \"VirusName\", DeviceCustomString1, \"\")\n| extend Policy = iif(DeviceCustomString2Label == \"Policy\", DeviceCustomString2, \"\")\n| extend ProcessCommandLine = iif(DeviceCustomString4Label == \"ProcessCommandLine\", DeviceCustomString4, \"\")\n| project-away DeviceCustomNumber1Label,\n DeviceCustomNumber1,\n DeviceCustomNumber2Label,\n DeviceCustomNumber2,\n DeviceCustomString1Label,\n DeviceCustomString1,\n DeviceCustomString2Label,\n DeviceCustomString2,\n DeviceCustomString3Label,\n DeviceCustomString3,\n DeviceCustomString4Label,\n DeviceCustomString4,\n DeviceCustomString5Label,\n DeviceCustomString5,\n DeviceCustomString6Label,\n DeviceCustomString6,\n DeviceCustomDate1Label,\n DeviceCustomDate1,\n DeviceCustomDate2Label,\n DeviceCustomDate2\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { @@ -652,33 +1010,15 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "properties": { - "description": "Trend Micro Apex One Workbook with template", - "displayName": "Trend Micro Apex One workbook template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TrendMicroApexOneWorkbook Workbook with template version 2.0.3", + "description": "TrendMicroApexOneWorkbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -743,37 +1083,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Trend Micro Apex One Analytics Rule 1 with template", - "displayName": "Trend Micro Apex One Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName1'),'/',variables('analyticRuleVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneAttackDiscoveryDetectionRisks_AnalyticalRules Analytics Rule with template version 2.0.3", + "description": "TMApexOneAttackDiscoveryDetectionRisks_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion1')]", @@ -782,7 +1115,7 @@ "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId1')]", + "name": "[variables('analyticRulecontentId1')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -801,33 +1134,42 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "TrendMicroApexOne", "dataTypes": [ "TMApexOneEvent" - ] + ], + "connectorId": "TrendMicroApexOne" + }, + { + "dataTypes": [ + "TMApexOneEvent" + ], + "connectorId": "TrendMicroApexOneAma" } ], "tactics": [ "InitialAccess" ], + "techniques": [ + "T1190" + ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { "identifier": "Name", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -860,37 +1202,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId1')]", + "contentKind": "AnalyticsRule", + "displayName": "ApexOne - Attack Discovery Detection", + "contentProductId": "[variables('_analyticRulecontentProductId1')]", + "id": "[variables('_analyticRulecontentProductId1')]", + "version": "[variables('analyticRuleVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Trend Micro Apex One Analytics Rule 2 with template", - "displayName": "Trend Micro Apex One Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName2'),'/',variables('analyticRuleVersion2'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName2'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneCommandLineSuspiciousRequests_AnalyticalRules Analytics Rule with template version 2.0.3", + "description": "TMApexOneCommandLineSuspiciousRequests_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion2')]", @@ -899,7 +1234,7 @@ "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId2')]", + "name": "[variables('analyticRulecontentId2')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -918,33 +1253,42 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "TrendMicroApexOne", "dataTypes": [ "TMApexOneEvent" - ] + ], + "connectorId": "TrendMicroApexOne" + }, + { + "dataTypes": [ + "TMApexOneEvent" + ], + "connectorId": "TrendMicroApexOneAma" } ], "tactics": [ "Execution" ], + "techniques": [ + "T1059" + ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { "identifier": "Name", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -974,40 +1318,33 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } - } - ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('analyticRuleTemplateSpecName3')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Trend Micro Apex One Analytics Rule 3 with template", - "displayName": "Trend Micro Apex One Analytics Rule template" + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId2')]", + "contentKind": "AnalyticsRule", + "displayName": "ApexOne - Suspicious commandline arguments", + "contentProductId": "[variables('_analyticRulecontentProductId2')]", + "id": "[variables('_analyticRulecontentProductId2')]", + "version": "[variables('analyticRuleVersion2')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName3'),'/',variables('analyticRuleVersion3'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName3')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName3'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneCommandsInRequest_AnalyticalRules Analytics Rule with template version 2.0.3", + "description": "TMApexOneCommandsInRequest_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion3')]", @@ -1016,7 +1353,7 @@ "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId3')]", + "name": "[variables('analyticRulecontentId3')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1035,24 +1372,34 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "TrendMicroApexOne", "dataTypes": [ "TMApexOneEvent" - ] + ], + "connectorId": "TrendMicroApexOne" + }, + { + "dataTypes": [ + "TMApexOneEvent" + ], + "connectorId": "TrendMicroApexOneAma" } ], "tactics": [ "InitialAccess" ], + "techniques": [ + "T1190", + "T1133" + ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "identifier": "Url", "columnName": "UrlCustomEntity" } - ], - "entityType": "URL" + ] } ] } @@ -1085,37 +1432,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId3')]", + "contentKind": "AnalyticsRule", + "displayName": "ApexOne - Commands in Url", + "contentProductId": "[variables('_analyticRulecontentProductId3')]", + "id": "[variables('_analyticRulecontentProductId3')]", + "version": "[variables('analyticRuleVersion3')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleTemplateSpecName4')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Trend Micro Apex One Analytics Rule 4 with template", - "displayName": "Trend Micro Apex One Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName4'),'/',variables('analyticRuleVersion4'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName4'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneDvcAccessPermissionWasChanged_AnalyticalRules Analytics Rule with template version 2.0.3", + "description": "TMApexOneDvcAccessPermissionWasChanged_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion4')]", @@ -1124,7 +1464,7 @@ "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId4')]", + "name": "[variables('analyticRulecontentId4')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1143,24 +1483,33 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "TrendMicroApexOne", "dataTypes": [ "TMApexOneEvent" - ] + ], + "connectorId": "TrendMicroApexOne" + }, + { + "dataTypes": [ + "TMApexOneEvent" + ], + "connectorId": "TrendMicroApexOneAma" } ], "tactics": [ "PrivilegeEscalation" ], + "techniques": [ + "T1078" + ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "Name", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1193,37 +1542,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId4')]", + "contentKind": "AnalyticsRule", + "displayName": "ApexOne - Device access permissions was changed", + "contentProductId": "[variables('_analyticRulecontentProductId4')]", + "id": "[variables('_analyticRulecontentProductId4')]", + "version": "[variables('analyticRuleVersion4')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleTemplateSpecName5')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Trend Micro Apex One Analytics Rule 5 with template", - "displayName": "Trend Micro Apex One Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName5'),'/',variables('analyticRuleVersion5'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName5'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneInboundRemoteAccess_AnalyticalRules Analytics Rule with template version 2.0.3", + "description": "TMApexOneInboundRemoteAccess_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion5')]", @@ -1232,7 +1574,7 @@ "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId5')]", + "name": "[variables('analyticRulecontentId5')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1251,33 +1593,42 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "TrendMicroApexOne", "dataTypes": [ "TMApexOneEvent" - ] + ], + "connectorId": "TrendMicroApexOne" + }, + { + "dataTypes": [ + "TMApexOneEvent" + ], + "connectorId": "TrendMicroApexOneAma" } ], "tactics": [ "LateralMovement" ], + "techniques": [ + "T1021" + ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { "identifier": "Name", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1310,37 +1661,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId5')]", + "contentKind": "AnalyticsRule", + "displayName": "ApexOne - Inbound remote access connection", + "contentProductId": "[variables('_analyticRulecontentProductId5')]", + "id": "[variables('_analyticRulecontentProductId5')]", + "version": "[variables('analyticRuleVersion5')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleTemplateSpecName6')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Trend Micro Apex One Analytics Rule 6 with template", - "displayName": "Trend Micro Apex One Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName6'),'/',variables('analyticRuleVersion6'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName6'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneMultipleDenyOrTerminateActionOnSingleIp_AnalyticalRules Analytics Rule with template version 2.0.3", + "description": "TMApexOneMultipleDenyOrTerminateActionOnSingleIp_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion6')]", @@ -1349,7 +1693,7 @@ "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId6')]", + "name": "[variables('analyticRulecontentId6')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1368,24 +1712,33 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "TrendMicroApexOne", "dataTypes": [ "TMApexOneEvent" - ] + ], + "connectorId": "TrendMicroApexOne" + }, + { + "dataTypes": [ + "TMApexOneEvent" + ], + "connectorId": "TrendMicroApexOneAma" } ], "tactics": [ "InitialAccess" ], + "techniques": [ + "T1190" + ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] } ] } @@ -1418,37 +1771,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId6')]", + "contentKind": "AnalyticsRule", + "displayName": "ApexOne - Multiple deny or terminate actions on single IP", + "contentProductId": "[variables('_analyticRulecontentProductId6')]", + "id": "[variables('_analyticRulecontentProductId6')]", + "version": "[variables('analyticRuleVersion6')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleTemplateSpecName7')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Trend Micro Apex One Analytics Rule 7 with template", - "displayName": "Trend Micro Apex One Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName7'),'/',variables('analyticRuleVersion7'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName7'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOnePossibleExploitOrExecuteOperation_AnalyticalRules Analytics Rule with template version 2.0.3", + "description": "TMApexOnePossibleExploitOrExecuteOperation_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion7')]", @@ -1457,7 +1803,7 @@ "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId7')]", + "name": "[variables('analyticRulecontentId7')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1476,34 +1822,43 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "TrendMicroApexOne", "dataTypes": [ "TMApexOneEvent" - ] + ], + "connectorId": "TrendMicroApexOne" + }, + { + "dataTypes": [ + "TMApexOneEvent" + ], + "connectorId": "TrendMicroApexOneAma" } ], "tactics": [ "PrivilegeEscalation", "Persistence" ], + "techniques": [ + "T1546" + ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { "identifier": "Name", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1536,37 +1891,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId7')]", + "contentKind": "AnalyticsRule", + "displayName": "ApexOne - Possible exploit or execute operation", + "contentProductId": "[variables('_analyticRulecontentProductId7')]", + "id": "[variables('_analyticRulecontentProductId7')]", + "version": "[variables('analyticRuleVersion7')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleTemplateSpecName8')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Trend Micro Apex One Analytics Rule 8 with template", - "displayName": "Trend Micro Apex One Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName8'),'/',variables('analyticRuleVersion8'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName8'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneRiskCnCEvents_AnalyticalRules Analytics Rule with template version 2.0.3", + "description": "TMApexOneRiskCnCEvents_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion8')]", @@ -1575,7 +1923,7 @@ "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId8')]", + "name": "[variables('analyticRulecontentId8')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1594,33 +1942,42 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "TrendMicroApexOne", "dataTypes": [ "TMApexOneEvent" - ] + ], + "connectorId": "TrendMicroApexOne" + }, + { + "dataTypes": [ + "TMApexOneEvent" + ], + "connectorId": "TrendMicroApexOneAma" } ], "tactics": [ "CommandAndControl" ], + "techniques": [ + "T1071" + ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { "identifier": "Name", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1653,37 +2010,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId8')]", + "contentKind": "AnalyticsRule", + "displayName": "ApexOne - C&C callback events", + "contentProductId": "[variables('_analyticRulecontentProductId8')]", + "id": "[variables('_analyticRulecontentProductId8')]", + "version": "[variables('analyticRuleVersion8')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleTemplateSpecName9')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Trend Micro Apex One Analytics Rule 9 with template", - "displayName": "Trend Micro Apex One Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName9'),'/',variables('analyticRuleVersion9'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName9'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneSpywareWithFailedResponse_AnalyticalRules Analytics Rule with template version 2.0.3", + "description": "TMApexOneSpywareWithFailedResponse_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion9')]", @@ -1692,7 +2042,7 @@ "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId9')]", + "name": "[variables('analyticRulecontentId9')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1711,33 +2061,42 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "TrendMicroApexOne", "dataTypes": [ "TMApexOneEvent" - ] + ], + "connectorId": "TrendMicroApexOne" + }, + { + "dataTypes": [ + "TMApexOneEvent" + ], + "connectorId": "TrendMicroApexOneAma" } ], "tactics": [ "InitialAccess" ], + "techniques": [ + "T1190" + ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { "identifier": "Name", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1770,37 +2129,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId9')]", + "contentKind": "AnalyticsRule", + "displayName": "ApexOne - Spyware with failed response", + "contentProductId": "[variables('_analyticRulecontentProductId9')]", + "id": "[variables('_analyticRulecontentProductId9')]", + "version": "[variables('analyticRuleVersion9')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleTemplateSpecName10')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Trend Micro Apex One Analytics Rule 10 with template", - "displayName": "Trend Micro Apex One Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName10'),'/',variables('analyticRuleVersion10'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName10'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneSuspiciousConnections_AnalyticalRules Analytics Rule with template version 2.0.3", + "description": "TMApexOneSuspiciousConnections_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleVersion10')]", @@ -1809,7 +2161,7 @@ "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId10')]", + "name": "[variables('analyticRulecontentId10')]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1828,33 +2180,42 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "TrendMicroApexOne", "dataTypes": [ "TMApexOneEvent" - ] + ], + "connectorId": "TrendMicroApexOne" + }, + { + "dataTypes": [ + "TMApexOneEvent" + ], + "connectorId": "TrendMicroApexOneAma" } ], "tactics": [ "CommandAndControl" ], + "techniques": [ + "T1102" + ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { "identifier": "Name", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1887,37 +2248,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId10')]", + "contentKind": "AnalyticsRule", + "displayName": "ApexOne - Suspicious connections", + "contentProductId": "[variables('_analyticRulecontentProductId10')]", + "id": "[variables('_analyticRulecontentProductId10')]", + "version": "[variables('analyticRuleVersion10')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "Trend Micro Apex One Hunting Query 1 with template", - "displayName": "Trend Micro Apex One Hunting Query template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('huntingQueryTemplateSpecName1'),'/',variables('huntingQueryVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneBehaviorMonitoringTranslatedAction_HuntingQueries Hunting Query with template version 2.0.3", + "description": "TMApexOneBehaviorMonitoringTranslatedAction_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion1')]", @@ -1926,7 +2280,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "name": "Trend_Micro_Apex_One_Hunting_Query_1", "location": "[parameters('workspace-location')]", "properties": { @@ -1979,37 +2333,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId1')]", + "contentKind": "HuntingQuery", + "displayName": "ApexOne - Behavior monitoring actions by files", + "contentProductId": "[variables('_huntingQuerycontentProductId1')]", + "id": "[variables('_huntingQuerycontentProductId1')]", + "version": "[variables('huntingQueryVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "Trend Micro Apex One Hunting Query 2 with template", - "displayName": "Trend Micro Apex One Hunting Query template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('huntingQueryTemplateSpecName2'),'/',variables('huntingQueryVersion2'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName2'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneBehaviorMonitoringTranslatedOperation_HuntingQueries Hunting Query with template version 2.0.3", + "description": "TMApexOneBehaviorMonitoringTranslatedOperation_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion2')]", @@ -2018,7 +2365,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "name": "Trend_Micro_Apex_One_Hunting_Query_2", "location": "[parameters('workspace-location')]", "properties": { @@ -2071,37 +2418,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId2')]", + "contentKind": "HuntingQuery", + "displayName": "ApexOne - Behavior monitoring operations by users", + "contentProductId": "[variables('_huntingQuerycontentProductId2')]", + "id": "[variables('_huntingQuerycontentProductId2')]", + "version": "[variables('huntingQueryVersion2')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryTemplateSpecName3')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "Trend Micro Apex One Hunting Query 3 with template", - "displayName": "Trend Micro Apex One Hunting Query template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('huntingQueryTemplateSpecName3'),'/',variables('huntingQueryVersion3'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName3'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneBehaviorMonitoringTriggeredPolicy_HuntingQueries Hunting Query with template version 2.0.3", + "description": "TMApexOneBehaviorMonitoringTriggeredPolicy_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion3')]", @@ -2110,7 +2450,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "name": "Trend_Micro_Apex_One_Hunting_Query_3", "location": "[parameters('workspace-location')]", "properties": { @@ -2163,37 +2503,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId3')]", + "contentKind": "HuntingQuery", + "displayName": "ApexOne - Behavior monitoring triggered policy by command line", + "contentProductId": "[variables('_huntingQuerycontentProductId3')]", + "id": "[variables('_huntingQuerycontentProductId3')]", + "version": "[variables('huntingQueryVersion3')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryTemplateSpecName4')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "Trend Micro Apex One Hunting Query 4 with template", - "displayName": "Trend Micro Apex One Hunting Query template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('huntingQueryTemplateSpecName4'),'/',variables('huntingQueryVersion4'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName4'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneBehaviorMonitoringTypesOfEvent_HuntingQueries Hunting Query with template version 2.0.3", + "description": "TMApexOneBehaviorMonitoringTypesOfEvent_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion4')]", @@ -2202,7 +2535,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "name": "Trend_Micro_Apex_One_Hunting_Query_4", "location": "[parameters('workspace-location')]", "properties": { @@ -2255,37 +2588,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId4')]", + "contentKind": "HuntingQuery", + "displayName": "ApexOne - Behavior monitoring event types by users", + "contentProductId": "[variables('_huntingQuerycontentProductId4')]", + "id": "[variables('_huntingQuerycontentProductId4')]", + "version": "[variables('huntingQueryVersion4')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryTemplateSpecName5')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "Trend Micro Apex One Hunting Query 5 with template", - "displayName": "Trend Micro Apex One Hunting Query template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('huntingQueryTemplateSpecName5'),'/',variables('huntingQueryVersion5'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName5'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneChannelType_HuntingQueries Hunting Query with template version 2.0.3", + "description": "TMApexOneChannelType_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion5')]", @@ -2294,7 +2620,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "name": "Trend_Micro_Apex_One_Hunting_Query_5", "location": "[parameters('workspace-location')]", "properties": { @@ -2347,37 +2673,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId5')]", + "contentKind": "HuntingQuery", + "displayName": "ApexOne - Channel type by users", + "contentProductId": "[variables('_huntingQuerycontentProductId5')]", + "id": "[variables('_huntingQuerycontentProductId5')]", + "version": "[variables('huntingQueryVersion5')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryTemplateSpecName6')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "Trend Micro Apex One Hunting Query 6 with template", - "displayName": "Trend Micro Apex One Hunting Query template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('huntingQueryTemplateSpecName6'),'/',variables('huntingQueryVersion6'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName6'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneDataLossPreventionAction_HuntingQueries Hunting Query with template version 2.0.3", + "description": "TMApexOneDataLossPreventionAction_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion6')]", @@ -2386,7 +2705,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "name": "Trend_Micro_Apex_One_Hunting_Query_6", "location": "[parameters('workspace-location')]", "properties": { @@ -2439,37 +2758,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId6')]", + "contentKind": "HuntingQuery", + "displayName": "ApexOne - Data loss prevention action by IP", + "contentProductId": "[variables('_huntingQuerycontentProductId6')]", + "id": "[variables('_huntingQuerycontentProductId6')]", + "version": "[variables('huntingQueryVersion6')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryTemplateSpecName7')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "Trend Micro Apex One Hunting Query 7 with template", - "displayName": "Trend Micro Apex One Hunting Query template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('huntingQueryTemplateSpecName7'),'/',variables('huntingQueryVersion7'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName7'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneRareAppProtocolByIP_HuntingQueries Hunting Query with template version 2.0.3", + "description": "TMApexOneRareAppProtocolByIP_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion7')]", @@ -2478,7 +2790,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "name": "Trend_Micro_Apex_One_Hunting_Query_7", "location": "[parameters('workspace-location')]", "properties": { @@ -2531,37 +2843,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId7')]", + "contentKind": "HuntingQuery", + "displayName": "ApexOne - Rare application protocols by Ip address", + "contentProductId": "[variables('_huntingQuerycontentProductId7')]", + "id": "[variables('_huntingQuerycontentProductId7')]", + "version": "[variables('huntingQueryVersion7')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryTemplateSpecName8')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "Trend Micro Apex One Hunting Query 8 with template", - "displayName": "Trend Micro Apex One Hunting Query template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('huntingQueryTemplateSpecName8'),'/',variables('huntingQueryVersion8'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName8'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneSpywareDetection_HuntingQueries Hunting Query with template version 2.0.3", + "description": "TMApexOneSpywareDetection_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion8')]", @@ -2570,7 +2875,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "name": "Trend_Micro_Apex_One_Hunting_Query_8", "location": "[parameters('workspace-location')]", "properties": { @@ -2623,37 +2928,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId8')]", + "contentKind": "HuntingQuery", + "displayName": "ApexOne - Spyware detection", + "contentProductId": "[variables('_huntingQuerycontentProductId8')]", + "id": "[variables('_huntingQuerycontentProductId8')]", + "version": "[variables('huntingQueryVersion8')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryTemplateSpecName9')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "Trend Micro Apex One Hunting Query 9 with template", - "displayName": "Trend Micro Apex One Hunting Query template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('huntingQueryTemplateSpecName9'),'/',variables('huntingQueryVersion9'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName9'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneSuspiciousFiles_HuntingQueries Hunting Query with template version 2.0.3", + "description": "TMApexOneSuspiciousFiles_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion9')]", @@ -2662,7 +2960,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "name": "Trend_Micro_Apex_One_Hunting_Query_9", "location": "[parameters('workspace-location')]", "properties": { @@ -2715,37 +3013,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId9')]", + "contentKind": "HuntingQuery", + "displayName": "ApexOne - Suspicious files events", + "contentProductId": "[variables('_huntingQuerycontentProductId9')]", + "id": "[variables('_huntingQuerycontentProductId9')]", + "version": "[variables('huntingQueryVersion9')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryTemplateSpecName10')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, - "properties": { - "description": "Trend Micro Apex One Hunting Query 10 with template", - "displayName": "Trend Micro Apex One Hunting Query template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('huntingQueryTemplateSpecName10'),'/',variables('huntingQueryVersion10'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "HuntingQuery" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('huntingQueryTemplateSpecName10'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TMApexOneTopSources_HuntingQueries Hunting Query with template version 2.0.3", + "description": "TMApexOneTopSources_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryVersion10')]", @@ -2754,7 +3045,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "name": "Trend_Micro_Apex_One_Hunting_Query_10", "location": "[parameters('workspace-location')]", "properties": { @@ -2807,17 +3098,35 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_huntingQuerycontentId10')]", + "contentKind": "HuntingQuery", + "displayName": "ApexOne - Top sources with alerts", + "contentProductId": "[variables('_huntingQuerycontentProductId10')]", + "id": "[variables('_huntingQuerycontentProductId10')]", + "version": "[variables('huntingQueryVersion10')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.3", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "Trend Micro Apex One", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Trend Micro Apex One solution for Microsoft Sentinel enables ingestion of Trend Micro Apex One events into Microsoft Sentinel. Refer to Trend Micro Apex Central for more information.

\n
    \n

  1. Trend Micro Apex One via AMA - This data connector helps in ingesting Trend Micro Apex One logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. Trend Micro Apex One via Legacy Agent - This data connector helps in ingesting Trend Micro Apex One logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends installation of Trend Micro Apex One via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 2, Parsers: 1, Workbooks: 1, Analytic Rules: 10, Hunting Queries: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { @@ -2843,6 +3152,11 @@ "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId2')]", + "version": "[variables('dataConnectorVersion2')]" + }, { "kind": "Parser", "contentId": "[variables('_parserContentId1')]", diff --git a/Solutions/Trend Micro Apex One/ReleaseNotes.md b/Solutions/Trend Micro Apex One/ReleaseNotes.md new file mode 100644 index 00000000000..19df1aa026c --- /dev/null +++ b/Solutions/Trend Micro Apex One/ReleaseNotes.md @@ -0,0 +1,5 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------| +| 3.0.0 | 22-09-2023 | Addition of new Trend Micro Apex One AMA **Data Connector** | | + + diff --git a/Solutions/Web Session Essentials/Package/3.0.0.zip b/Solutions/Web Session Essentials/Package/3.0.0.zip index a8d71c1bd1b..2aaa27683fc 100644 Binary files a/Solutions/Web Session Essentials/Package/3.0.0.zip and b/Solutions/Web Session Essentials/Package/3.0.0.zip differ diff --git a/Solutions/Web Session Essentials/Package/mainTemplate.json b/Solutions/Web Session Essentials/Package/mainTemplate.json index 0d44d401348..946250ccf3a 100644 --- a/Solutions/Web Session Essentials/Package/mainTemplate.json +++ b/Solutions/Web Session Essentials/Package/mainTemplate.json @@ -988,7 +988,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Web Session Essentials\\n---\\n\\nThe 'Web Session Essentials' workbook provides real-time insights into activity and potential threats in your network.\\n\\nThis workbook is designed for network teams, security architects, analysts, and consultants to monitor, identify and investigate threats on Web servers, Web Proxies and Web Security Gateways assets. This Workbook gives a summary of analysed web traffic and helps with threat analysis and investigating suspicious http traffic.\\n\\nThe \\\"SummarizeWebSessionData\\\" Playbook installed along with the solution helps in summarizing the logs and improving the performance of the Workbook and data searches. This Workbook leverages the default as well as custom web session summarized data tables for visualising the data. Although enabling the summarization playbook is optional, we highly recommend enabling it for better user experience in environments with high EPS (events per second) data ingestion. Please note that summarization would require the playbook to run on a scheduled basis to utilise this workbook's capabilities.\\n\\nSummarized web session data can found in following custom tables:\\n- WebSession_Summarized_SrcInfo_CL\\n- WebSession_Summarized_SrcIP_CL\\n- WebSession_Summarized_DstIP_CL\\n- WebSession_Summarized_ThreatInfo_CL\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"10f90ed9-b14c-4bd3-8618-fe92d29d0055\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::selected\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"a28728e5-2c6b-4f0f-9b2e-906fe24c52a6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"query\":\"summarize by subscriptionId\\r\\n| project value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\",\"crossComponentResources\":[\"value::selected\"],\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"c8af6801-1cdf-47f6-b959-a7774b2f5faf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"description\":\"Select required Log Analytics Workspace\",\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| project id\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":\"\"},{\"id\":\"b875f4b5-5a7c-4cf1-baf9-7b860f737cb8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":604800000}},{\"id\":\"ab5ebbc3-a282-4ee4-9cc0-7cfebaa7e06a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LastIngestionTimeSrcInfo\",\"type\":1,\"description\":\"Get last ingestion time in WebSession_Summarized_SrcInfo_CL custom table\",\"isRequired\":true,\"query\":\"let LastIngestionTime = toscalar (\\r\\n union isfuzzy=true \\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | summarize max_TimeGenerated=max(EventTime_t)\\r\\n | extend max_TimeGenerated = datetime_add('hour', 1, max_TimeGenerated)\\r\\n ),\\r\\n (\\r\\n print({TimeRange:start})\\r\\n | extend max_TimeGenerated = print_0\\r\\n | project max_TimeGenerated\\r\\n )\\r\\n | summarize maxTimeGenerated = max(max_TimeGenerated) \\r\\n );\\r\\n print LastIngestionTime\",\"crossComponentResources\":[\"{Workspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"b8fc59a5-83c9-4ec1-9dfa-f71fa4e1ad15\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LastIngestionTimeSrcIP\",\"type\":1,\"description\":\"Get last ingestion time in WebSession_Summarized_SrcIP_CL custom table\",\"isRequired\":true,\"query\":\"let LastIngestionTime = toscalar (\\r\\n union isfuzzy=true \\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | summarize max_TimeGenerated=max(EventTime_t)\\r\\n | extend max_TimeGenerated = datetime_add('hour', 1, max_TimeGenerated)\\r\\n ),\\r\\n (\\r\\n print({TimeRange:start})\\r\\n | extend max_TimeGenerated = print_0\\r\\n | project max_TimeGenerated\\r\\n )\\r\\n | summarize maxTimeGenerated = max(max_TimeGenerated) \\r\\n );\\r\\n print LastIngestionTime\",\"crossComponentResources\":[\"{Workspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"c318ae1b-984d-4f08-a0a1-46f0a8e62252\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LastIngestionTimeDstIP\",\"type\":1,\"description\":\"Get last ingestion time in WebSession_Summarized_DstIP_CL custom table\",\"isRequired\":true,\"query\":\"let LastIngestionTime = toscalar (\\r\\n union isfuzzy=true \\r\\n (\\r\\n WebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | summarize max_TimeGenerated=max(EventTime_t)\\r\\n | extend max_TimeGenerated = datetime_add('hour', 1, max_TimeGenerated)\\r\\n ),\\r\\n (\\r\\n print({TimeRange:start})\\r\\n | extend max_TimeGenerated = print_0\\r\\n | project max_TimeGenerated\\r\\n )\\r\\n | summarize maxTimeGenerated = max(max_TimeGenerated) \\r\\n );\\r\\n print LastIngestionTime\",\"crossComponentResources\":[\"{Workspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"041050ed-6db3-42ae-96cd-100abebd7492\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LastIngestionTimeThreatInfo\",\"type\":1,\"description\":\"Get last ingestion time in WebSession_Summarized_ThreatInfo_CL custom table\",\"isRequired\":true,\"query\":\"let LastIngestionTime = toscalar (\\r\\n union isfuzzy=true \\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | summarize max_TimeGenerated=max(EventTime_t)\\r\\n | extend max_TimeGenerated = datetime_add('hour', 1, max_TimeGenerated)\\r\\n ),\\r\\n (\\r\\n print({TimeRange:start})\\r\\n | extend max_TimeGenerated = print_0\\r\\n | project max_TimeGenerated\\r\\n )\\r\\n | summarize maxTimeGenerated = max(max_TimeGenerated) \\r\\n );\\r\\n print LastIngestionTime\",\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"7c67ea90-b8cb-44e0-b7e0-24d7b55e2680\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SrcIpAddr\",\"label\":\"Source IP\",\"type\":2,\"description\":\"search single or multiple Source IPs\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(SrcIpAddr)\\r\\n | distinct SrcIpAddr\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcIpAddr_s)\\r\\n | distinct SrcIpAddr=SrcIpAddr_s\\r\\n )\\r\\n | distinct SrcIpAddr\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"value\":[\"value::all\"]},{\"id\":\"a8533e73-c384-4490-94d7-a86b0298add0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SrcUsername\",\"label\":\"User name\",\"type\":2,\"description\":\"search single or multiple usernames\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(SrcUsername)\\r\\n | distinct SrcUsername\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcUsername_s)\\r\\n | distinct SrcUsername=SrcUsername_s\\r\\n )\\r\\n | distinct SrcUsername\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"value\":[\"value::all\"]},{\"id\":\"161946b4-aa92-4bc3-8ae1-8b4ee67389ea\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SrcHostname\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(SrcHostname)\\r\\n | distinct SrcHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcHostname_s)\\r\\n | distinct SrcHostname=SrcHostname_s\\r\\n )\\r\\n | distinct SrcHostname\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\"},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"value\":[\"value::all\"],\"label\":\"Source Host\"},{\"id\":\"e67b1965-4b24-45bd-9e07-64892a11ed5c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DstHostname\",\"type\":2,\"description\":\"search single or multiple URLs\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(Url)\\r\\n | extend SiteName = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | distinct SiteName\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DestDomain_s)\\r\\n | distinct SiteName = DestDomain_s\\r\\n )\\r\\n | distinct SiteName\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"value\":[\"value::all\"],\"label\":\"Dest Site\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"tabStyle\":\"bigger\",\"links\":[{\"id\":\"c3e512f5-3e3f-41f3-b645-121f7bd6a557\",\"cellValue\":\"tabVisibility\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Web servers\",\"subTarget\":\"webservers\",\"preText\":\"Web servers\",\"style\":\"link\"},{\"id\":\"6d785be8-da74-4cae-977f-576d5d3fa070\",\"cellValue\":\"tabVisibility\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Web Proxies and Security Gateways\",\"subTarget\":\"webproxies\",\"style\":\"link\"},{\"id\":\"9f095674-3da6-4a46-aae9-6820b2b4baee\",\"cellValue\":\"tabVisibility\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Top Queries\",\"subTarget\":\"topQueries\",\"style\":\"link\"},{\"id\":\"e4f43157-d64d-41d2-8f9d-e39a30b0c1ce\",\"cellValue\":\"tabVisibility\",\"linkTarget\":\"parameter\",\"linkLabel\":\"View Threat Events\",\"subTarget\":\"threatevents\",\"style\":\"link\"}]},\"name\":\"links - 8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let uniqueConnection = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n\\t\\t| where isnotempty(SrcIpAddr) and isnotempty(Url)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize count() by SrcIpAddr, DestHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n\\t\\t| where isnotempty(SrcIpAddr_s) and isnotempty(DestDomain_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize count() by SrcIpAddr, DestHostname\\r\\n )\\r\\n | summarize count() by SrcIpAddr, DestHostname\\r\\n | count\\r\\n | extend Metric = \\\"Unique Connections\\\", orderNum = 1;\\r\\nlet products = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where isnotempty(EventProduct)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct EventProduct\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(EventProduct_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct EventProduct=EventProduct_s\\r\\n )\\r\\n | distinct EventProduct\\r\\n | count\\r\\n | extend Metric = \\\"Product Count\\\", orderNum = 2;\\r\\nlet UserNames = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where isnotempty(SrcUsername)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcUsername\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcUsername_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcUsername\\r\\n )\\r\\n | distinct SrcUsername\\r\\n | count\\r\\n | extend Metric = \\\"Unique UserNames\\\", orderNum = 3;\\r\\nlet Srchosts = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where isnotempty(SrcHostname)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcHostname_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcHostname=SrcHostname_s\\r\\n )\\r\\n | distinct SrcHostname\\r\\n | count\\r\\n | extend Metric = \\\"Source HostNames\\\", orderNum = 4;\\r\\nlet ClientIPs = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where isnotempty(SrcIpAddr)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcIpAddr\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcIpAddr_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcIpAddr=SrcIpAddr_s\\r\\n )\\r\\n | distinct SrcIpAddr\\r\\n | count\\r\\n | extend Metric = \\\"Unique Source IPs\\\", orderNum = 5;\\r\\nlet DestHostName = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where isnotempty(Url)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DestDomain_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n )\\r\\n | distinct DestHostname\\r\\n | count\\r\\n | extend Metric = \\\"Unique Dest Sites\\\", orderNum = 6;\\r\\nlet TotalUserAgents = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where isnotempty(HttpUserAgent)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}))\\r\\n | distinct HttpUserAgent\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(HttpUserAgent_s)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}))\\r\\n | distinct HttpUserAgent=HttpUserAgent_s\\r\\n )\\r\\n | distinct HttpUserAgent\\r\\n | count\\r\\n | extend Metric = \\\"Unique UserAgents\\\", orderNum = 7;\\r\\nlet ServerErrorsCount = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where toint(EventResultDetails) between (500 .. 599)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventResultDetails, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where toint(EventResultDetails_s) between (500 .. 599)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, EventResultDetails=EventResultDetails_s, EventTime = EventTime_t, EventCount = EventCount_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by EventResultDetails, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize Count = sum(EventCount)\\r\\n | extend Metric = \\\"Total Server Errors\\\", orderNum = 8;\\r\\nlet ClientErrorsCount = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where toint(EventResultDetails) between (400 .. 499)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventResultDetails, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where toint(EventResultDetails_s) between (400 .. 499)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, EventResultDetails=EventResultDetails_s, EventTime = EventTime_t, EventCount = EventCount_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by EventResultDetails, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize Count = sum(EventCount)\\r\\n | extend Metric = \\\"Total Client Errors\\\", orderNum = 9;\\r\\nunion uniqueConnection, products, UserNames, Srchosts, ClientIPs, DestHostName, TotalUserAgents, ServerErrorsCount, ClientErrorsCount | where Count != 0\\r\\n| order by orderNum asc\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Metric\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where isnotempty(EventProduct)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventProduct, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | extend EventProduct = EventProduct_s\\r\\n | where isnotempty(EventProduct)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount_d)) by EventProduct, bin(TimeGenerated=EventTime_t,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by EventProduct, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Events by products over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"EventProduct\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"EventCount\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"EventProduct\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"EventCount\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"EventCount\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"EventCount\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"EventCount\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"50\",\"name\":\"Events by products over time - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where isnotempty(EventResultDetails) and EventResultDetails !~ 'NA'\\r\\n | where toint(EventResultDetails) between (400 .. 599)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventResultDetails, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | project\\r\\n EventResultDetails= EventResultDetails_s,\\r\\n EventTime = EventTime_t,\\r\\n EventCount = EventCount_d,\\r\\n SrcIpAddr=SrcIpAddr_s,\\r\\n DestHostname=DestDomain_s,\\r\\n SrcUsername=SrcUsername_s,\\r\\n SrcHostname=SrcHostname_s\\r\\n | where isnotempty(EventResultDetails) and EventResultDetails !~ 'NA'\\r\\n | where toint(EventResultDetails) between (400 .. 599)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by EventResultDetails, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n| summarize EventCount = sum(EventCount) by EventResultDetails, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Events by error type over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"EventResultDetails\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"EventCount\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"Count by errors type over time\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true\\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and ipv4_is_private(SrcIpAddr)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize RequestCount=tolong(count()) by User, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | extend User = coalesce(SrcUsername_s, SrcIpAddr_s)\\r\\n | where isnotempty(User) and ipv4_is_private(SrcIpAddr_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, EventTime=EventTime_t, EventCount=EventCount_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize RequestCount=tolong(sum(EventCount)) by User, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n | summarize RequestCount = sum(RequestCount) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize RequestCount = sum(RequestCount) by User\\r\\n| order by RequestCount desc\\r\\n| take 10\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top internal users by request count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"Top internal users by request count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true\\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and not(ipv4_is_private(SrcIpAddr))\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize RequestCount=tolong(count()) by User, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | extend User = coalesce(SrcUsername_s, SrcIpAddr_s)\\r\\n | where isnotempty(User) and not(ipv4_is_private(SrcIpAddr_s))\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, EventTime=EventTime_t, EventCount=EventCount_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize RequestCount=tolong(sum(EventCount)) by User, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n | summarize RequestCount = sum(RequestCount) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize RequestCount = sum(RequestCount) by User\\r\\n| order by RequestCount desc\\r\\n| take 10\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top external users by request count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"Top external clients by request count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_Im_WebSession(starttime={TimeRange:start}, endtime=now())\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| where isnotempty(EventSeverity)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize RequestCount=tolong(count()) by EventSeverity\",\"size\":1,\"showAnalytics\":true,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"query - 7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeDstIP}'), endtime=now())\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(DstHostname)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by DstHostname, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | extend DstHostname_s = coalesce(DstHostname_s, DstIpAddr_s)\\r\\n | project EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, DstHostname=DstHostname_s, DestHostname=DestDomain_s\\r\\n | where isnotempty(DstHostname)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by DstHostname, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by DstHostname\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by DstHostname\\r\\n) on DstHostname\\r\\n| project WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top web hosts with most request count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"25\",\"name\":\"Top web hosts with most request count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_Im_WebSession(starttime={TimeRange:start}, eventresult='Failure')\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| where isnotempty(Url)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=count() by Url\\r\\n| order by EventCount desc \\r\\n| take 25\",\"size\":3,\"showAnalytics\":true,\"title\":\"Urls with most failed requests\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Url\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"EventCount\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"name\":\"Urls with most failed requests\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeDstIP}'), endtime=now())\\r\\n| where EventType =~ 'WebServerSession'\\r\\n | extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(DstHostname) and toint(EventResultDetails) between (500 .. 599)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by DstHostname, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | extend DstHostname_s = coalesce(DstHostname_s, DstIpAddr_s)\\r\\n | project EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, DstHostname=DstHostname_s, DestHostname=DestDomain_s\\r\\n | where isnotempty(DstHostname) and toint(EventResultDetails) between (500 .. 599)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by DstHostname, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by DstHostname\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by DstHostname\\r\\n) on DstHostname\\r\\n| project WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top web hosts with most server errors\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top web hosts with most server errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeDstIP}'), endtime=now())\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(DstHostname) and toint(EventResultDetails) between (400 .. 499)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by DstHostname, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | extend DstHostname_s = coalesce(DstHostname_s, DstIpAddr_s)\\r\\n | project EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, DstHostname=DstHostname_s, DestHostname=DestDomain_s\\r\\n | where isnotempty(DstHostname) and toint(EventResultDetails) between (400 .. 499)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by DstHostname, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by DstHostname\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by DstHostname\\r\\n) on DstHostname\\r\\n| project WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top web hosts with most client errors\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top web hosts with most client errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n_Im_WebSession(starttime={TimeRange:start}, endtime=now())\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n| extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (400 .. 499)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by User, DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by User, DstHostname\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User, DstHostname\\r\\n) on User, DstHostname\\r\\n| project User, WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top users with most client errors\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top users with most client errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n_Im_WebSession(starttime={TimeRange:start}, endtime=now())\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n| extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (500 .. 599)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n| where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\nand ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\nand ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\nand ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by User, DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by User, DstHostname\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User, DstHostname\\r\\n) on User, DstHostname\\r\\n| project User, WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top users with most server errors\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top users with most server errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n _Im_WebSession(starttime={TimeRange:start}, endtime=now(), eventresult='Success')\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(HttpUserAgent) and HttpUserAgent != 'Unknown'\\r\\n | summarize EventCount=tolong(count()) by HttpUserAgent, DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpUserAgent, DstHostname\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpUserAgent, DstHostname\\r\\n )\\r\\n on HttpUserAgent, DstHostname\\r\\n| project HttpUserAgent, WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Rare User Agent requests resulted in success\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Rare User Agent requests resulted in success\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n _Im_WebSession(starttime={TimeRange:start}, endtime=now(), eventresult='Failure')\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(HttpUserAgent) and HttpUserAgent != 'Unknown'\\r\\n | summarize EventCount=tolong(count()) by HttpUserAgent, DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpUserAgent, DstHostname\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpUserAgent, DstHostname\\r\\n )\\r\\n on HttpUserAgent, DstHostname\\r\\n| project HttpUserAgent, WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Rare User Agent requests resulted in errors\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Rare User Agent requests resulted in errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeDstIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(DstHostname) and isnotempty(DstBytes)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataReceived=tolong(sum(DstBytes)) by DstHostname, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_DstIP_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| where EventType_s =~ 'WebServerSession'\\r\\n| extend DstHostname_s = coalesce(DstHostname_s, DstIpAddr_s)\\r\\n| project EventCount=EventCount_d, EventTime=EventTime_t, DstHostname=DstHostname_s, DestHostname=DestDomain_s, DstBytes= DstBytes_d\\r\\n | where isnotempty(DstHostname) and isnotempty(DstBytes)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataReceived=tolong(sum(DstBytes)) by DstHostname, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize DataReceived = sum(DataReceived) by DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\n WebData\\r\\n | summarize DataReceived = sum(DataReceived) by DstHostname\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(DataReceived) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by DstHostname\\r\\n ) on DstHostname\\r\\n | project WebServer=DstHostname, DataReceived=DataReceived, Trend\\r\\n | order by DataReceived desc\\r\\n | take 25\",\"size\":1,\"title\":\"Top Web servers with highest download\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top Web servers with highest download\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let common_file_ext_list = dynamic([\\\".txt\\\", \\\".xlsx\\\", \\\".doc\\\", \\\".docx\\\", \\\".csv\\\", \\\".pdf\\\", \\\".png\\\", \\\".jpg\\\", \\\".jpeg\\\"]); // Add list of common files as per your environment\\r\\n_Im_WebSession (starttime={TimeRange:start}, eventresult='Success')\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| where HttpRequestMethod in~ (\\\"POST\\\", \\\"PUT\\\") \\r\\n| project\\r\\n Url,\\r\\n SrcIpAddr,\\r\\n SrcUsername,\\r\\n SrcHostname,\\r\\n DstIpAddr,\\r\\n DstPortNumber,\\r\\n DstHostname,\\r\\n TimeGenerated\\r\\n| extend requestedFileName=tostring(split(tostring(parse_url(Url)[\\\"Path\\\"]), '/')[-1])\\r\\n| extend FileWithdualextension = extract(@'([\\\\w-]+\\\\.\\\\w+\\\\.\\\\w+)$', 1, requestedFileName, typeof(string))\\r\\n| extend SecondExt = tostring(split(FileWithdualextension, '.')[-1])\\r\\n| where strcat('.', SecondExt) in~ (common_file_ext_list) // Second extension is mostly from the common files\\r\\n| summarize\\r\\n EventCount=count(),\\r\\n EventStartTime=min(TimeGenerated),\\r\\n EventEndTime=max(TimeGenerated)\\r\\n by\\r\\n SrcIpAddr,\\r\\n Url,\\r\\n FileWithdualextension,\\r\\n SrcUsername,\\r\\n SrcHostname,\\r\\n DstIpAddr,\\r\\n DstPortNumber,\\r\\n DstHostname\",\"size\":1,\"title\":\"Possible malicious double extension file upload\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"tabVisibility\",\"comparison\":\"isEqualTo\",\"value\":\"webservers\"},\"name\":\"Web servers\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let uniqueConnection = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n\\t\\t| where isnotempty(SrcIpAddr) and isnotempty(Url)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize count() by SrcIpAddr, DestHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n\\t\\t| where isnotempty(SrcIpAddr_s) and isnotempty(DestDomain_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize count() by SrcIpAddr, DestHostname\\r\\n )\\r\\n | summarize count() by SrcIpAddr, DestHostname\\r\\n | count\\r\\n | extend Metric = \\\"Unique Connections\\\", orderNum = 1;\\r\\nlet products = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where isnotempty(EventProduct)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct EventProduct\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotempty(EventProduct_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct EventProduct=EventProduct_s\\r\\n )\\r\\n | distinct EventProduct\\r\\n | count\\r\\n | extend Metric = \\\"Product Count\\\", orderNum = 2;\\r\\nlet UserNames = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where isnotempty(SrcUsername)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcUsername\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotempty(SrcUsername_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcUsername\\r\\n )\\r\\n | distinct SrcUsername\\r\\n | count\\r\\n | extend Metric = \\\"Unique UserNames\\\", orderNum = 3;\\r\\nlet Srchosts = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(SrcHostname)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotempty(SrcHostname_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcHostname=SrcHostname_s\\r\\n )\\r\\n | distinct SrcHostname\\r\\n | count\\r\\n | extend Metric = \\\"Source HostNames\\\", orderNum = 4;\\r\\nlet ClientIPs = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(SrcIpAddr)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcIpAddr\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotempty(SrcIpAddr_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcIpAddr=SrcIpAddr_s\\r\\n )\\r\\n | distinct SrcIpAddr\\r\\n | count\\r\\n | extend Metric = \\\"Unique Source IPs\\\", orderNum = 5;\\r\\nlet DestHostName = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(Url)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotempty(DestDomain_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n )\\r\\n | distinct DestHostname\\r\\n | count\\r\\n | extend Metric = \\\"Unique Dest HostNames\\\", orderNum = 6;\\r\\nlet TotalUserAgents = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(HttpUserAgent)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}))\\r\\n | distinct HttpUserAgent\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotempty(HttpUserAgent_s)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}))\\r\\n | distinct HttpUserAgent=HttpUserAgent_s\\r\\n )\\r\\n | distinct HttpUserAgent\\r\\n | count\\r\\n | extend Metric = \\\"Unique UserAgents\\\", orderNum = 7;\\r\\nunion uniqueConnection, products, UserNames, Srchosts, ClientIPs, DestHostName, TotalUserAgents | where Count != 0\\r\\n| order by orderNum asc\",\"size\":4,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Metric\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Unique Connections\",\"representation\":\"Connect\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Product Count\",\"representation\":\"Normal\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Unique UserNames\",\"representation\":\"AvatarDefault\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Source HostNames\",\"representation\":\"resource\"},{\"operator\":\"==\",\"thresholdValue\":\"Unique Source IPs\",\"representation\":\"Publish\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Unique UserAgents\",\"representation\":\"Important\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Unique Hosts\",\"representation\":\"Book\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":true,\"size\":\"auto\"}},\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(EventProduct)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventProduct, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | extend EventProduct = EventProduct_s\\r\\n | where isnotempty(EventProduct)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount_d)) by EventProduct, bin(TimeGenerated=EventTime_t,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by EventProduct, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Events by products over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"EventProduct\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"EventCount\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"EventProduct\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"EventCount\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"EventCount\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"EventCount\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"EventCount\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"33\",\"name\":\"Events by products over time\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(EventResult)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventResult, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | extend EventResult = EventResult_s\\r\\n | where isnotempty(EventResult)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount_d)) by EventResult, bin(TimeGenerated=EventTime_t,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by EventResult, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Events by result over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"EventResult\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"EventCount\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failure\",\"color\":\"red\"},{\"seriesName\":\"Success\",\"color\":\"green\"}]},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"EventCount\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"EventCount\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"EventCount\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"33\",\"name\":\"Events by result over time\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | where toint(EventResultDetails) > 399 // Take events resulted in errors\\r\\n | summarize EventCount=tolong(count()) by EventResultDetails, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | extend\\r\\n SrcIpAddr=SrcIpAddr_s,\\r\\n DestHostname=DestDomain_s,\\r\\n SrcUsername=SrcUsername_s,\\r\\n SrcHostname=SrcHostname_s,\\r\\n SrcBytes = SrcBytes_d,\\r\\n DstBytes = DstBytes_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | where toint(EventResultDetails_s) > 399 // Take events resulted in errors\\r\\n | summarize EventCount=tolong(sum(EventCount_d)) by EventResultDetails=EventResultDetails_s, TimeGenerated=bin(EventTime_t, {TimeRange:grain})\\r\\n )\\r\\n| summarize EventCount = sum(EventCount) by EventResultDetails, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Errors by type over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\"},\"customWidth\":\"33\",\"name\":\"Errors by type over time\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(EventType)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventType, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | extend EventType=EventType_s, EventCount=EventCount_d, EventTime=EventTime_t\\r\\n | where isnotempty(EventType)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by EventType, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by EventType, bin(TimeGenerated, {TimeRange:grain})\",\"size\":1,\"showAnalytics\":true,\"title\":\"Events by type\",\"color\":\"lightBlue\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"20\",\"name\":\"Events by type\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotnull(SrcBytes) or isnotnull(DstBytes)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataSent=tolong(sum(SrcBytes)), DataReceived=tolong(sum(DstBytes)) by bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotnull(SrcBytes_d) or isnotnull(DstBytes_d)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, SrcBytes = SrcBytes_d, DstBytes = DstBytes_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataSent=tolong(sum(SrcBytes)), DataReceived=tolong(sum(DstBytes)) by bin(TimeGenerated=EventTime_t,{TimeRange:grain})\\r\\n )\\r\\n | summarize DataSent = sum(DataSent), DataReceived=tolong(sum(DataReceived)) by bin(TimeGenerated, {TimeRange:grain})\\r\\n | project DataSentinGB = format_bytes(DataSent,0,'GB'), DataReceivedinGB=format_bytes(DataReceived,0,'GB'), TimeGenerated\\r\\n | extend DataSentinGB = toint(replace_string(DataSentinGB,\\\" GB\\\",\\\"\\\")), DataReceivedinGB = toint(replace_string(DataReceivedinGB,\\\" GB\\\",\\\"\\\"))\",\"size\":1,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Sent and Received data in GB over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"40\",\"name\":\"Sent and Received data in GB over time\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DestHostnameSet = make_set(DestHostname, 1000000) by bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n| where isnotempty(DestDomain_s)\\r\\n| extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, SrcBytes = SrcBytes_d, DstBytes = DstBytes_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize DestHostnameSet = make_set(DestHostname, 1000000) by TimeGenerated=bin(EventTime_t, {TimeRange:grain})\\r\\n)\\r\\n| summarize TotalSites = array_length(make_set(DestHostnameSet, 1000000)) by bin(TimeGenerated, {TimeRange:grain})\\r\\n\",\"size\":1,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Distinct requested applications over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"customWidth\":\"40\",\"name\":\"Distinct requested applications over time\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_Im_WebSession(starttime={TimeRange:start}, eventresult='Failure')\\r\\n| where EventType =~ 'HTTPsession'\\r\\n| where isnotempty(Url)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=count() by Url\\r\\n| order by EventCount desc \\r\\n| take 25\",\"size\":0,\"showAnalytics\":true,\"title\":\"Urls with most failed requests count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Url\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"EventCount\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Urls with most failed requests count\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabVisibility\",\"comparison\":\"isEqualTo\",\"value\":\"webproxies\"},\"name\":\"Group - Web Proxies and Security Gateways\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | extend DestDomain = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestDomain in~ ({DstHostname})))\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and isnotempty(DestDomain)\\r\\n | summarize RequestCount=tolong(count()) by User, DestDomain, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project\\r\\n SrcUsername=SrcUsername_s,\\r\\n SrcIpAddr=SrcIpAddr_s,\\r\\n SrcHostname=SrcHostname_s,\\r\\n TimeGenerated=EventTime_t,\\r\\n DestDomain=DestDomain_s,\\r\\n EventCount=EventCount_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestDomain in~ ({DstHostname})))\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and isnotempty(DestDomain)\\r\\n | summarize RequestCount=tolong(sum(EventCount)) by User, DestDomain, bin(TimeGenerated, {TimeRange:grain})\\r\\n )\\r\\n | summarize RequestCount = sum(RequestCount) by User, DestDomain, bin(TimeGenerated, {TimeRange:grain});\\r\\nlet UserData = WebData\\r\\n | summarize RequestCount=sum(RequestCount) by User\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(RequestCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User)\\r\\n on User\\r\\n | order by RequestCount desc, User asc;\\r\\nWebData\\r\\n| summarize RequestCount=sum(RequestCount) by User, DestDomain\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(RequestCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User, DestDomain\\r\\n) on User, DestDomain\\r\\n| order by RequestCount desc, User asc\\r\\n| project Id=DestDomain, Name=DestDomain, RequestCount, Trend, ParentId=User, Type='DestDomain'\\r\\n| union (UserData\\r\\n| project Id=User, Name=User, RequestCount, Trend, ParentId = 'root', Type='User'\\r\\n)\\r\\n| order by RequestCount desc, Name asc\\r\\n| take 25\",\"size\":1,\"title\":\"Top sites of the top users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Id\",\"formatter\":5},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"ParentId\",\"formatter\":5}],\"hierarchySettings\":{\"idColumn\":\"Id\",\"parentColumn\":\"ParentId\",\"treeType\":0,\"expanderColumn\":\"Name\",\"expandTopLevel\":false}}},\"customWidth\":\"50\",\"name\":\"Top sites of the top users\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by User, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | extend EventCount=EventCount_d, SrcIpAddr=SrcIpAddr_s, EventTime=EventTime_t, SrcUsername=SrcUsername_s, DestHostname=DestDomain_s, SrcHostname=SrcHostname_s\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by User, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\n WebData\\r\\n | summarize EventCount = sum(EventCount) by User\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User\\r\\n ) on User\\r\\n | project User, EventCount, Trend\\r\\n | order by EventCount desc\\r\\n | take 25\",\"size\":1,\"title\":\"Top Users with most request count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"User\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"25%\"}},{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"25%\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\",\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":\"[]\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top Users with most request count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (400 .. 499)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by User, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (400 .. 499)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by User, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by User\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User\\r\\n) on User\\r\\n| project User, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top Users with most client errors\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top Users with most client errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (500 .. 599)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by User, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (500 .. 599)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by User, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by User\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User\\r\\n) on User\\r\\n| project User, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top Users with most server errors\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top Users with most server errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (400 .. 499)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by EventResultDetails=toint(EventResultDetails), bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcIP_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (400 .. 499)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by EventResultDetails=toint(EventResultDetails), bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by EventResultDetails, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by EventResultDetails\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by EventResultDetails\\r\\n) on EventResultDetails\\r\\n| project EventResultDetails, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top client error types\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top client error types\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (500 .. 599)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by EventResultDetails=toint(EventResultDetails), bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcIP_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (500 .. 599)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by EventResultDetails=toint(EventResultDetails), bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by EventResultDetails, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by EventResultDetails\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by EventResultDetails\\r\\n) on EventResultDetails\\r\\n| project EventResultDetails, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top server error types\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top server error types\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Webdata = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now(), eventresult='Success')\\r\\n | extend Website = case(\\r\\n isnotempty(DstDomain),DstDomain\\r\\n , isnotempty(Url),tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n ,\\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\"\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | summarize EventCount = count() by Website, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n | project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s, DstBytes= DstBytes_d, EventResult_s\\r\\n | extend Website = case(\\r\\n isnotempty(DestHostname),DestHostname\\r\\n ,\\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\" and EventResult_s =~ 'Success'\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by Website, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by Website, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebdata\\r\\n| summarize EventCount = sum(EventCount) by Website\\r\\n| join kind = inner (\\r\\nWebdata | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by Website\\r\\n) \\r\\non Website\\r\\n| project Website, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top websites by successful requests count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top websites by successful requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Webdata = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now(), eventresult='Failure')\\r\\n | extend Website = case(\\r\\n isnotempty(DstDomain),DstDomain\\r\\n , isnotempty(Url),tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n ,\\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\"\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | summarize EventCount = count() by Website, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n | project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s, DstBytes= DstBytes_d, EventResult_s\\r\\n | extend Website = case(\\r\\n isnotempty(DestHostname),DestHostname\\r\\n ,\\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\" and EventResult_s =~ 'Failure'\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by Website, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by Website, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebdata\\r\\n| summarize EventCount = sum(EventCount) by Website\\r\\n| join kind = inner (\\r\\nWebdata | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by Website\\r\\n) \\r\\non Website\\r\\n| project Website, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top websites by failed requests count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top websites by failed requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and isnotempty(SrcBytes)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataSent=tolong(sum(SrcBytes)) by User, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s, SrcBytes= SrcBytes_d\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and isnotempty(SrcBytes)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataSent=tolong(sum(SrcBytes)) by User, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize DataSent = sum(DataSent) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\n WebData\\r\\n | summarize DataSent = sum(DataSent) by User\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(DataSent) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User\\r\\n ) on User\\r\\n | project User, DataSentinMB=DataSent/1048576, Trend\\r\\n | order by DataSentinMB desc\\r\\n | take 25\",\"size\":1,\"title\":\"Users with highest upload (MB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DataSentinMB\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"SentData\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Users with highest upload (MB)\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and isnotempty(DstBytes)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataReceived=tolong(sum(DstBytes)) by User, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s, DstBytes= DstBytes_d\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and isnotempty(DstBytes)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataReceived=tolong(sum(DstBytes)) by User, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize DataReceived = sum(DataReceived) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\n WebData\\r\\n | summarize DataReceived = sum(DataReceived) by User\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(DataReceived) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User\\r\\n ) on User\\r\\n | project User, DataReceivedinMB=DataReceived/1048576, Trend\\r\\n | order by DataReceivedinMB desc\\r\\n | take 25\",\"size\":1,\"title\":\"Users with highest download (MB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DataReceivedinMB\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Users with highest download (MB)\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | extend Website = case(\\r\\n isnotempty(DstDomain),\\r\\n DstDomain\\r\\n ,\\r\\n isnotempty(Url),\\r\\n tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n ,\\r\\n \\\"NA\\\"\\r\\n )\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | where Website != \\\"NA\\\" and isnotempty(SrcBytes)\\r\\n | summarize DataSent=tolong(sum(SrcBytes)) by Website, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project\\r\\n SrcIpAddr=SrcIpAddr_s,\\r\\n EventResultDetails=EventResultDetails_s,\\r\\n EventCount=EventCount_d,\\r\\n EventTime=EventTime_t,\\r\\n SrcUsername=SrcUsername_s,\\r\\n SrcHostname=SrcHostname_s,\\r\\n DestHostname=DestDomain_s,\\r\\n SrcBytes= SrcBytes_d\\r\\n | extend Website = case(\\r\\n isnotempty(DestHostname),\\r\\n DestHostname\\r\\n ,\\r\\n \\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\" and isnotnull(SrcBytes)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataSent=tolong(sum(SrcBytes)) by Website, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n | summarize DataSent = sum(DataSent) by Website, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize DataSent = sum(DataSent) by Website\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(DataSent) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by Website\\r\\n )\\r\\n on Website\\r\\n| project Website, DataSentinMB=DataSent / 1048576, Trend\\r\\n| order by DataSentinMB desc\\r\\n| take 25\",\"size\":1,\"title\":\"Websites with highest upload (MB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DataSentinMB\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Websites with highest upload (MB) (no summarization)\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | project DstDomain, Url, TimeGenerated, DstBytes, SrcIpAddr, SrcUsername, SrcHostname\\r\\n | extend Website = case(\\r\\n isnotempty(DstDomain),\\r\\n DstDomain\\r\\n ,\\r\\n isnotempty(Url),\\r\\n tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n ,\\r\\n \\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\" and isnotempty(DstBytes)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | where Website != \\\"NA\\\" and isnotempty(DstBytes)\\r\\n | summarize DataReceived=tolong(sum(DstBytes)) by Website, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project\\r\\n SrcIpAddr=SrcIpAddr_s,\\r\\n EventResultDetails=EventResultDetails_s,\\r\\n EventCount=EventCount_d,\\r\\n EventTime=EventTime_t,\\r\\n SrcUsername=SrcUsername_s,\\r\\n SrcHostname=SrcHostname_s,\\r\\n DestHostname=DestDomain_s,\\r\\n DstBytes= DstBytes_d\\r\\n | extend Website = case(\\r\\n isnotempty(DestHostname),\\r\\n DestHostname\\r\\n ,\\r\\n \\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\" and isnotempty(DstBytes)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | summarize DataReceived=tolong(sum(DstBytes)) by Website, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n | summarize DataReceived = sum(DataReceived) by Website, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize DataReceived = sum(DataReceived) by Website\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(DataReceived) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by Website\\r\\n )\\r\\n on Website\\r\\n| project Website, DataReceivedinMB=DataReceived / 1048576, Trend\\r\\n| order by DataReceivedinMB desc\\r\\n| take 25\",\"size\":1,\"title\":\"Websites with highest download(MB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DataReceivedinMB\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Websites with highest download(MB)\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult='Success')\\r\\n| where isnotempty(HttpRequestMethod) and HttpRequestMethod != \\\"NA\\\"\\r\\n| summarize EventCount=tolong(count()) by HttpRequestMethod, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcInfo_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project HttpRequestMethod=HttpRequestMethod_s, EventCount=EventCount_d, EventTime=EventTime_t, EventResult=EventResult_s\\r\\n| where isnotempty(HttpRequestMethod) and HttpRequestMethod != \\\"NA\\\" and EventResult =~ 'Success'\\r\\n| summarize EventCount=tolong(sum(EventCount)) by HttpRequestMethod, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by HttpRequestMethod, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpRequestMethod\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpRequestMethod\\r\\n) on HttpRequestMethod\\r\\n| project HttpRequestMethod, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top HTTP request methods by successful requests count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP request methods by successful requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult='Failure')\\r\\n| where isnotempty(HttpRequestMethod) and HttpRequestMethod != \\\"NA\\\"\\r\\n| summarize EventCount=tolong(count()) by HttpRequestMethod, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcInfo_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project HttpRequestMethod=HttpRequestMethod_s, EventCount=EventCount_d, EventTime=EventTime_t, EventResult=EventResult_s\\r\\n| where isnotempty(HttpRequestMethod) and HttpRequestMethod != \\\"NA\\\" and EventResult =~ 'Failure'\\r\\n| summarize EventCount=tolong(sum(EventCount)) by HttpRequestMethod, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by HttpRequestMethod, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpRequestMethod\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpRequestMethod\\r\\n) on HttpRequestMethod\\r\\n| project HttpRequestMethod, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top HTTP request methods by failed requests count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP request methods by failed requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult='Success')\\r\\n| where isnotempty(HttpContentType) and HttpContentType != \\\"None\\\"\\r\\n| summarize EventCount=tolong(count()) by HttpContentType, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcInfo_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project HttpContentType=HttpContentType_s, EventCount=EventCount_d, EventTime=EventTime_t, EventResult=EventResult_s\\r\\n| where isnotempty(HttpContentType) and HttpContentType != \\\"None\\\" and EventResult =~ 'Success'\\r\\n| summarize EventCount=tolong(sum(EventCount)) by HttpContentType, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by HttpContentType, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpContentType\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpContentType\\r\\n) on HttpContentType\\r\\n| project HttpContentType, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top HTTP content types by successful requests count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP content types by successful requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult='Failure')\\r\\n| where isnotempty(HttpContentType) and HttpContentType != \\\"None\\\"\\r\\n| summarize EventCount=tolong(count()) by HttpContentType, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcInfo_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project HttpContentType=HttpContentType_s, EventCount=EventCount_d, EventTime=EventTime_t, EventResult=EventResult_s\\r\\n| where isnotempty(HttpContentType) and HttpContentType != \\\"None\\\" and EventResult =~ 'Failure'\\r\\n| summarize EventCount=tolong(sum(EventCount)) by HttpContentType, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by HttpContentType, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpContentType\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpContentType\\r\\n) on HttpContentType\\r\\n| project HttpContentType, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top HTTP content types by failed requests count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP content types by failed requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n _Im_WebSession(starttime = {TimeRange:start}, endtime=now(), eventresult='Success')\\r\\n | where isnotempty(HttpReferrer)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by HttpReferrer, bin(TimeGenerated,{TimeRange:grain})\\r\\n ;\\r\\n WebData\\r\\n | summarize EventCount = sum(EventCount) by HttpReferrer\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpReferrer\\r\\n ) on HttpReferrer\\r\\n | project HttpReferrer, EventCount, Trend\\r\\n | order by EventCount desc\\r\\n | take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top HTTP referrers by successful requests count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP referrers by successful requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n _Im_WebSession(starttime = {TimeRange:start}, endtime=now(), eventresult='Failure')\\r\\n | where isnotempty(HttpReferrer)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by HttpReferrer, bin(TimeGenerated,{TimeRange:grain})\\r\\n ;\\r\\n WebData\\r\\n | summarize EventCount = sum(EventCount) by HttpReferrer\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpReferrer\\r\\n ) on HttpReferrer\\r\\n | project HttpReferrer, EventCount, Trend\\r\\n | order by EventCount desc\\r\\n | take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top HTTP referrers by failed requests count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP referrers by failed requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult=\\\"Failure\\\")\\r\\n | project UrlCategory, TimeGenerated\\r\\n | where isnotempty(UrlCategory)\\r\\n | summarize EventCount=tolong(count()) by UrlCategory, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project UrlCategory=UrlCategory_s, TimeGenerated=EventTime_t, EventCount=EventCount_d, EventResult = EventResult_s\\r\\n | where isnotempty(UrlCategory) and EventResult =~ \\\"Failure\\\"\\r\\n | summarize EventCount=tolong(sum(EventCount)) by UrlCategory, bin(TimeGenerated, {TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by UrlCategory, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by UrlCategory\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by UrlCategory\\r\\n) on UrlCategory\\r\\n| project UrlCategory, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top URL Categories by failed requests count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top URL Categories by failed requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult=\\\"Success\\\")\\r\\n | project UrlCategory, TimeGenerated\\r\\n | where isnotempty(UrlCategory)\\r\\n | summarize EventCount=tolong(count()) by UrlCategory, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project UrlCategory=UrlCategory_s, TimeGenerated=EventTime_t, EventCount=EventCount_d, EventResult = EventResult_s\\r\\n | where isnotempty(UrlCategory) and EventResult =~ \\\"Success\\\"\\r\\n | summarize EventCount=tolong(sum(EventCount)) by UrlCategory, bin(TimeGenerated, {TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by UrlCategory, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by UrlCategory\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by UrlCategory\\r\\n) on UrlCategory\\r\\n| project UrlCategory, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top URL Categories by successful requests count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top URL Categories by successful requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult='Success')\\r\\n | where isnotempty(HttpUserAgent) and HttpUserAgent != 'Unknown'\\r\\n | summarize EventCount=tolong(count()) by HttpUserAgent, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project\\r\\n HttpUserAgent=HttpUserAgent_s,\\r\\n EventCount=EventCount_d,\\r\\n EventTime=EventTime_t,\\r\\n EventResult=EventResult_s\\r\\n | where isnotempty(HttpUserAgent)\\r\\n and HttpUserAgent != 'Unknown'\\r\\n and EventResult =~ 'Success'\\r\\n | summarize EventCount=tolong(sum(EventCount)) by HttpUserAgent, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by HttpUserAgent, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpUserAgent\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpUserAgent\\r\\n )\\r\\n on HttpUserAgent\\r\\n| project HttpUserAgent, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top HTTP User Agents by successful request count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP User Agents by successful request count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult='Failure')\\r\\n | where isnotempty(HttpUserAgent) and HttpUserAgent != 'Unknown'\\r\\n | summarize EventCount=tolong(count()) by HttpUserAgent, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project\\r\\n HttpUserAgent=HttpUserAgent_s,\\r\\n EventCount=EventCount_d,\\r\\n EventTime=EventTime_t,\\r\\n EventResult=EventResult_s\\r\\n | where isnotempty(HttpUserAgent)\\r\\n and HttpUserAgent != 'Unknown'\\r\\n and EventResult =~ 'Failure'\\r\\n | summarize EventCount=tolong(sum(EventCount)) by HttpUserAgent, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by HttpUserAgent, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpUserAgent\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpUserAgent\\r\\n )\\r\\n on HttpUserAgent\\r\\n| project HttpUserAgent, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top HTTP User Agents by failed request count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP User Agents by failed request count\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"tabVisibility\",\"comparison\":\"isEqualTo\",\"value\":\"topQueries\"},\"name\":\"Group - Top Queries\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let exludeString = dynamic ( [ \\\"/\\\", \\\"None\\\",\\\"\\\" ]);\\r\\nlet distinctThreats = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where (ThreatName !in~ (exludeString) and isnotempty(ThreatName))\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where (ThreatName_s !in~ (exludeString) and isnotempty(ThreatName_s))\\r\\n | extend ThreatName = ThreatName_s\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n )\\r\\n | summarize Result=tostring(dcount(ThreatName))\\r\\n | extend Query = \\\"Distinct ThreatNames\\\", orderNum = 1;\\r\\nlet distinctThreatCategory = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where (ThreatCategory !in~ (exludeString) and isnotempty(ThreatCategory))\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where (ThreatCategory_s !in~ (exludeString) and isnotempty(ThreatCategory_s))\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | extend ThreatCategory = ThreatCategory_s\\r\\n )\\r\\n | summarize Result=tostring(dcount(ThreatCategory))\\r\\n | extend Query = \\\"Distinct Threat Categories\\\", orderNum = 2;\\r\\nlet maxRiskLevel = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where ThreatRiskLevel > 60\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where ThreatRiskLevel_d > 60\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | extend ThreatRiskLevel = toint(ThreatRiskLevel_d)\\r\\n )\\r\\n | summarize Max_RiskLevel=max(ThreatRiskLevel)\\r\\n | extend Result=tostring(iff(isempty(Max_RiskLevel), 0, Max_RiskLevel))\\r\\n | extend Query = \\\"Maximum RiskLevel\\\", orderNum = 3;\\r\\nlet maxThreatConfidence = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | extend ThreatOriginalConfidence=toint(ThreatOriginalConfidence)\\r\\n | where ThreatOriginalConfidence > 0\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where toint(ThreatOriginalConfidence_d) > 0\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, ThreatOriginalConfidence=ThreatOriginalConfidence_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | extend ThreatOriginalConfidence = toint(ThreatOriginalConfidence)\\r\\n )\\r\\n | summarize Max_ThreatOriginalConfidence=max(ThreatOriginalConfidence)\\r\\n | extend Result=tostring(iff(isempty(Max_ThreatOriginalConfidence), 0, Max_ThreatOriginalConfidence))\\r\\n | extend Query = \\\"Maximum ThreatConfidence\\\", orderNum = 4;\\r\\nlet MaxEventSeverity = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where isnotempty(EventSeverity) and EventSeverity != 'Informational'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct EventSeverity\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(EventSeverity_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct EventSeverity=EventSeverity_s\\r\\n )\\r\\n | distinct EventSeverity\\r\\n | summarize EventSeverity=make_set(EventSeverity, 5)\\r\\n | extend Result=case(\\r\\n EventSeverity has 'High',\\r\\n 'High',\\r\\n EventSeverity has 'Medium',\\r\\n 'Medium',\\r\\n EventSeverity has 'Low',\\r\\n 'Low',\\r\\n EventSeverity has 'Informational',\\r\\n 'Informational',\\r\\n EventSeverity\\r\\n )\\r\\n | extend Query = \\\"Max Event Severity\\\", orderNum = 5;\\r\\nunion distinctThreatCategory, distinctThreats, maxRiskLevel, maxThreatConfidence, MaxEventSeverity\\r\\n| order by orderNum asc\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Query\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Result\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"2\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"4\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"success\",\"text\":\"{0}{1}\"},{\"operator\":\"!=\",\"thresholdValue\":\"0\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"unknown\",\"text\":\"{0}{1}\"}]},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true,\"size\":\"auto\"}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where (ThreatName != 'None' and isnotempty(ThreatName))\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=count() by ThreatName, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project ThreatName=ThreatName_s, EventCount=EventCount_d, TimeGenerated=EventTime_t, ThreatField=ThreatField_s, SrcIpAddr=SrcIpAddr_s, SrcUsername=SrcUsername_s, DestHostname=DestDomain_s, EventResult=EventResult_s\\r\\n | where (ThreatName != 'None' and isnotempty(ThreatName))\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by ThreatName, bin(TimeGenerated, {TimeRange:grain})\\r\\n )\\r\\n| summarize EventCount = sum(EventCount) by ThreatName, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n| order by EventCount\",\"size\":1,\"aggregation\":3,\"title\":\"Events by threat name\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"Events by threat name\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let exludeString = dynamic ( [ \\\"/\\\", \\\"None\\\",\\\"\\\" ]);\\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where ThreatCategory !in~ (exludeString)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=count() by ThreatCategory, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project ThreatCategory=ThreatCategory_s, EventCount=EventCount_d, ThreatField=ThreatField_s, SrcIpAddr=SrcIpAddr_s, SrcUsername=SrcUsername_s, DestHostname=DestDomain_s, EventResult=EventResult_s\\r\\n | where ThreatCategory !in~ (exludeString)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by ThreatCategory, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n )\\r\\n| summarize EventCount = sum(EventCount) by ThreatCategory, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\",\"size\":1,\"aggregation\":3,\"title\":\"Events by threat category\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"query - 2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where isnotempty(EventSeverity) and EventSeverity != 'Informational'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize EventCount=tolong(count()) by EventSeverity, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project EventSeverity=EventSeverity_s, EventCount=EventCount_d, ThreatField=ThreatField_s, SrcIpAddr=SrcIpAddr_s, SrcUsername=SrcUsername_s, DestHostname=DestDomain_s, EventResult=EventResult_s\\r\\n\\t | where isnotempty(EventSeverity) and EventSeverity != 'Informational'\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t | summarize EventCount=tolong(sum(EventCount)) by EventSeverity, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n )\\r\\n | summarize EventCount=sum(EventCount) by EventSeverity, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\",\"size\":1,\"aggregation\":3,\"title\":\"Events by Severity over time\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\"},\"customWidth\":\"33\",\"name\":\"query - 6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where ThreatRiskLevel > 60\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize EventCount=tolong(count()) by ThreatRiskLevel, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project ThreatRiskLevel=toint(ThreatRiskLevel_d), EventCount=EventCount_d, ThreatField=ThreatField_s, SrcIpAddr=SrcIpAddr_s, SrcUsername=SrcUsername_s, DestHostname=DestDomain_s, EventResult=EventResult_s\\r\\n | where ThreatRiskLevel > 60\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t | summarize EventCount=tolong(sum(EventCount)) by ThreatRiskLevel, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n )\\r\\n | summarize EventCount=sum(EventCount) by tostring(ThreatRiskLevel), ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\",\"size\":1,\"aggregation\":3,\"title\":\"Events by Risk Level over time\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\"},\"customWidth\":\"33\",\"name\":\"query - 4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | extend ThreatOriginalConfidence = toint(ThreatOriginalConfidence)\\r\\n | where ThreatOriginalConfidence > 0\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize EventCount=tolong(count()) by ThreatOriginalConfidence, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where ThreatOriginalConfidence_d > 0\\r\\n | project ThreatOriginalConfidence=toint(ThreatOriginalConfidence_d), EventTime_t, EventCount_d, ThreatField=ThreatField_s, SrcIpAddr=SrcIpAddr_s, SrcUsername=SrcUsername_s, DestHostname=DestDomain_s, EventResult=EventResult_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount_d)) by ThreatOriginalConfidence, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n )\\r\\n | summarize EventCount=sum(EventCount) by ThreatOriginalConfidence, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\",\"size\":1,\"title\":\"Events by Confidence over time\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\"},\"customWidth\":\"33\",\"name\":\"query - 5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllPublicIPs = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where not(ipv4_is_private(SrcIpAddr))\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | extend PublicIPAddress = SrcIpAddr\\r\\n | where PublicIPAddress != ''\\r\\n\\t\\t| project PublicIPAddress\\r\\n\\t\\t| distinct PublicIPAddress\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where not(ipv4_is_private(SrcIpAddr))\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | extend PublicIPAddress = SrcIpAddr\\r\\n | where PublicIPAddress != ''\\r\\n | project PublicIPAddress\\r\\n\\t\\t| distinct PublicIPAddress\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | extend DstIpAddr=DstIpAddr_s, DestHostname=DestDomain_s\\r\\n | where not(ipv4_is_private(DstIpAddr))\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | extend PublicIPAddress = DstIpAddr\\r\\n | where PublicIPAddress != ''\\r\\n | project PublicIPAddress\\r\\n\\t\\t| distinct PublicIPAddress\\r\\n )\\r\\n | distinct PublicIPAddress;\\r\\n ThreatIntelligenceIndicator\\r\\n | where NetworkIP in~ (AllPublicIPs)\",\"size\":1,\"title\":\"Source or Destination IPs matching with Threat Intelligence indicators\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllDstWebsites = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(Url)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where isnotempty(DestHostname)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DestDomain_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DestDomain_s)\\r\\n | extend DstIpAddr=DstIpAddr_s, DestHostname=DestDomain_s\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n )\\r\\n | distinct DestHostname;\\r\\n ThreatIntelligenceIndicator\\r\\n | where Url has_any(AllDstWebsites)\",\"size\":1,\"title\":\"Requested URL matching with Threat Intelligence Indicators\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"Requested URL with Threat Intelligence Indicators\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllSrcIPs = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(SrcIpAddr)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| project SrcIpAddr\\r\\n\\t\\t| distinct SrcIpAddr\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcIpAddr_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| distinct SrcIpAddr=SrcIpAddr_s\\r\\n )\\r\\n | distinct SrcIpAddr;\\r\\nlet AllDstIPs = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeDstIP}'), endtime=now())\\r\\n | where isnotempty(DstIpAddr)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| distinct DstIpAddr\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DstIpAddr_s)\\r\\n | extend DstIpAddr=DstIpAddr_s, DestHostname=DestDomain_s\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| distinct DstIpAddr\\r\\n )\\r\\n | distinct DstIpAddr;\\r\\nlet AllIPs =\\r\\nunion AllSrcIPs, AllDstIPs;\\r\\n SecurityAlert\\r\\n | where TimeGenerated > {TimeRange:start}\\r\\n | extend Parsed_Entities = parse_json(Entities)\\r\\n | mv-expand Parsed_Entities\\r\\n | extend Parsed_EntityType=tostring(Parsed_Entities.Type)\\r\\n | where Parsed_EntityType =~ 'ip'\\r\\n | extend IPEntity = tostring(Parsed_Entities.Address)\\r\\n | project-away Parsed_Entities\\r\\n | where IPEntity in~ (AllIPs)\\r\\n | project TimeGenerated, AlertSeverity, AlertName, Description, ProviderName, IPEntity, Status, Tactics, Techniques\",\"size\":1,\"title\":\"Source or Destination IPs matching with Entities in Security Alert table\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"33\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllDstWebsites = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(Url)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DestDomain_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DestDomain_s)\\r\\n | extend DestHostname = DestDomain_s\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n )\\r\\n | distinct DestHostname;\\r\\nSecurityAlert\\r\\n| where TimeGenerated > {TimeRange:start}\\r\\n | extend Parsed_Entities = parse_json(Entities)\\r\\n | mv-expand Parsed_Entities\\r\\n | extend Parsed_EntityType=tostring(Parsed_Entities.Type)\\r\\n | where Parsed_EntityType =~ 'url'\\r\\n | extend UrlEntity = tostring(Parsed_Entities.Url)\\r\\n | project-away Parsed_Entities\\r\\n| where UrlEntity has_any (AllDstWebsites)\\r\\n| project TimeGenerated, AlertSeverity, AlertName, Description, ProviderName, UrlEntity, Status, Tactics, Techniques\",\"size\":1,\"title\":\"Request URLs matching with Entities in Security Alert table\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"33\",\"name\":\"query - 9\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllSrcHostnames = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(SrcHostname)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcHostname\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcHostname_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcHostname=SrcHostname_s\\r\\n )\\r\\n | distinct SrcHostname;\\r\\nSecurityAlert\\r\\n| where TimeGenerated > {TimeRange:start}\\r\\n | extend Parsed_Entities = parse_json(Entities)\\r\\n | mv-expand Parsed_Entities\\r\\n | extend Parsed_EntityType=tostring(Parsed_Entities.Type)\\r\\n | where Parsed_EntityType =~ 'host'\\r\\n | extend HostEntity = tostring(Parsed_Entities.HostName)\\r\\n | project-away Parsed_Entities\\r\\n| where HostEntity in~ (AllSrcHostnames)\\r\\n| project TimeGenerated, AlertSeverity, AlertName, Description, ProviderName, HostEntity, Status, Tactics, Techniques\",\"size\":1,\"title\":\"Source HostNames matching with Entities in Security Alert table\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"33\",\"name\":\"query - 10\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"tabVisibility\",\"comparison\":\"isEqualTo\",\"value\":\"threatevents\"},\"name\":\"Threat Events\"}],\"fallbackResourceIds\":[],\"fromTemplateId\":\"sentinel-WebSessionDomainSolution\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Web Session Essentials\\n---\\n\\nThe 'Web Session Essentials' workbook provides real-time insights into activity and potential threats in your network.\\n\\nThis workbook is designed for network teams, security architects, analysts, and consultants to monitor, identify and investigate threats on Web servers, Web Proxies and Web Security Gateways assets. This Workbook gives a summary of analysed web traffic and helps with threat analysis and investigating suspicious http traffic.\\n\\nThe \\\"SummarizeWebSessionData\\\" Playbook installed along with the solution helps in summarizing the logs and improving the performance of the Workbook and data searches. This Workbook leverages the default as well as custom web session summarized data tables for visualising the data. Although enabling the summarization playbook is optional, we highly recommend enabling it for better user experience in environments with high EPS (events per second) data ingestion. Please note that summarization would require the playbook to run on a scheduled basis to utilise this workbook's capabilities.\\n\\nSummarized web session data can found in following custom tables:\\n- WebSession_Summarized_SrcInfo_CL\\n- WebSession_Summarized_SrcIP_CL\\n- WebSession_Summarized_DstIP_CL\\n- WebSession_Summarized_ThreatInfo_CL\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"10f90ed9-b14c-4bd3-8618-fe92d29d0055\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::selected\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"a28728e5-2c6b-4f0f-9b2e-906fe24c52a6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"query\":\"summarize by subscriptionId\\r\\n| project value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\",\"crossComponentResources\":[\"value::selected\"],\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"c8af6801-1cdf-47f6-b959-a7774b2f5faf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"description\":\"Select required Log Analytics Workspace\",\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| project id\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":\"\"},{\"id\":\"b875f4b5-5a7c-4cf1-baf9-7b860f737cb8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":604800000}},{\"id\":\"ab5ebbc3-a282-4ee4-9cc0-7cfebaa7e06a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LastIngestionTimeSrcInfo\",\"type\":1,\"description\":\"Get last ingestion time in WebSession_Summarized_SrcInfo_CL custom table\",\"isRequired\":true,\"query\":\"let LastIngestionTime = toscalar (\\r\\n union isfuzzy=true \\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | summarize max_TimeGenerated=max(EventTime_t)\\r\\n | extend max_TimeGenerated = datetime_add('hour', 1, max_TimeGenerated)\\r\\n ),\\r\\n (\\r\\n print({TimeRange:start})\\r\\n | extend max_TimeGenerated = print_0\\r\\n | project max_TimeGenerated\\r\\n )\\r\\n | summarize maxTimeGenerated = max(max_TimeGenerated) \\r\\n );\\r\\n print LastIngestionTime\",\"crossComponentResources\":[\"{Workspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"b8fc59a5-83c9-4ec1-9dfa-f71fa4e1ad15\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LastIngestionTimeSrcIP\",\"type\":1,\"description\":\"Get last ingestion time in WebSession_Summarized_SrcIP_CL custom table\",\"isRequired\":true,\"query\":\"let LastIngestionTime = toscalar (\\r\\n union isfuzzy=true \\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | summarize max_TimeGenerated=max(EventTime_t)\\r\\n | extend max_TimeGenerated = datetime_add('hour', 1, max_TimeGenerated)\\r\\n ),\\r\\n (\\r\\n print({TimeRange:start})\\r\\n | extend max_TimeGenerated = print_0\\r\\n | project max_TimeGenerated\\r\\n )\\r\\n | summarize maxTimeGenerated = max(max_TimeGenerated) \\r\\n );\\r\\n print LastIngestionTime\",\"crossComponentResources\":[\"{Workspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"c318ae1b-984d-4f08-a0a1-46f0a8e62252\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LastIngestionTimeDstIP\",\"type\":1,\"description\":\"Get last ingestion time in WebSession_Summarized_DstIP_CL custom table\",\"isRequired\":true,\"query\":\"let LastIngestionTime = toscalar (\\r\\n union isfuzzy=true \\r\\n (\\r\\n WebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | summarize max_TimeGenerated=max(EventTime_t)\\r\\n | extend max_TimeGenerated = datetime_add('hour', 1, max_TimeGenerated)\\r\\n ),\\r\\n (\\r\\n print({TimeRange:start})\\r\\n | extend max_TimeGenerated = print_0\\r\\n | project max_TimeGenerated\\r\\n )\\r\\n | summarize maxTimeGenerated = max(max_TimeGenerated) \\r\\n );\\r\\n print LastIngestionTime\",\"crossComponentResources\":[\"{Workspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"041050ed-6db3-42ae-96cd-100abebd7492\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LastIngestionTimeThreatInfo\",\"type\":1,\"description\":\"Get last ingestion time in WebSession_Summarized_ThreatInfo_CL custom table\",\"isRequired\":true,\"query\":\"let LastIngestionTime = toscalar (\\r\\n union isfuzzy=true \\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | summarize max_TimeGenerated=max(EventTime_t)\\r\\n | extend max_TimeGenerated = datetime_add('hour', 1, max_TimeGenerated)\\r\\n ),\\r\\n (\\r\\n print({TimeRange:start})\\r\\n | extend max_TimeGenerated = print_0\\r\\n | project max_TimeGenerated\\r\\n )\\r\\n | summarize maxTimeGenerated = max(max_TimeGenerated) \\r\\n );\\r\\n print LastIngestionTime\",\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"7c67ea90-b8cb-44e0-b7e0-24d7b55e2680\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SrcIpAddr\",\"label\":\"Source IP\",\"type\":2,\"description\":\"search single or multiple Source IPs\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(SrcIpAddr)\\r\\n | distinct SrcIpAddr\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcIpAddr_s)\\r\\n | distinct SrcIpAddr=SrcIpAddr_s\\r\\n )\\r\\n | distinct SrcIpAddr\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"value\":[\"value::all\"]},{\"id\":\"a8533e73-c384-4490-94d7-a86b0298add0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SrcUsername\",\"label\":\"User name\",\"type\":2,\"description\":\"search single or multiple usernames\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(SrcUsername)\\r\\n | distinct SrcUsername\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcUsername_s)\\r\\n | distinct SrcUsername=SrcUsername_s\\r\\n )\\r\\n | distinct SrcUsername\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"value\":[\"value::all\"]},{\"id\":\"161946b4-aa92-4bc3-8ae1-8b4ee67389ea\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SrcHostname\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(SrcHostname)\\r\\n | distinct SrcHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcHostname_s)\\r\\n | distinct SrcHostname=SrcHostname_s\\r\\n )\\r\\n | distinct SrcHostname\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\"},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"value\":[\"value::all\"],\"label\":\"Source Host\"},{\"id\":\"e67b1965-4b24-45bd-9e07-64892a11ed5c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DstHostname\",\"type\":2,\"description\":\"search single or multiple URLs\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(Url)\\r\\n | extend SiteName = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | distinct SiteName\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DestDomain_s)\\r\\n | distinct SiteName = DestDomain_s\\r\\n )\\r\\n | distinct SiteName\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"value\":[\"value::all\"],\"label\":\"Dest Site\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"tabStyle\":\"bigger\",\"links\":[{\"id\":\"c3e512f5-3e3f-41f3-b645-121f7bd6a557\",\"cellValue\":\"tabVisibility\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Web servers\",\"subTarget\":\"webservers\",\"preText\":\"Web servers\",\"style\":\"link\"},{\"id\":\"6d785be8-da74-4cae-977f-576d5d3fa070\",\"cellValue\":\"tabVisibility\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Web Proxies and Security Gateways\",\"subTarget\":\"webproxies\",\"style\":\"link\"},{\"id\":\"9f095674-3da6-4a46-aae9-6820b2b4baee\",\"cellValue\":\"tabVisibility\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Top Queries\",\"subTarget\":\"topQueries\",\"style\":\"link\"},{\"id\":\"e4f43157-d64d-41d2-8f9d-e39a30b0c1ce\",\"cellValue\":\"tabVisibility\",\"linkTarget\":\"parameter\",\"linkLabel\":\"View Threat Events\",\"subTarget\":\"threatevents\",\"style\":\"link\"}]},\"name\":\"links - 8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let uniqueConnection = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n\\t\\t| where isnotempty(SrcIpAddr) and isnotempty(Url)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize count() by SrcIpAddr, DestHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n\\t\\t| where isnotempty(SrcIpAddr_s) and isnotempty(DestDomain_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize count() by SrcIpAddr, DestHostname\\r\\n )\\r\\n | summarize count() by SrcIpAddr, DestHostname\\r\\n | count\\r\\n | extend Metric = \\\"Unique Connections\\\", orderNum = 1;\\r\\nlet products = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where isnotempty(EventProduct)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct EventProduct\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(EventProduct_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct EventProduct=EventProduct_s\\r\\n )\\r\\n | distinct EventProduct\\r\\n | count\\r\\n | extend Metric = \\\"Product Count\\\", orderNum = 2;\\r\\nlet UserNames = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where isnotempty(SrcUsername)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcUsername\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcUsername_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcUsername\\r\\n )\\r\\n | distinct SrcUsername\\r\\n | count\\r\\n | extend Metric = \\\"Unique UserNames\\\", orderNum = 3;\\r\\nlet Srchosts = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where isnotempty(SrcHostname)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcHostname_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcHostname=SrcHostname_s\\r\\n )\\r\\n | distinct SrcHostname\\r\\n | count\\r\\n | extend Metric = \\\"Source HostNames\\\", orderNum = 4;\\r\\nlet ClientIPs = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where isnotempty(SrcIpAddr)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcIpAddr\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcIpAddr_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcIpAddr=SrcIpAddr_s\\r\\n )\\r\\n | distinct SrcIpAddr\\r\\n | count\\r\\n | extend Metric = \\\"Unique Source IPs\\\", orderNum = 5;\\r\\nlet DestHostName = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where isnotempty(Url)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DestDomain_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n )\\r\\n | distinct DestHostname\\r\\n | count\\r\\n | extend Metric = \\\"Unique Dest Sites\\\", orderNum = 6;\\r\\nlet TotalUserAgents = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where isnotempty(HttpUserAgent)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}))\\r\\n | distinct HttpUserAgent\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(HttpUserAgent_s)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}))\\r\\n | distinct HttpUserAgent=HttpUserAgent_s\\r\\n )\\r\\n | distinct HttpUserAgent\\r\\n | count\\r\\n | extend Metric = \\\"Unique UserAgents\\\", orderNum = 7;\\r\\nlet ServerErrorsCount = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where toint(EventResultDetails) between (500 .. 599)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventResultDetails, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where toint(EventResultDetails_s) between (500 .. 599)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, EventResultDetails=EventResultDetails_s, EventTime = EventTime_t, EventCount = EventCount_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by EventResultDetails, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize Count = sum(EventCount)\\r\\n | extend Metric = \\\"Total Server Errors\\\", orderNum = 8;\\r\\nlet ClientErrorsCount = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where toint(EventResultDetails) between (400 .. 499)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventResultDetails, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where toint(EventResultDetails_s) between (400 .. 499)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, EventResultDetails=EventResultDetails_s, EventTime = EventTime_t, EventCount = EventCount_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by EventResultDetails, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize Count = sum(EventCount)\\r\\n | extend Metric = \\\"Total Client Errors\\\", orderNum = 9;\\r\\nunion uniqueConnection, products, UserNames, Srchosts, ClientIPs, DestHostName, TotalUserAgents, ServerErrorsCount, ClientErrorsCount | where Count != 0\\r\\n| order by orderNum asc\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Metric\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where isnotempty(EventProduct)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventProduct, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | extend EventProduct = EventProduct_s\\r\\n | where isnotempty(EventProduct)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount_d)) by EventProduct, bin(TimeGenerated=EventTime_t,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by EventProduct, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Events by products over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"EventProduct\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"EventCount\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"EventProduct\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"EventCount\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"EventCount\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"EventCount\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"EventCount\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"50\",\"name\":\"Events by products over time - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | where isnotempty(EventResultDetails) and EventResultDetails !~ 'NA'\\r\\n | where toint(EventResultDetails) between (400 .. 599)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventResultDetails, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | project\\r\\n EventResultDetails= EventResultDetails_s,\\r\\n EventTime = EventTime_t,\\r\\n EventCount = EventCount_d,\\r\\n SrcIpAddr=SrcIpAddr_s,\\r\\n DestHostname=DestDomain_s,\\r\\n SrcUsername=SrcUsername_s,\\r\\n SrcHostname=SrcHostname_s\\r\\n | where isnotempty(EventResultDetails) and EventResultDetails !~ 'NA'\\r\\n | where toint(EventResultDetails) between (400 .. 599)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by EventResultDetails, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n| summarize EventCount = sum(EventCount) by EventResultDetails, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Events by error type over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"EventResultDetails\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"EventCount\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"Count by errors type over time\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true\\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and ipv4_is_private(SrcIpAddr)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize RequestCount=tolong(count()) by User, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | extend User = coalesce(SrcUsername_s, SrcIpAddr_s)\\r\\n | where isnotempty(User) and ipv4_is_private(SrcIpAddr_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, EventTime=EventTime_t, EventCount=EventCount_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize RequestCount=tolong(sum(EventCount)) by User, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n | summarize RequestCount = sum(RequestCount) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize RequestCount = sum(RequestCount) by User\\r\\n| order by RequestCount desc\\r\\n| take 10\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top internal users by request count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"Top internal users by request count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true\\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and not(ipv4_is_private(SrcIpAddr))\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize RequestCount=tolong(count()) by User, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | extend User = coalesce(SrcUsername_s, SrcIpAddr_s)\\r\\n | where isnotempty(User) and not(ipv4_is_private(SrcIpAddr_s))\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, EventTime=EventTime_t, EventCount=EventCount_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize RequestCount=tolong(sum(EventCount)) by User, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n | summarize RequestCount = sum(RequestCount) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize RequestCount = sum(RequestCount) by User\\r\\n| order by RequestCount desc\\r\\n| take 10\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top external users by request count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"Top external clients by request count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_Im_WebSession(starttime={TimeRange:start}, endtime=now())\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| where isnotempty(EventSeverity)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize RequestCount=tolong(count()) by EventSeverity\",\"size\":1,\"showAnalytics\":true,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"query - 7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeDstIP}'), endtime=now())\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(DstHostname)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by DstHostname, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | extend DstHostname_s = coalesce(DstHostname_s, DstIpAddr_s)\\r\\n | project EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, DstHostname=DstHostname_s, DestHostname=DestDomain_s\\r\\n | where isnotempty(DstHostname)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by DstHostname, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by DstHostname\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by DstHostname\\r\\n) on DstHostname\\r\\n| project WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top web hosts with most request count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"25\",\"name\":\"Top web hosts with most request count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_Im_WebSession(starttime={TimeRange:start}, eventresult='Failure')\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| where isnotempty(Url)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=count() by Url\\r\\n| order by EventCount desc \\r\\n| take 25\",\"size\":3,\"showAnalytics\":true,\"title\":\"Urls with most failed requests\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Url\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"EventCount\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"name\":\"Urls with most failed requests\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeDstIP}'), endtime=now())\\r\\n| where EventType =~ 'WebServerSession'\\r\\n | extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(DstHostname) and toint(EventResultDetails) between (500 .. 599)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by DstHostname, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | extend DstHostname_s = coalesce(DstHostname_s, DstIpAddr_s)\\r\\n | project EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, DstHostname=DstHostname_s, DestHostname=DestDomain_s\\r\\n | where isnotempty(DstHostname) and toint(EventResultDetails) between (500 .. 599)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by DstHostname, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by DstHostname\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by DstHostname\\r\\n) on DstHostname\\r\\n| project WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top web hosts with most server errors\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top web hosts with most server errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeDstIP}'), endtime=now())\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(DstHostname) and toint(EventResultDetails) between (400 .. 499)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by DstHostname, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'WebServerSession'\\r\\n | extend DstHostname_s = coalesce(DstHostname_s, DstIpAddr_s)\\r\\n | project EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, DstHostname=DstHostname_s, DestHostname=DestDomain_s\\r\\n | where isnotempty(DstHostname) and toint(EventResultDetails) between (400 .. 499)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by DstHostname, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by DstHostname\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by DstHostname\\r\\n) on DstHostname\\r\\n| project WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top web hosts with most client errors\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top web hosts with most client errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n_Im_WebSession(starttime={TimeRange:start}, endtime=now())\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n| extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (400 .. 499)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by User, DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by User, DstHostname\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User, DstHostname\\r\\n) on User, DstHostname\\r\\n| project User, WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top users with most client errors\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top users with most client errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n_Im_WebSession(starttime={TimeRange:start}, endtime=now())\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n| extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (500 .. 599)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n| where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\nand ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\nand ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\nand ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by User, DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by User, DstHostname\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User, DstHostname\\r\\n) on User, DstHostname\\r\\n| project User, WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top users with most server errors\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top users with most server errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n _Im_WebSession(starttime={TimeRange:start}, endtime=now(), eventresult='Success')\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(HttpUserAgent) and HttpUserAgent != 'Unknown'\\r\\n | summarize EventCount=tolong(count()) by HttpUserAgent, DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpUserAgent, DstHostname\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpUserAgent, DstHostname\\r\\n )\\r\\n on HttpUserAgent, DstHostname\\r\\n| project HttpUserAgent, WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Rare User Agent requests resulted in success\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Rare User Agent requests resulted in success\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n _Im_WebSession(starttime={TimeRange:start}, endtime=now(), eventresult='Failure')\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(HttpUserAgent) and HttpUserAgent != 'Unknown'\\r\\n | summarize EventCount=tolong(count()) by HttpUserAgent, DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpUserAgent, DstHostname\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpUserAgent, DstHostname\\r\\n )\\r\\n on HttpUserAgent, DstHostname\\r\\n| project HttpUserAgent, WebServer=DstHostname, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Rare User Agent requests resulted in errors\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Rare User Agent requests resulted in errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeDstIP}'), endtime=now())\\r\\n | where EventType =~ 'WebServerSession'\\r\\n | extend DstHostname = coalesce(DstHostname, DstIpAddr)\\r\\n | where isnotempty(DstHostname) and isnotempty(DstBytes)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataReceived=tolong(sum(DstBytes)) by DstHostname, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_DstIP_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| where EventType_s =~ 'WebServerSession'\\r\\n| extend DstHostname_s = coalesce(DstHostname_s, DstIpAddr_s)\\r\\n| project EventCount=EventCount_d, EventTime=EventTime_t, DstHostname=DstHostname_s, DestHostname=DestDomain_s, DstBytes= DstBytes_d\\r\\n | where isnotempty(DstHostname) and isnotempty(DstBytes)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataReceived=tolong(sum(DstBytes)) by DstHostname, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize DataReceived = sum(DataReceived) by DstHostname, bin(TimeGenerated, {TimeRange:grain});\\r\\n WebData\\r\\n | summarize DataReceived = sum(DataReceived) by DstHostname\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(DataReceived) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by DstHostname\\r\\n ) on DstHostname\\r\\n | project WebServer=DstHostname, DataReceived=DataReceived, Trend\\r\\n | order by DataReceived desc\\r\\n | take 25\",\"size\":1,\"title\":\"Top Web servers with highest download\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top Web servers with highest download\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let common_file_ext_list = dynamic([\\\".txt\\\", \\\".xlsx\\\", \\\".doc\\\", \\\".docx\\\", \\\".csv\\\", \\\".pdf\\\", \\\".png\\\", \\\".jpg\\\", \\\".jpeg\\\"]); // Add list of common files as per your environment\\r\\n_Im_WebSession (starttime={TimeRange:start}, eventresult='Success')\\r\\n| where EventType =~ 'WebServerSession'\\r\\n| where HttpRequestMethod in~ (\\\"POST\\\", \\\"PUT\\\") \\r\\n| project\\r\\n Url,\\r\\n SrcIpAddr,\\r\\n SrcUsername,\\r\\n SrcHostname,\\r\\n DstIpAddr,\\r\\n DstPortNumber,\\r\\n DstHostname,\\r\\n TimeGenerated\\r\\n| extend requestedFileName=tostring(split(tostring(parse_url(Url)[\\\"Path\\\"]), '/')[-1])\\r\\n| extend FileWithdualextension = extract(@'([\\\\w-]+\\\\.\\\\w+\\\\.\\\\w+)$', 1, requestedFileName, typeof(string))\\r\\n| extend SecondExt = tostring(split(FileWithdualextension, '.')[-1])\\r\\n| where strcat('.', SecondExt) in~ (common_file_ext_list) // Second extension is mostly from the common files\\r\\n| summarize\\r\\n EventCount=count(),\\r\\n EventStartTime=min(TimeGenerated),\\r\\n EventEndTime=max(TimeGenerated)\\r\\n by\\r\\n SrcIpAddr,\\r\\n Url,\\r\\n FileWithdualextension,\\r\\n SrcUsername,\\r\\n SrcHostname,\\r\\n DstIpAddr,\\r\\n DstPortNumber,\\r\\n DstHostname\",\"size\":1,\"title\":\"Possible malicious double extension file upload\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"tabVisibility\",\"comparison\":\"isEqualTo\",\"value\":\"webservers\"},\"name\":\"Web servers\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let uniqueConnection = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n\\t\\t| where isnotempty(SrcIpAddr) and isnotempty(Url)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize count() by SrcIpAddr, DestHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n\\t\\t| where isnotempty(SrcIpAddr_s) and isnotempty(DestDomain_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize count() by SrcIpAddr, DestHostname\\r\\n )\\r\\n | summarize count() by SrcIpAddr, DestHostname\\r\\n | count\\r\\n | extend Metric = \\\"Unique Connections\\\", orderNum = 1;\\r\\nlet products = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where isnotempty(EventProduct)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct EventProduct\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotempty(EventProduct_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct EventProduct=EventProduct_s\\r\\n )\\r\\n | distinct EventProduct\\r\\n | count\\r\\n | extend Metric = \\\"Product Count\\\", orderNum = 2;\\r\\nlet UserNames = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where isnotempty(SrcUsername)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcUsername\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotempty(SrcUsername_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcUsername\\r\\n )\\r\\n | distinct SrcUsername\\r\\n | count\\r\\n | extend Metric = \\\"Unique UserNames\\\", orderNum = 3;\\r\\nlet Srchosts = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(SrcHostname)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotempty(SrcHostname_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcHostname=SrcHostname_s\\r\\n )\\r\\n | distinct SrcHostname\\r\\n | count\\r\\n | extend Metric = \\\"Source HostNames\\\", orderNum = 4;\\r\\nlet ClientIPs = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(SrcIpAddr)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcIpAddr\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotempty(SrcIpAddr_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcIpAddr=SrcIpAddr_s\\r\\n )\\r\\n | distinct SrcIpAddr\\r\\n | count\\r\\n | extend Metric = \\\"Unique Source IPs\\\", orderNum = 5;\\r\\nlet DestHostName = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(Url)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotempty(DestDomain_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n )\\r\\n | distinct DestHostname\\r\\n | count\\r\\n | extend Metric = \\\"Unique Dest HostNames\\\", orderNum = 6;\\r\\nlet TotalUserAgents = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(HttpUserAgent)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}))\\r\\n | distinct HttpUserAgent\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotempty(HttpUserAgent_s)\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}))\\r\\n | distinct HttpUserAgent=HttpUserAgent_s\\r\\n )\\r\\n | distinct HttpUserAgent\\r\\n | count\\r\\n | extend Metric = \\\"Unique UserAgents\\\", orderNum = 7;\\r\\nunion uniqueConnection, products, UserNames, Srchosts, ClientIPs, DestHostName, TotalUserAgents | where Count != 0\\r\\n| order by orderNum asc\",\"size\":4,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Metric\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Unique Connections\",\"representation\":\"Connect\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Product Count\",\"representation\":\"Normal\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Unique UserNames\",\"representation\":\"AvatarDefault\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Source HostNames\",\"representation\":\"resource\"},{\"operator\":\"==\",\"thresholdValue\":\"Unique Source IPs\",\"representation\":\"Publish\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Unique UserAgents\",\"representation\":\"Important\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Unique Hosts\",\"representation\":\"Book\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":true,\"size\":\"auto\"}},\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(EventProduct)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventProduct, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | extend EventProduct = EventProduct_s\\r\\n | where isnotempty(EventProduct)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount_d)) by EventProduct, bin(TimeGenerated=EventTime_t,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by EventProduct, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Events by products over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"EventProduct\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"EventCount\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"EventProduct\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"EventCount\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"EventCount\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"EventCount\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"EventCount\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"33\",\"name\":\"Events by products over time\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(EventResult)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventResult, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | extend EventResult = EventResult_s\\r\\n | where isnotempty(EventResult)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount_d)) by EventResult, bin(TimeGenerated=EventTime_t,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by EventResult, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Events by result over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"EventResult\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"EventCount\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failure\",\"color\":\"red\"},{\"seriesName\":\"Success\",\"color\":\"green\"}]},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"EventCount\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"EventCount\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"EventCount\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"33\",\"name\":\"Events by result over time\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | where toint(EventResultDetails) > 399 // Take events resulted in errors\\r\\n | summarize EventCount=tolong(count()) by EventResultDetails, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | extend\\r\\n SrcIpAddr=SrcIpAddr_s,\\r\\n DestHostname=DestDomain_s,\\r\\n SrcUsername=SrcUsername_s,\\r\\n SrcHostname=SrcHostname_s,\\r\\n SrcBytes = SrcBytes_d,\\r\\n DstBytes = DstBytes_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | where toint(EventResultDetails_s) > 399 // Take events resulted in errors\\r\\n | summarize EventCount=tolong(sum(EventCount_d)) by EventResultDetails=EventResultDetails_s, TimeGenerated=bin(EventTime_t, {TimeRange:grain})\\r\\n )\\r\\n| summarize EventCount = sum(EventCount) by EventResultDetails, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Errors by type over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\"},\"customWidth\":\"33\",\"name\":\"Errors by type over time\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotempty(EventType)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by EventType, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | extend EventType=EventType_s, EventCount=EventCount_d, EventTime=EventTime_t\\r\\n | where isnotempty(EventType)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by EventType, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by EventType, bin(TimeGenerated, {TimeRange:grain})\",\"size\":1,\"showAnalytics\":true,\"title\":\"Events by type\",\"color\":\"lightBlue\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"20\",\"name\":\"Events by type\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | where isnotnull(SrcBytes) or isnotnull(DstBytes)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataSent=tolong(sum(SrcBytes)), DataReceived=tolong(sum(DstBytes)) by bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n | where isnotnull(SrcBytes_d) or isnotnull(DstBytes_d)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, SrcBytes = SrcBytes_d, DstBytes = DstBytes_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataSent=tolong(sum(SrcBytes)), DataReceived=tolong(sum(DstBytes)) by bin(TimeGenerated=EventTime_t,{TimeRange:grain})\\r\\n )\\r\\n | summarize DataSent = sum(DataSent), DataReceived=tolong(sum(DataReceived)) by bin(TimeGenerated, {TimeRange:grain})\\r\\n | project DataSentinGB = format_bytes(DataSent,0,'GB'), DataReceivedinGB=format_bytes(DataReceived,0,'GB'), TimeGenerated\\r\\n | extend DataSentinGB = toint(replace_string(DataSentinGB,\\\" GB\\\",\\\"\\\")), DataReceivedinGB = toint(replace_string(DataReceivedinGB,\\\" GB\\\",\\\"\\\"))\",\"size\":1,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Sent and Received data in GB over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"40\",\"name\":\"Sent and Received data in GB over time\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where EventType =~ 'HTTPsession'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DestHostnameSet = make_set(DestHostname, 1000000) by bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where EventType_s =~ 'HTTPsession'\\r\\n| where isnotempty(DestDomain_s)\\r\\n| extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, SrcBytes = SrcBytes_d, DstBytes = DstBytes_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize DestHostnameSet = make_set(DestHostname, 1000000) by TimeGenerated=bin(EventTime_t, {TimeRange:grain})\\r\\n)\\r\\n| summarize TotalSites = array_length(make_set(DestHostnameSet, 1000000)) by bin(TimeGenerated, {TimeRange:grain})\\r\\n\",\"size\":1,\"aggregation\":3,\"showAnalytics\":true,\"title\":\"Distinct requested applications over time\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"customWidth\":\"40\",\"name\":\"Distinct requested applications over time\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_Im_WebSession(starttime={TimeRange:start}, eventresult='Failure')\\r\\n| where EventType =~ 'HTTPsession'\\r\\n| where isnotempty(Url)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=count() by Url\\r\\n| order by EventCount desc \\r\\n| take 25\",\"size\":0,\"showAnalytics\":true,\"title\":\"Urls with most failed requests count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Url\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"EventCount\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Urls with most failed requests count\"}]},\"conditionalVisibility\":{\"parameterName\":\"tabVisibility\",\"comparison\":\"isEqualTo\",\"value\":\"webproxies\"},\"name\":\"Group - Web Proxies and Security Gateways\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | extend DestDomain = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestDomain in~ ({DstHostname})))\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and isnotempty(DestDomain)\\r\\n | summarize RequestCount=tolong(count()) by User, DestDomain, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project\\r\\n SrcUsername=SrcUsername_s,\\r\\n SrcIpAddr=SrcIpAddr_s,\\r\\n SrcHostname=SrcHostname_s,\\r\\n TimeGenerated=EventTime_t,\\r\\n DestDomain=DestDomain_s,\\r\\n EventCount=EventCount_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestDomain in~ ({DstHostname})))\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and isnotempty(DestDomain)\\r\\n | summarize RequestCount=tolong(sum(EventCount)) by User, DestDomain, bin(TimeGenerated, {TimeRange:grain})\\r\\n )\\r\\n | summarize RequestCount = sum(RequestCount) by User, DestDomain, bin(TimeGenerated, {TimeRange:grain});\\r\\nlet UserData = WebData\\r\\n | summarize RequestCount=sum(RequestCount) by User\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(RequestCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User)\\r\\n on User\\r\\n | order by RequestCount desc, User asc;\\r\\nWebData\\r\\n| summarize RequestCount=sum(RequestCount) by User, DestDomain\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(RequestCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User, DestDomain\\r\\n) on User, DestDomain\\r\\n| order by RequestCount desc, User asc\\r\\n| project Id=DestDomain, Name=DestDomain, RequestCount, Trend, ParentId=User, Type='DestDomain'\\r\\n| union (UserData\\r\\n| project Id=User, Name=User, RequestCount, Trend, ParentId = 'root', Type='User'\\r\\n)\\r\\n| order by RequestCount desc, Name asc\\r\\n| take 25\",\"size\":1,\"title\":\"Top sites of the top users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Id\",\"formatter\":5},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"ParentId\",\"formatter\":5}],\"hierarchySettings\":{\"idColumn\":\"Id\",\"parentColumn\":\"ParentId\",\"treeType\":0,\"expanderColumn\":\"Name\",\"expandTopLevel\":false}}},\"customWidth\":\"50\",\"name\":\"Top sites of the top users\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by User, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | extend EventCount=EventCount_d, SrcIpAddr=SrcIpAddr_s, EventTime=EventTime_t, SrcUsername=SrcUsername_s, DestHostname=DestDomain_s, SrcHostname=SrcHostname_s\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by User, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\n WebData\\r\\n | summarize EventCount = sum(EventCount) by User\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User\\r\\n ) on User\\r\\n | project User, EventCount, Trend\\r\\n | order by EventCount desc\\r\\n | take 25\",\"size\":1,\"title\":\"Top Users with most request count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"User\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"25%\"}},{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"25%\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\",\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":\"[]\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top Users with most request count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (400 .. 499)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by User, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (400 .. 499)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by User, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by User\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User\\r\\n) on User\\r\\n| project User, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top Users with most client errors\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top Users with most client errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (500 .. 599)\\r\\n| extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by User, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (500 .. 599)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by User, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by User\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User\\r\\n) on User\\r\\n| project User, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top Users with most server errors\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top Users with most server errors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (400 .. 499)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by EventResultDetails=toint(EventResultDetails), bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcIP_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (400 .. 499)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by EventResultDetails=toint(EventResultDetails), bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by EventResultDetails, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by EventResultDetails\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by EventResultDetails\\r\\n) on EventResultDetails\\r\\n| project EventResultDetails, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top client error types\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top client error types\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (500 .. 599)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(count()) by EventResultDetails=toint(EventResultDetails), bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcIP_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s\\r\\n| extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and toint(EventResultDetails) between (500 .. 599)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n| summarize EventCount=tolong(sum(EventCount)) by EventResultDetails=toint(EventResultDetails), bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by EventResultDetails, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by EventResultDetails\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by EventResultDetails\\r\\n) on EventResultDetails\\r\\n| project EventResultDetails, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top server error types\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top server error types\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Webdata = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now(), eventresult='Success')\\r\\n | extend Website = case(\\r\\n isnotempty(DstDomain),DstDomain\\r\\n , isnotempty(Url),tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n ,\\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\"\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | summarize EventCount = count() by Website, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n | project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s, DstBytes= DstBytes_d, EventResult_s\\r\\n | extend Website = case(\\r\\n isnotempty(DestHostname),DestHostname\\r\\n ,\\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\" and EventResult_s =~ 'Success'\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by Website, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by Website, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebdata\\r\\n| summarize EventCount = sum(EventCount) by Website\\r\\n| join kind = inner (\\r\\nWebdata | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by Website\\r\\n) \\r\\non Website\\r\\n| project Website, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top websites by successful requests count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top websites by successful requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Webdata = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now(), eventresult='Failure')\\r\\n | extend Website = case(\\r\\n isnotempty(DstDomain),DstDomain\\r\\n , isnotempty(Url),tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n ,\\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\"\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | summarize EventCount = count() by Website, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n | project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s, DstBytes= DstBytes_d, EventResult_s\\r\\n | extend Website = case(\\r\\n isnotempty(DestHostname),DestHostname\\r\\n ,\\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\" and EventResult_s =~ 'Failure'\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by Website, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by Website, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebdata\\r\\n| summarize EventCount = sum(EventCount) by Website\\r\\n| join kind = inner (\\r\\nWebdata | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by Website\\r\\n) \\r\\non Website\\r\\n| project Website, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top websites by failed requests count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RequestCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top websites by failed requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and isnotempty(SrcBytes)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataSent=tolong(sum(SrcBytes)) by User, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s, SrcBytes= SrcBytes_d\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and isnotempty(SrcBytes)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataSent=tolong(sum(SrcBytes)) by User, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize DataSent = sum(DataSent) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\n WebData\\r\\n | summarize DataSent = sum(DataSent) by User\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(DataSent) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User\\r\\n ) on User\\r\\n | project User, DataSentinMB=DataSent/1048576, Trend\\r\\n | order by DataSentinMB desc\\r\\n | take 25\",\"size\":1,\"title\":\"Users with highest upload (MB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DataSentinMB\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"SentData\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Users with highest upload (MB)\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and isnotempty(DstBytes)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataReceived=tolong(sum(DstBytes)) by User, bin(TimeGenerated,{TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project SrcIpAddr=SrcIpAddr_s, EventResultDetails=EventResultDetails_s, EventCount=EventCount_d, EventTime=EventTime_t, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s, DestHostname=DestDomain_s, DstBytes= DstBytes_d\\r\\n | extend User = coalesce(SrcUsername, SrcIpAddr)\\r\\n | where isnotempty(User) and isnotempty(DstBytes)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataReceived=tolong(sum(DstBytes)) by User, bin(TimeGenerated=EventTime,{TimeRange:grain})\\r\\n )\\r\\n | summarize DataReceived = sum(DataReceived) by User, bin(TimeGenerated, {TimeRange:grain});\\r\\n WebData\\r\\n | summarize DataReceived = sum(DataReceived) by User\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(DataReceived) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by User\\r\\n ) on User\\r\\n | project User, DataReceivedinMB=DataReceived/1048576, Trend\\r\\n | order by DataReceivedinMB desc\\r\\n | take 25\",\"size\":1,\"title\":\"Users with highest download (MB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DataReceivedinMB\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Users with highest download (MB)\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | extend Website = case(\\r\\n isnotempty(DstDomain),\\r\\n DstDomain\\r\\n ,\\r\\n isnotempty(Url),\\r\\n tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n ,\\r\\n \\\"NA\\\"\\r\\n )\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | where Website != \\\"NA\\\" and isnotempty(SrcBytes)\\r\\n | summarize DataSent=tolong(sum(SrcBytes)) by Website, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project\\r\\n SrcIpAddr=SrcIpAddr_s,\\r\\n EventResultDetails=EventResultDetails_s,\\r\\n EventCount=EventCount_d,\\r\\n EventTime=EventTime_t,\\r\\n SrcUsername=SrcUsername_s,\\r\\n SrcHostname=SrcHostname_s,\\r\\n DestHostname=DestDomain_s,\\r\\n SrcBytes= SrcBytes_d\\r\\n | extend Website = case(\\r\\n isnotempty(DestHostname),\\r\\n DestHostname\\r\\n ,\\r\\n \\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\" and isnotnull(SrcBytes)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize DataSent=tolong(sum(SrcBytes)) by Website, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n | summarize DataSent = sum(DataSent) by Website, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize DataSent = sum(DataSent) by Website\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(DataSent) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by Website\\r\\n )\\r\\n on Website\\r\\n| project Website, DataSentinMB=DataSent / 1048576, Trend\\r\\n| order by DataSentinMB desc\\r\\n| take 25\",\"size\":1,\"title\":\"Websites with highest upload (MB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DataSentinMB\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Websites with highest upload (MB) (no summarization)\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | project DstDomain, Url, TimeGenerated, DstBytes, SrcIpAddr, SrcUsername, SrcHostname\\r\\n | extend Website = case(\\r\\n isnotempty(DstDomain),\\r\\n DstDomain\\r\\n ,\\r\\n isnotempty(Url),\\r\\n tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n ,\\r\\n \\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\" and isnotempty(DstBytes)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | where Website != \\\"NA\\\" and isnotempty(DstBytes)\\r\\n | summarize DataReceived=tolong(sum(DstBytes)) by Website, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project\\r\\n SrcIpAddr=SrcIpAddr_s,\\r\\n EventResultDetails=EventResultDetails_s,\\r\\n EventCount=EventCount_d,\\r\\n EventTime=EventTime_t,\\r\\n SrcUsername=SrcUsername_s,\\r\\n SrcHostname=SrcHostname_s,\\r\\n DestHostname=DestDomain_s,\\r\\n DstBytes= DstBytes_d\\r\\n | extend Website = case(\\r\\n isnotempty(DestHostname),\\r\\n DestHostname\\r\\n ,\\r\\n \\\"NA\\\"\\r\\n )\\r\\n | where Website != \\\"NA\\\" and isnotempty(DstBytes)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (Website in~ ({DstHostname})))\\r\\n | summarize DataReceived=tolong(sum(DstBytes)) by Website, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n | summarize DataReceived = sum(DataReceived) by Website, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize DataReceived = sum(DataReceived) by Website\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(DataReceived) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by Website\\r\\n )\\r\\n on Website\\r\\n| project Website, DataReceivedinMB=DataReceived / 1048576, Trend\\r\\n| order by DataReceivedinMB desc\\r\\n| take 25\",\"size\":1,\"title\":\"Websites with highest download(MB)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DataReceivedinMB\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Websites with highest download(MB)\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult='Success')\\r\\n| where isnotempty(HttpRequestMethod) and HttpRequestMethod != \\\"NA\\\"\\r\\n| summarize EventCount=tolong(count()) by HttpRequestMethod, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcInfo_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project HttpRequestMethod=HttpRequestMethod_s, EventCount=EventCount_d, EventTime=EventTime_t, EventResult=EventResult_s\\r\\n| where isnotempty(HttpRequestMethod) and HttpRequestMethod != \\\"NA\\\" and EventResult =~ 'Success'\\r\\n| summarize EventCount=tolong(sum(EventCount)) by HttpRequestMethod, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by HttpRequestMethod, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpRequestMethod\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpRequestMethod\\r\\n) on HttpRequestMethod\\r\\n| project HttpRequestMethod, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top HTTP request methods by successful requests count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP request methods by successful requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult='Failure')\\r\\n| where isnotempty(HttpRequestMethod) and HttpRequestMethod != \\\"NA\\\"\\r\\n| summarize EventCount=tolong(count()) by HttpRequestMethod, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcInfo_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project HttpRequestMethod=HttpRequestMethod_s, EventCount=EventCount_d, EventTime=EventTime_t, EventResult=EventResult_s\\r\\n| where isnotempty(HttpRequestMethod) and HttpRequestMethod != \\\"NA\\\" and EventResult =~ 'Failure'\\r\\n| summarize EventCount=tolong(sum(EventCount)) by HttpRequestMethod, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by HttpRequestMethod, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpRequestMethod\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpRequestMethod\\r\\n) on HttpRequestMethod\\r\\n| project HttpRequestMethod, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top HTTP request methods by failed requests count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP request methods by failed requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult='Success')\\r\\n| where isnotempty(HttpContentType) and HttpContentType != \\\"None\\\"\\r\\n| summarize EventCount=tolong(count()) by HttpContentType, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcInfo_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project HttpContentType=HttpContentType_s, EventCount=EventCount_d, EventTime=EventTime_t, EventResult=EventResult_s\\r\\n| where isnotempty(HttpContentType) and HttpContentType != \\\"None\\\" and EventResult =~ 'Success'\\r\\n| summarize EventCount=tolong(sum(EventCount)) by HttpContentType, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by HttpContentType, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpContentType\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpContentType\\r\\n) on HttpContentType\\r\\n| project HttpContentType, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top HTTP content types by successful requests count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP content types by successful requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\nunion isfuzzy=true \\r\\n(\\r\\n_Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult='Failure')\\r\\n| where isnotempty(HttpContentType) and HttpContentType != \\\"None\\\"\\r\\n| summarize EventCount=tolong(count()) by HttpContentType, bin(TimeGenerated, {TimeRange:grain})\\r\\n),\\r\\n(\\r\\nWebSession_Summarized_SrcInfo_CL\\r\\n| where EventTime_t >= {TimeRange:start}\\r\\n| project HttpContentType=HttpContentType_s, EventCount=EventCount_d, EventTime=EventTime_t, EventResult=EventResult_s\\r\\n| where isnotempty(HttpContentType) and HttpContentType != \\\"None\\\" and EventResult =~ 'Failure'\\r\\n| summarize EventCount=tolong(sum(EventCount)) by HttpContentType, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n)\\r\\n| summarize EventCount = sum(EventCount) by HttpContentType, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpContentType\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpContentType\\r\\n) on HttpContentType\\r\\n| project HttpContentType, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top HTTP content types by failed requests count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP content types by failed requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n _Im_WebSession(starttime = {TimeRange:start}, endtime=now(), eventresult='Success')\\r\\n | where isnotempty(HttpReferrer)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by HttpReferrer, bin(TimeGenerated,{TimeRange:grain})\\r\\n ;\\r\\n WebData\\r\\n | summarize EventCount = sum(EventCount) by HttpReferrer\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpReferrer\\r\\n ) on HttpReferrer\\r\\n | project HttpReferrer, EventCount, Trend\\r\\n | order by EventCount desc\\r\\n | take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top HTTP referrers by successful requests count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP referrers by successful requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n _Im_WebSession(starttime = {TimeRange:start}, endtime=now(), eventresult='Failure')\\r\\n | where isnotempty(HttpReferrer)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(count()) by HttpReferrer, bin(TimeGenerated,{TimeRange:grain})\\r\\n ;\\r\\n WebData\\r\\n | summarize EventCount = sum(EventCount) by HttpReferrer\\r\\n | join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpReferrer\\r\\n ) on HttpReferrer\\r\\n | project HttpReferrer, EventCount, Trend\\r\\n | order by EventCount desc\\r\\n | take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top HTTP referrers by failed requests count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP referrers by failed requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult=\\\"Failure\\\")\\r\\n | project UrlCategory, TimeGenerated\\r\\n | where isnotempty(UrlCategory)\\r\\n | summarize EventCount=tolong(count()) by UrlCategory, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project UrlCategory=UrlCategory_s, TimeGenerated=EventTime_t, EventCount=EventCount_d, EventResult = EventResult_s\\r\\n | where isnotempty(UrlCategory) and EventResult =~ \\\"Failure\\\"\\r\\n | summarize EventCount=tolong(sum(EventCount)) by UrlCategory, bin(TimeGenerated, {TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by UrlCategory, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by UrlCategory\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by UrlCategory\\r\\n) on UrlCategory\\r\\n| project UrlCategory, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top URL Categories by failed requests count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top URL Categories by failed requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult=\\\"Success\\\")\\r\\n | project UrlCategory, TimeGenerated\\r\\n | where isnotempty(UrlCategory)\\r\\n | summarize EventCount=tolong(count()) by UrlCategory, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project UrlCategory=UrlCategory_s, TimeGenerated=EventTime_t, EventCount=EventCount_d, EventResult = EventResult_s\\r\\n | where isnotempty(UrlCategory) and EventResult =~ \\\"Success\\\"\\r\\n | summarize EventCount=tolong(sum(EventCount)) by UrlCategory, bin(TimeGenerated, {TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by UrlCategory, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by UrlCategory\\r\\n| join kind=inner (WebData\\r\\n| make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by UrlCategory\\r\\n) on UrlCategory\\r\\n| project UrlCategory, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top URL Categories by successful requests count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top URL Categories by successful requests count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult='Success')\\r\\n | where isnotempty(HttpUserAgent) and HttpUserAgent != 'Unknown'\\r\\n | summarize EventCount=tolong(count()) by HttpUserAgent, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project\\r\\n HttpUserAgent=HttpUserAgent_s,\\r\\n EventCount=EventCount_d,\\r\\n EventTime=EventTime_t,\\r\\n EventResult=EventResult_s\\r\\n | where isnotempty(HttpUserAgent)\\r\\n and HttpUserAgent != 'Unknown'\\r\\n and EventResult =~ 'Success'\\r\\n | summarize EventCount=tolong(sum(EventCount)) by HttpUserAgent, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by HttpUserAgent, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpUserAgent\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpUserAgent\\r\\n )\\r\\n on HttpUserAgent\\r\\n| project HttpUserAgent, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"title\":\"Top HTTP User Agents by successful request count\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP User Agents by successful request count\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let WebData = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcInfo}'), endtime=now(), eventresult='Failure')\\r\\n | where isnotempty(HttpUserAgent) and HttpUserAgent != 'Unknown'\\r\\n | summarize EventCount=tolong(count()) by HttpUserAgent, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project\\r\\n HttpUserAgent=HttpUserAgent_s,\\r\\n EventCount=EventCount_d,\\r\\n EventTime=EventTime_t,\\r\\n EventResult=EventResult_s\\r\\n | where isnotempty(HttpUserAgent)\\r\\n and HttpUserAgent != 'Unknown'\\r\\n and EventResult =~ 'Failure'\\r\\n | summarize EventCount=tolong(sum(EventCount)) by HttpUserAgent, bin(TimeGenerated=EventTime, {TimeRange:grain})\\r\\n )\\r\\n | summarize EventCount = sum(EventCount) by HttpUserAgent, bin(TimeGenerated, {TimeRange:grain});\\r\\nWebData\\r\\n| summarize EventCount = sum(EventCount) by HttpUserAgent\\r\\n| join kind=inner (WebData\\r\\n | make-series Trend = sum(EventCount) on TimeGenerated from {TimeRange:start} to now() step {TimeRange:grain} by HttpUserAgent\\r\\n )\\r\\n on HttpUserAgent\\r\\n| project HttpUserAgent, EventCount, Trend\\r\\n| order by EventCount desc\\r\\n| take 25\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top HTTP User Agents by failed request count\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"Top HTTP User Agents by failed request count\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"tabVisibility\",\"comparison\":\"isEqualTo\",\"value\":\"topQueries\"},\"name\":\"Group - Top Queries\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let exludeString = dynamic ( [ \\\"/\\\", \\\"None\\\",\\\"\\\" ]);\\r\\nlet distinctThreats = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where (ThreatName !in~ (exludeString) and isnotempty(ThreatName))\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where (ThreatName_s !in~ (exludeString) and isnotempty(ThreatName_s))\\r\\n | extend ThreatName = ThreatName_s\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n )\\r\\n | summarize Result=tostring(dcount(ThreatName))\\r\\n | extend Query = \\\"Distinct ThreatNames\\\", orderNum = 1;\\r\\nlet distinctThreatCategory = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where (ThreatCategory !in~ (exludeString) and isnotempty(ThreatCategory))\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where (ThreatCategory_s !in~ (exludeString) and isnotempty(ThreatCategory_s))\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | extend ThreatCategory = ThreatCategory_s\\r\\n )\\r\\n | summarize Result=tostring(dcount(ThreatCategory))\\r\\n | extend Query = \\\"Distinct Threat Categories\\\", orderNum = 2;\\r\\nlet maxRiskLevel = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where ThreatRiskLevel > 60\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where ThreatRiskLevel_d > 60\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | extend ThreatRiskLevel = toint(ThreatRiskLevel_d)\\r\\n )\\r\\n | summarize Max_RiskLevel=max(ThreatRiskLevel)\\r\\n | extend Result=tostring(iff(isempty(Max_RiskLevel), 0, Max_RiskLevel))\\r\\n | extend Query = \\\"Maximum RiskLevel\\\", orderNum = 3;\\r\\nlet maxThreatConfidence = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | extend ThreatOriginalConfidence=toint(ThreatOriginalConfidence)\\r\\n | where ThreatOriginalConfidence > 0\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where toint(ThreatOriginalConfidence_d) > 0\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, ThreatOriginalConfidence=ThreatOriginalConfidence_d\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | extend ThreatOriginalConfidence = toint(ThreatOriginalConfidence)\\r\\n )\\r\\n | summarize Max_ThreatOriginalConfidence=max(ThreatOriginalConfidence)\\r\\n | extend Result=tostring(iff(isempty(Max_ThreatOriginalConfidence), 0, Max_ThreatOriginalConfidence))\\r\\n | extend Query = \\\"Maximum ThreatConfidence\\\", orderNum = 4;\\r\\nlet MaxEventSeverity = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where isnotempty(EventSeverity) and EventSeverity != 'Informational'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct EventSeverity\\r\\n ),\\r\\n ( \\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(EventSeverity_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct EventSeverity=EventSeverity_s\\r\\n )\\r\\n | distinct EventSeverity\\r\\n | summarize EventSeverity=make_set(EventSeverity, 5)\\r\\n | extend Result=case(\\r\\n EventSeverity has 'High',\\r\\n 'High',\\r\\n EventSeverity has 'Medium',\\r\\n 'Medium',\\r\\n EventSeverity has 'Low',\\r\\n 'Low',\\r\\n EventSeverity has 'Informational',\\r\\n 'Informational',\\r\\n EventSeverity\\r\\n )\\r\\n | extend Query = \\\"Max Event Severity\\\", orderNum = 5;\\r\\nunion distinctThreatCategory, distinctThreats, maxRiskLevel, maxThreatConfidence, MaxEventSeverity\\r\\n| order by orderNum asc\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Query\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Result\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"2\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"4\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"success\",\"text\":\"{0}{1}\"},{\"operator\":\"!=\",\"thresholdValue\":\"0\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"unknown\",\"text\":\"{0}{1}\"}]},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true,\"size\":\"auto\"}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where (ThreatName != 'None' and isnotempty(ThreatName))\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=count() by ThreatName, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult, bin(TimeGenerated, {TimeRange:grain})\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project ThreatName=ThreatName_s, EventCount=EventCount_d, TimeGenerated=EventTime_t, ThreatField=ThreatField_s, SrcIpAddr=SrcIpAddr_s, SrcUsername=SrcUsername_s, DestHostname=DestDomain_s, EventResult=EventResult_s\\r\\n | where (ThreatName != 'None' and isnotempty(ThreatName))\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by ThreatName, bin(TimeGenerated, {TimeRange:grain})\\r\\n )\\r\\n| summarize EventCount = sum(EventCount) by ThreatName, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n| order by EventCount\",\"size\":1,\"aggregation\":3,\"title\":\"Events by threat name\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"Events by threat name\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let exludeString = dynamic ( [ \\\"/\\\", \\\"None\\\",\\\"\\\" ]);\\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where ThreatCategory !in~ (exludeString)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=count() by ThreatCategory, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project ThreatCategory=ThreatCategory_s, EventCount=EventCount_d, ThreatField=ThreatField_s, SrcIpAddr=SrcIpAddr_s, SrcUsername=SrcUsername_s, DestHostname=DestDomain_s, EventResult=EventResult_s\\r\\n | where ThreatCategory !in~ (exludeString)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount)) by ThreatCategory, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n )\\r\\n| summarize EventCount = sum(EventCount) by ThreatCategory, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\",\"size\":1,\"aggregation\":3,\"title\":\"Events by threat category\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"query - 2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where isnotempty(EventSeverity) and EventSeverity != 'Informational'\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize EventCount=tolong(count()) by EventSeverity, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project EventSeverity=EventSeverity_s, EventCount=EventCount_d, ThreatField=ThreatField_s, SrcIpAddr=SrcIpAddr_s, SrcUsername=SrcUsername_s, DestHostname=DestDomain_s, EventResult=EventResult_s\\r\\n\\t | where isnotempty(EventSeverity) and EventSeverity != 'Informational'\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t | summarize EventCount=tolong(sum(EventCount)) by EventSeverity, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n )\\r\\n | summarize EventCount=sum(EventCount) by EventSeverity, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\",\"size\":1,\"aggregation\":3,\"title\":\"Events by Severity over time\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\"},\"customWidth\":\"33\",\"name\":\"query - 6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | where ThreatRiskLevel > 60\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize EventCount=tolong(count()) by ThreatRiskLevel, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project ThreatRiskLevel=toint(ThreatRiskLevel_d), EventCount=EventCount_d, ThreatField=ThreatField_s, SrcIpAddr=SrcIpAddr_s, SrcUsername=SrcUsername_s, DestHostname=DestDomain_s, EventResult=EventResult_s\\r\\n | where ThreatRiskLevel > 60\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t | summarize EventCount=tolong(sum(EventCount)) by ThreatRiskLevel, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n )\\r\\n | summarize EventCount=sum(EventCount) by tostring(ThreatRiskLevel), ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\",\"size\":1,\"aggregation\":3,\"title\":\"Events by Risk Level over time\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\"},\"customWidth\":\"33\",\"name\":\"query - 4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeThreatInfo}'), endtime=now())\\r\\n | extend ThreatOriginalConfidence = toint(ThreatOriginalConfidence)\\r\\n | where ThreatOriginalConfidence > 0\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| summarize EventCount=tolong(count()) by ThreatOriginalConfidence, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_ThreatInfo_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where ThreatOriginalConfidence_d > 0\\r\\n | project ThreatOriginalConfidence=toint(ThreatOriginalConfidence_d), EventTime_t, EventCount_d, ThreatField=ThreatField_s, SrcIpAddr=SrcIpAddr_s, SrcUsername=SrcUsername_s, DestHostname=DestDomain_s, EventResult=EventResult_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | summarize EventCount=tolong(sum(EventCount_d)) by ThreatOriginalConfidence, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\\r\\n )\\r\\n | summarize EventCount=sum(EventCount) by ThreatOriginalConfidence, ThreatField, SrcIpAddr, SrcUsername, DestHostname, EventResult\",\"size\":1,\"title\":\"Events by Confidence over time\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\"},\"customWidth\":\"33\",\"name\":\"query - 5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllPublicIPs = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where not(ipv4_is_private(SrcIpAddr))\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | extend PublicIPAddress = SrcIpAddr\\r\\n | where PublicIPAddress != ''\\r\\n\\t\\t| project PublicIPAddress\\r\\n\\t\\t| distinct PublicIPAddress\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | project SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where not(ipv4_is_private(SrcIpAddr))\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | extend PublicIPAddress = SrcIpAddr\\r\\n | where PublicIPAddress != ''\\r\\n | project PublicIPAddress\\r\\n\\t\\t| distinct PublicIPAddress\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | extend DstIpAddr=DstIpAddr_s, DestHostname=DestDomain_s\\r\\n | where not(ipv4_is_private(DstIpAddr))\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | extend PublicIPAddress = DstIpAddr\\r\\n | where PublicIPAddress != ''\\r\\n | project PublicIPAddress\\r\\n\\t\\t| distinct PublicIPAddress\\r\\n )\\r\\n | distinct PublicIPAddress;\\r\\n ThreatIntelligenceIndicator\\r\\n | where NetworkIP in~ (AllPublicIPs)\",\"size\":1,\"title\":\"Source or Destination IPs matching with Threat Intelligence indicators\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllDstWebsites = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(Url)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where isnotempty(DestHostname)\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DestDomain_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DestDomain_s)\\r\\n | extend DstIpAddr=DstIpAddr_s, DestHostname=DestDomain_s\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n )\\r\\n | distinct DestHostname;\\r\\n ThreatIntelligenceIndicator\\r\\n | where Url has_any(AllDstWebsites)\",\"size\":1,\"title\":\"Requested URL matching with Threat Intelligence Indicators\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"Requested URL with Threat Intelligence Indicators\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllSrcIPs = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(SrcIpAddr)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| project SrcIpAddr\\r\\n\\t\\t| distinct SrcIpAddr\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcIpAddr_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| distinct SrcIpAddr=SrcIpAddr_s\\r\\n )\\r\\n | distinct SrcIpAddr;\\r\\nlet AllDstIPs = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeDstIP}'), endtime=now())\\r\\n | where isnotempty(DstIpAddr)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| distinct DstIpAddr\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DstIpAddr_s)\\r\\n | extend DstIpAddr=DstIpAddr_s, DestHostname=DestDomain_s\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n\\t\\t| distinct DstIpAddr\\r\\n )\\r\\n | distinct DstIpAddr;\\r\\nlet AllIPs =\\r\\nunion AllSrcIPs, AllDstIPs;\\r\\n SecurityAlert\\r\\n | where TimeGenerated > {TimeRange:start}\\r\\n | extend Parsed_Entities = parse_json(Entities)\\r\\n | mv-expand Parsed_Entities\\r\\n | extend Parsed_EntityType=tostring(Parsed_Entities.Type)\\r\\n | where Parsed_EntityType =~ 'ip'\\r\\n | extend IPEntity = tostring(Parsed_Entities.Address)\\r\\n | project-away Parsed_Entities\\r\\n | where IPEntity in~ (AllIPs)\\r\\n | project TimeGenerated, AlertSeverity, AlertName, Description, ProviderName, IPEntity, Status, Tactics, Techniques\",\"size\":1,\"title\":\"Source or Destination IPs matching with Entities in Security Alert table\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"33\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllDstWebsites = \\r\\nunion isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(Url)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DestDomain_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_DstIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(DestDomain_s)\\r\\n | extend DestHostname = DestDomain_s\\r\\n | where ('*' in~ ({SrcIpAddr}))\\r\\n and ('*' in~ ({SrcUsername}))\\r\\n and ('*' in~ ({SrcHostname}))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct DestHostname\\r\\n )\\r\\n | distinct DestHostname;\\r\\nSecurityAlert\\r\\n| where TimeGenerated > {TimeRange:start}\\r\\n | extend Parsed_Entities = parse_json(Entities)\\r\\n | mv-expand Parsed_Entities\\r\\n | extend Parsed_EntityType=tostring(Parsed_Entities.Type)\\r\\n | where Parsed_EntityType =~ 'url'\\r\\n | extend UrlEntity = tostring(Parsed_Entities.Url)\\r\\n | project-away Parsed_Entities\\r\\n| where UrlEntity has_any (AllDstWebsites)\\r\\n| project TimeGenerated, AlertSeverity, AlertName, Description, ProviderName, UrlEntity, Status, Tactics, Techniques\",\"size\":1,\"title\":\"Request URLs matching with Entities in Security Alert table\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"33\",\"name\":\"query - 9\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllSrcHostnames = \\r\\n union isfuzzy=true \\r\\n (\\r\\n _Im_WebSession(starttime=todatetime('{LastIngestionTimeSrcIP}'), endtime=now())\\r\\n | where isnotempty(SrcHostname)\\r\\n | extend DestHostname = tostring(parse_url(Url)[\\\"Host\\\"])\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcHostname\\r\\n ),\\r\\n (\\r\\n WebSession_Summarized_SrcIP_CL\\r\\n | where EventTime_t >= {TimeRange:start}\\r\\n | where isnotempty(SrcHostname_s)\\r\\n | extend SrcIpAddr=SrcIpAddr_s, DestHostname=DestDomain_s, SrcUsername=SrcUsername_s, SrcHostname=SrcHostname_s\\r\\n | where ('*' in~ ({SrcIpAddr}) or (SrcIpAddr in~ ({SrcIpAddr})))\\r\\n and ('*' in~ ({SrcUsername}) or (SrcUsername in~ ({SrcUsername})))\\r\\n and ('*' in~ ({SrcHostname}) or (SrcHostname in~ ({SrcHostname})))\\r\\n and ('*' in~ ({DstHostname}) or (DestHostname in~ ({DstHostname})))\\r\\n | distinct SrcHostname=SrcHostname_s\\r\\n )\\r\\n | distinct SrcHostname;\\r\\nSecurityAlert\\r\\n| where TimeGenerated > {TimeRange:start}\\r\\n | extend Parsed_Entities = parse_json(Entities)\\r\\n | mv-expand Parsed_Entities\\r\\n | extend Parsed_EntityType=tostring(Parsed_Entities.Type)\\r\\n | where Parsed_EntityType =~ 'host'\\r\\n | extend HostEntity = tostring(Parsed_Entities.HostName)\\r\\n | project-away Parsed_Entities\\r\\n| where HostEntity in~ (AllSrcHostnames)\\r\\n| project TimeGenerated, AlertSeverity, AlertName, Description, ProviderName, HostEntity, Status, Tactics, Techniques\",\"size\":1,\"title\":\"Source HostNames matching with Entities in Security Alert table\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"33\",\"name\":\"query - 10\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"tabVisibility\",\"comparison\":\"isEqualTo\",\"value\":\"threatevents\"},\"name\":\"Threat Events\"}],\"fromTemplateId\":\"sentinel-WebSessionDomainSolution\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" diff --git a/Solutions/iboss/Data Connectors/iboss_cef.json b/Solutions/iboss/Data Connectors/iboss_cef.json index 94dfc8a5765..a6fd6f3884b 100644 --- a/Solutions/iboss/Data Connectors/iboss_cef.json +++ b/Solutions/iboss/Data Connectors/iboss_cef.json @@ -1,6 +1,6 @@ { "id": "iboss", - "title": "iboss", + "title": "[Deprecated] iboss via Legacy Agent", "publisher": "iboss", "descriptionMarkdown": "The [iboss](https://www.iboss.com) data connector enables you to seamlessly connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.", "graphQueries": [ @@ -92,7 +92,7 @@ }, { "title": "2. Forward Common Event Format (CEF) logs", - "description": "Set your Threat Console to send Syslog messages in CEF format to your Azure workspace. Make note of your Workspace ID and Primary Key within your Log Analytics Workspace (Select the workspace from the Log Analytics workspaces menu in the Azure portal. Then select Agents management in the Settings section). \n\n>1. Navigate to Reporting & Analytics inside your iboss Console\n\n>2. Select Log Forwarding -> Forward From Reporter\n\n>3. Select Actions -> Add Service\n\n>4. Toggle to Microsoft Sentinel as a Service Type and input your Workspace ID/Primary Key along with other criteria. If a dedicated proxy Linux machine has been configured, toggle to Syslog as a Service Type and configure the settings to point to your dedicated proxy Linux machine\n\n>5. Wait one to two minutes for the setup to complete\n\n>6. Select your Microsoft Sentinel Service and verify the Sentinel Setup Status is Successful. If a dedicated proxy Linux machine has been configured, you may proceed with validating your connection" + "description": "Set your Threat Console to send Syslog messages in CEF format to your Azure workspace. Make note of your Workspace ID and Primary Key within your Log Analytics Workspace (Select the workspace from the Log Analytics workspaces menu in the Azure portal. Then select Agents management in the Settings section). \n\n>1. Navigate to Reporting & Analytics inside your iboss Console\n\n>2. Select Log Forwarding -> Forward From Reporter\n\n>3. Select Actions -> Add Service\n\n>4. Toggle to Microsoft Sentinel as a Service Type and input your Workspace ID/Primary Key along with other criteria. If a dedicated proxy Linux machine has been configured, toggle to Syslog as a Service Type and configure the settings to point to your dedicated proxy Linux machine\n\n>5. Wait one to two minutes for the setup to complete\n\n>6. Select your Microsoft Sentinel Service and verify the Microsoft Sentinel Setup Status is Successful. If a dedicated proxy Linux machine has been configured, you may proceed with validating your connection" }, { "title": "3. Validate connection", diff --git a/Solutions/iboss/Data Connectors/template_ibossAMA.json b/Solutions/iboss/Data Connectors/template_ibossAMA.json new file mode 100644 index 00000000000..8c5b7e0da70 --- /dev/null +++ b/Solutions/iboss/Data Connectors/template_ibossAMA.json @@ -0,0 +1,131 @@ +{ + "id": "ibossAma", + "title": "[Recommended] iboss via AMA", + "publisher": "iboss", + "descriptionMarkdown": "The [iboss](https://www.iboss.com) data connector enables you to seamlessly connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "ibossUrlEvent", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'iboss'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description": "Logs Received from the past week", + "query": "ibossUrlEvent | where TimeGenerated > ago(7d)" + } + ], + "dataTypes": [ + { + "name": "ibossUrlEvent", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'iboss'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'iboss'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "title": "", + "description": "", + + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine", + "instructions": [ + ] + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs", + "description": "Set your Threat Console to send Syslog messages in CEF format to your Azure workspace. Make note of your Workspace ID and Primary Key within your Log Analytics Workspace (Select the workspace from the Log Analytics workspaces menu in the Azure portal. Then select Agents management in the Settings section). \n\n>1. Navigate to Reporting & Analytics inside your iboss Console\n\n>2. Select Log Forwarding -> Forward From Reporter\n\n>3. Select Actions -> Add Service\n\n>4. Toggle to Microsoft Sentinel as a Service Type and input your Workspace ID/Primary Key along with other criteria. If a dedicated proxy Linux machine has been configured, toggle to Syslog as a Service Type and configure the settings to point to your dedicated proxy Linux machine\n\n>5. Wait one to two minutes for the setup to complete\n\n>6. Select your Microsoft Sentinel Service and verify the Sentinel Setup Status is Successful. If a dedicated proxy Linux machine has been configured, you may proceed with validating your connection", + "instructions": [ + ] + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + + + }, + + { + "title": "2. Secure your machine ", + "description": "Make sure to configure the machine's security according to your organization's security policy (Only applicable if a dedicated proxy Linux machine has been configured).\n\n\n[Learn more >](https://aka.ms/SecureCEF)" + } + ], + "metadata": { + "id": "f8c448b1-3df4-444d-aded-63e4ad2aec08", + "version": "1.0.0", + "kind": "dataConnector", + "author": { + "name": "iboss" + }, + "support": { + "tier": "Type of support for content item: microsoft | developer | community", + "name": "iboss", + "link": "https://www.iboss.com/" + } + } +} \ No newline at end of file diff --git a/Solutions/iboss/Data/Solution_iboss.json b/Solutions/iboss/Data/Solution_iboss.json index 26bb9448434..c558a43f60b 100644 --- a/Solutions/iboss/Data/Solution_iboss.json +++ b/Solutions/iboss/Data/Solution_iboss.json @@ -2,19 +2,20 @@ "Name": "iboss", "Author": "iboss", "Logo": "", - "Description": "The iboss Solution provides means to connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.", + "Description": "The iboss Solution provides means to connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.\n\r\n1. **Iboss via AMA** - This data connector helps in ingesting Iboss logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Iboss via Legacy Agent** - This data connector helps in ingesting Iboss logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Iboss via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", "Data Connectors": [ - "Data Connectors/iboss_cef.json" + "Data Connectors/iboss_cef.json", + "Data Connectors/template_ibossAMA.json" ], "Parsers": [ - "Parsers/ibossUrlEvent.txt" + "Parsers/ibossUrlEvent.yaml" ], "Workbooks": [ "Workbooks/ibossMalwareAndC2.json", "Workbooks/ibossWebUsage.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\iboss", - "Version": "2.0.2", + "Version": "3.0.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/iboss/Data/system_generated_metadata.json b/Solutions/iboss/Data/system_generated_metadata.json new file mode 100644 index 00000000000..568c759ad83 --- /dev/null +++ b/Solutions/iboss/Data/system_generated_metadata.json @@ -0,0 +1,31 @@ +{ + "Name": "iboss", + "Author": "iboss", + "Logo": "", + "Description": "The iboss Solution provides means to connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.\n\r\n1. **Iboss via AMA** - This data connector helps in ingesting Iboss logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Iboss via Legacy Agent** - This data connector helps in ingesting Iboss logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Iboss via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\iboss", + "Version": "3.0.0", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1Pconnector": false, + "publisherId": "iboss", + "offerId": "iboss-sentinel-connector", + "providers": [ + "iboss" + ], + "categories": { + "domains": [ + "Security - Network" + ] + }, + "firstPublishDate": "2022-02-15", + "support": { + "name": "iboss", + "email": "support@iboss.com", + "tier": "Partner", + "link": "https://www.iboss.com/contact-us/" + }, + "Data Connectors": "[\n \"Data Connectors/iboss_cef.json\",\n \"Data Connectors/template_ibossAMA.json\"\n]", + "Parsers": "[\n \"ibossUrlEvent.yaml\"\n]", + "Workbooks": "[\n \"Workbooks/ibossMalwareAndC2.json\",\n \"Workbooks/ibossWebUsage.json\"\n]" +} diff --git a/Solutions/iboss/Package/3.0.0.zip b/Solutions/iboss/Package/3.0.0.zip new file mode 100644 index 00000000000..292ad8562a3 Binary files /dev/null and b/Solutions/iboss/Package/3.0.0.zip differ diff --git a/Solutions/iboss/Package/createUiDefinition.json b/Solutions/iboss/Package/createUiDefinition.json index 8fbae192fd7..cddec712c27 100644 --- a/Solutions/iboss/Package/createUiDefinition.json +++ b/Solutions/iboss/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe iboss Solution provides means to connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/iboss/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe iboss Solution provides means to connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.\n\r\n1. **Iboss via AMA** - This data connector helps in ingesting Iboss logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Iboss via Legacy Agent** - This data connector helps in ingesting Iboss logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Iboss via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Parsers:** 1, **Workbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -80,6 +80,7 @@ } } } + ] }, { @@ -145,4 +146,4 @@ "workspace": "[basics('workspace')]" } } -} \ No newline at end of file +} diff --git a/Solutions/iboss/Package/mainTemplate.json b/Solutions/iboss/Package/mainTemplate.json index 325d102c5e9..73f409c5bf3 100644 --- a/Solutions/iboss/Package/mainTemplate.json +++ b/Solutions/iboss/Package/mainTemplate.json @@ -48,63 +48,61 @@ "variables": { "solutionId": "iboss.iboss-sentinel-connector", "_solutionId": "[variables('solutionId')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_solutionName": "iboss", + "_solutionVersion": "3.0.0", "uiConfigId1": "iboss", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "iboss", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", - "parserVersion1": "1.0.0", - "parserContentId1": "ibossUrlEvent-Parser", - "_parserContentId1": "[variables('parserContentId1')]", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "uiConfigId2": "ibossAma", + "_uiConfigId2": "[variables('uiConfigId2')]", + "dataConnectorContentId2": "ibossAma", + "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", + "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "_dataConnectorId2": "[variables('dataConnectorId2')]", + "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", + "dataConnectorVersion2": "1.0.0", + "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "parserName1": "ibossUrlEvent", "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1')))]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", + "parserVersion1": "1.0.0", + "parserContentId1": "ibossUrlEvent-Parser", + "_parserContentId1": "[variables('parserContentId1')]", + "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", "workbookVersion1": "1.0.0", "workbookContentId1": "ibossMalwareAndC2Workbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", "workbookVersion2": "1.0.0", "workbookContentId2": "ibossWebUsageWorkbook", "workbookId2": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId2'))]", - "workbookTemplateSpecName2": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId2')))]", - "_workbookContentId2": "[variables('workbookContentId2')]" + "workbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId2'))))]", + "_workbookContentId2": "[variables('workbookContentId2')]", + "_workbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId2'),'-', variables('workbookVersion2'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "iboss data connector with template", - "displayName": "iboss template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "iboss data connector with template version 2.0.2", + "description": "iboss data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -120,7 +118,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId1')]", - "title": "iboss", + "title": "[Deprecated] iboss via Legacy Agent", "publisher": "iboss", "descriptionMarkdown": "The [iboss](https://www.iboss.com) data connector enables you to seamlessly connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.", "graphQueries": [ @@ -211,7 +209,7 @@ "title": "1. Configure a dedicated proxy Linux machine" }, { - "description": "Set your Threat Console to send Syslog messages in CEF format to your Azure workspace. Make note of your Workspace ID and Primary Key within your Log Analytics Workspace (Select the workspace from the Log Analytics workspaces menu in the Azure portal. Then select Agents management in the Settings section). \n\n>1. Navigate to Reporting & Analytics inside your iboss Console\n\n>2. Select Log Forwarding -> Forward From Reporter\n\n>3. Select Actions -> Add Service\n\n>4. Toggle to Microsoft Sentinel as a Service Type and input your Workspace ID/Primary Key along with other criteria. If a dedicated proxy Linux machine has been configured, toggle to Syslog as a Service Type and configure the settings to point to your dedicated proxy Linux machine\n\n>5. Wait one to two minutes for the setup to complete\n\n>6. Select your Microsoft Sentinel Service and verify the Sentinel Setup Status is Successful. If a dedicated proxy Linux machine has been configured, you may proceed with validating your connection", + "description": "Set your Threat Console to send Syslog messages in CEF format to your Azure workspace. Make note of your Workspace ID and Primary Key within your Log Analytics Workspace (Select the workspace from the Log Analytics workspaces menu in the Azure portal. Then select Agents management in the Settings section). \n\n>1. Navigate to Reporting & Analytics inside your iboss Console\n\n>2. Select Log Forwarding -> Forward From Reporter\n\n>3. Select Actions -> Add Service\n\n>4. Toggle to Microsoft Sentinel as a Service Type and input your Workspace ID/Primary Key along with other criteria. If a dedicated proxy Linux machine has been configured, toggle to Syslog as a Service Type and configure the settings to point to your dedicated proxy Linux machine\n\n>5. Wait one to two minutes for the setup to complete\n\n>6. Select your Microsoft Sentinel Service and verify the Microsoft Sentinel Setup Status is Successful. If a dedicated proxy Linux machine has been configured, you may proceed with validating your connection", "title": "2. Forward Common Event Format (CEF) logs" }, { @@ -241,7 +239,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -265,12 +263,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "[Deprecated] iboss via Legacy Agent", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -305,7 +314,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "iboss", + "title": "[Deprecated] iboss via Legacy Agent", "publisher": "iboss", "descriptionMarkdown": "The [iboss](https://www.iboss.com) data connector enables you to seamlessly connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.", "graphQueries": [ @@ -396,7 +405,7 @@ "title": "1. Configure a dedicated proxy Linux machine" }, { - "description": "Set your Threat Console to send Syslog messages in CEF format to your Azure workspace. Make note of your Workspace ID and Primary Key within your Log Analytics Workspace (Select the workspace from the Log Analytics workspaces menu in the Azure portal. Then select Agents management in the Settings section). \n\n>1. Navigate to Reporting & Analytics inside your iboss Console\n\n>2. Select Log Forwarding -> Forward From Reporter\n\n>3. Select Actions -> Add Service\n\n>4. Toggle to Microsoft Sentinel as a Service Type and input your Workspace ID/Primary Key along with other criteria. If a dedicated proxy Linux machine has been configured, toggle to Syslog as a Service Type and configure the settings to point to your dedicated proxy Linux machine\n\n>5. Wait one to two minutes for the setup to complete\n\n>6. Select your Microsoft Sentinel Service and verify the Sentinel Setup Status is Successful. If a dedicated proxy Linux machine has been configured, you may proceed with validating your connection", + "description": "Set your Threat Console to send Syslog messages in CEF format to your Azure workspace. Make note of your Workspace ID and Primary Key within your Log Analytics Workspace (Select the workspace from the Log Analytics workspaces menu in the Azure portal. Then select Agents management in the Settings section). \n\n>1. Navigate to Reporting & Analytics inside your iboss Console\n\n>2. Select Log Forwarding -> Forward From Reporter\n\n>3. Select Actions -> Add Service\n\n>4. Toggle to Microsoft Sentinel as a Service Type and input your Workspace ID/Primary Key along with other criteria. If a dedicated proxy Linux machine has been configured, toggle to Syslog as a Service Type and configure the settings to point to your dedicated proxy Linux machine\n\n>5. Wait one to two minutes for the setup to complete\n\n>6. Select your Microsoft Sentinel Service and verify the Microsoft Sentinel Setup Status is Successful. If a dedicated proxy Linux machine has been configured, you may proceed with validating your connection", "title": "2. Forward Common Event Format (CEF) logs" }, { @@ -413,33 +422,351 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('parserTemplateSpecName1')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName2')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "iboss data connector with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion2')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId2')]", + "title": "[Recommended] iboss via AMA", + "publisher": "iboss", + "descriptionMarkdown": "The [iboss](https://www.iboss.com) data connector enables you to seamlessly connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "ibossUrlEvent", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'iboss'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description": "Logs Received from the past week", + "query": "ibossUrlEvent | where TimeGenerated > ago(7d)" + } + ], + "dataTypes": [ + { + "name": "ibossUrlEvent", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'iboss'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'iboss'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs", + "description": "Set your Threat Console to send Syslog messages in CEF format to your Azure workspace. Make note of your Workspace ID and Primary Key within your Log Analytics Workspace (Select the workspace from the Log Analytics workspaces menu in the Azure portal. Then select Agents management in the Settings section). \n\n>1. Navigate to Reporting & Analytics inside your iboss Console\n\n>2. Select Log Forwarding -> Forward From Reporter\n\n>3. Select Actions -> Add Service\n\n>4. Toggle to Microsoft Sentinel as a Service Type and input your Workspace ID/Primary Key along with other criteria. If a dedicated proxy Linux machine has been configured, toggle to Syslog as a Service Type and configure the settings to point to your dedicated proxy Linux machine\n\n>5. Wait one to two minutes for the setup to complete\n\n>6. Select your Microsoft Sentinel Service and verify the Microsoft Sentinel Setup Status is Successful. If a dedicated proxy Linux machine has been configured, you may proceed with validating your connection" + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy (Only applicable if a dedicated proxy Linux machine has been configured).\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ], + "metadata": { + "id": "f8c448b1-3df4-444d-aded-63e4ad2aec08", + "version": "1.0.0", + "kind": "dataConnector", + "author": { + "name": "iboss" + }, + "support": { + "tier": "Type of support for content item: microsoft | developer | community", + "name": "iboss", + "link": "https://www.iboss.com/" + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "iboss", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "iboss" + }, + "support": { + "name": "iboss", + "email": "support@iboss.com", + "tier": "Partner", + "link": "https://www.iboss.com/contact-us/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId2')]", + "contentKind": "DataConnector", + "displayName": "[Recommended] iboss via AMA", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", + "version": "[variables('dataConnectorVersion2')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId2')]" + ], "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, "properties": { - "description": "ibossUrlEvent Data Parser with template", - "displayName": "ibossUrlEvent Data Parser template" + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "iboss", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "iboss" + }, + "support": { + "name": "iboss", + "email": "support@iboss.com", + "tier": "Partner", + "link": "https://www.iboss.com/contact-us/" + } } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('parserTemplateSpecName1'),'/',variables('parserVersion1'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "[Recommended] iboss via AMA", + "publisher": "iboss", + "descriptionMarkdown": "The [iboss](https://www.iboss.com) data connector enables you to seamlessly connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "ibossUrlEvent", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'iboss'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "dataTypes": [ + { + "name": "ibossUrlEvent", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'iboss'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'iboss'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Logs Received from the past week", + "query": "ibossUrlEvent | where TimeGenerated > ago(7d)" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs", + "description": "Set your Threat Console to send Syslog messages in CEF format to your Azure workspace. Make note of your Workspace ID and Primary Key within your Log Analytics Workspace (Select the workspace from the Log Analytics workspaces menu in the Azure portal. Then select Agents management in the Settings section). \n\n>1. Navigate to Reporting & Analytics inside your iboss Console\n\n>2. Select Log Forwarding -> Forward From Reporter\n\n>3. Select Actions -> Add Service\n\n>4. Toggle to Microsoft Sentinel as a Service Type and input your Workspace ID/Primary Key along with other criteria. If a dedicated proxy Linux machine has been configured, toggle to Syslog as a Service Type and configure the settings to point to your dedicated proxy Linux machine\n\n>5. Wait one to two minutes for the setup to complete\n\n>6. Select your Microsoft Sentinel Service and verify the Microsoft Sentinel Setup Status is Successful. If a dedicated proxy Linux machine has been configured, you may proceed with validating your connection" + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy (Only applicable if a dedicated proxy Linux machine has been configured).\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ], + "id": "[variables('_uiConfigId2')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('parserTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ibossUrlEvent Data Parser with template version 2.0.2", + "description": "ibossUrlEvent Data Parser with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserVersion1')]", @@ -448,20 +775,21 @@ "resources": [ { "name": "[variables('_parserName1')]", - "apiVersion": "2020-08-01", + "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "ibossUrlEvent", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "ibossUrlEvent", - "query": "\nCommonSecurityLog\r\n| where DeviceVendor == \"iboss\" and FlexString2 == \"URL\"\r\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\r\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2)\r\n| project-rename EventVendor=DeviceVendor\r\n , EventProduct=DeviceProduct\r\n , EventProductVersion=DeviceVersion\r\n , EventResult=DeviceEventClassID\r\n , EventResultDetails=FlexNumber1\r\n , DvcAction=DeviceAction\r\n , RuleName=FlexString1\r\n , SrcPortNumber=SourcePort\r\n , SrcIpAddr=SourceIP\r\n , SrcMacAddr=SourceMACAddress\r\n , SrcUsername=SourceUserName\r\n , SrcBytes=SentBytes\r\n , DstPortNumber=DestinationPort\r\n , DstIpAddr=DestinationIP\r\n , DstBytes=ReceivedBytes\r\n , Domain=DestinationHostName\r\n , Url=RequestURL\r\n , UrlCategory=DeviceCustomString2\r\n , HttpRequestMethod=RequestMethod\r\n , HttpUserAgent=RequestClientApplication\r\n , FileSHA256=DeviceCustomString3\r\n , ThreatName=DeviceCustomString1\r\n , MalwareDetected=DeviceCustomNumber1\r\n , CNCDetected=DeviceCustomNumber2\r\n| extend NetworkBytes=SrcBytes+DstBytes\r\n , EventTime=todatetime(DeviceCustomDate1)\r\n| project-away DeviceCustom*\r\n , FlexNumber*\r\n , FlexString*\r\n", - "version": 1, + "query": "CommonSecurityLog\n| where DeviceVendor == \"iboss\" and FlexString2 == \"URL\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2)\n| project-rename EventVendor=DeviceVendor\n , EventProduct=DeviceProduct\n , EventProductVersion=DeviceVersion\n , EventResult=DeviceEventClassID\n , EventResultDetails=FlexNumber1\n , DvcAction=DeviceAction\n , RuleName=FlexString1\n , SrcPortNumber=SourcePort\n , SrcIpAddr=SourceIP\n , SrcMacAddr=SourceMACAddress\n , SrcUsername=SourceUserName\n , SrcBytes=SentBytes\n , DstPortNumber=DestinationPort\n , DstIpAddr=DestinationIP\n , DstBytes=ReceivedBytes\n , Domain=DestinationHostName\n , Url=RequestURL\n , UrlCategory=DeviceCustomString2\n , HttpRequestMethod=RequestMethod\n , HttpUserAgent=RequestClientApplication\n , FileSHA256=DeviceCustomString3\n , ThreatName=DeviceCustomString1\n , MalwareDetected=DeviceCustomNumber1\n , CNCDetected=DeviceCustomNumber2\n| extend NetworkBytes=SrcBytes+DstBytes\n , EventTime=todatetime(DeviceCustomDate1)\n| project-away DeviceCustom*\n , FlexNumber*\n , FlexString*\n", + "functionParameters": "", + "version": 2, "tags": [ { "name": "description", - "value": "ibossUrlEvent" + "value": "" } ] } @@ -471,7 +799,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", "dependsOn": [ - "[variables('_parserName1')]" + "[variables('_parserId1')]" ], "properties": { "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", @@ -495,21 +823,39 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_parserContentId1')]", + "contentKind": "Parser", + "displayName": "ibossUrlEvent", + "contentProductId": "[variables('_parsercontentProductId1')]", + "id": "[variables('_parsercontentProductId1')]", + "version": "[variables('parserVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2021-06-01", + "apiVersion": "2022-10-01", "name": "[variables('_parserName1')]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "ibossUrlEvent", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "ibossUrlEvent", - "query": "\nCommonSecurityLog\r\n| where DeviceVendor == \"iboss\" and FlexString2 == \"URL\"\r\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\r\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2)\r\n| project-rename EventVendor=DeviceVendor\r\n , EventProduct=DeviceProduct\r\n , EventProductVersion=DeviceVersion\r\n , EventResult=DeviceEventClassID\r\n , EventResultDetails=FlexNumber1\r\n , DvcAction=DeviceAction\r\n , RuleName=FlexString1\r\n , SrcPortNumber=SourcePort\r\n , SrcIpAddr=SourceIP\r\n , SrcMacAddr=SourceMACAddress\r\n , SrcUsername=SourceUserName\r\n , SrcBytes=SentBytes\r\n , DstPortNumber=DestinationPort\r\n , DstIpAddr=DestinationIP\r\n , DstBytes=ReceivedBytes\r\n , Domain=DestinationHostName\r\n , Url=RequestURL\r\n , UrlCategory=DeviceCustomString2\r\n , HttpRequestMethod=RequestMethod\r\n , HttpUserAgent=RequestClientApplication\r\n , FileSHA256=DeviceCustomString3\r\n , ThreatName=DeviceCustomString1\r\n , MalwareDetected=DeviceCustomNumber1\r\n , CNCDetected=DeviceCustomNumber2\r\n| extend NetworkBytes=SrcBytes+DstBytes\r\n , EventTime=todatetime(DeviceCustomDate1)\r\n| project-away DeviceCustom*\r\n , FlexNumber*\r\n , FlexString*\r\n", - "version": 1 + "query": "CommonSecurityLog\n| where DeviceVendor == \"iboss\" and FlexString2 == \"URL\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2)\n| project-rename EventVendor=DeviceVendor\n , EventProduct=DeviceProduct\n , EventProductVersion=DeviceVersion\n , EventResult=DeviceEventClassID\n , EventResultDetails=FlexNumber1\n , DvcAction=DeviceAction\n , RuleName=FlexString1\n , SrcPortNumber=SourcePort\n , SrcIpAddr=SourceIP\n , SrcMacAddr=SourceMACAddress\n , SrcUsername=SourceUserName\n , SrcBytes=SentBytes\n , DstPortNumber=DestinationPort\n , DstIpAddr=DestinationIP\n , DstBytes=ReceivedBytes\n , Domain=DestinationHostName\n , Url=RequestURL\n , UrlCategory=DeviceCustomString2\n , HttpRequestMethod=RequestMethod\n , HttpUserAgent=RequestClientApplication\n , FileSHA256=DeviceCustomString3\n , ThreatName=DeviceCustomString1\n , MalwareDetected=DeviceCustomNumber1\n , CNCDetected=DeviceCustomNumber2\n| extend NetworkBytes=SrcBytes+DstBytes\n , EventTime=todatetime(DeviceCustomDate1)\n| project-away DeviceCustom*\n , FlexNumber*\n , FlexString*\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { @@ -542,33 +888,15 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "properties": { - "description": "iboss Workbook with template", - "displayName": "iboss workbook template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ibossMalwareAndC2Workbook Workbook with template version 2.0.2", + "description": "ibossMalwareAndC2Workbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -586,7 +914,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## iboss Malware and C2 Detections\\n\\n**NOTE:** This workbook uses a parser based on a Kusto Function to normalize fields. [Follow these steps](https://aka.ms/sentinel-iboss-parser) to create the Kusto function alias **ibossUrlEvent**.\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"7cf056ef-64cd-41a5-85e0-90c0ec529434\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"time_range_picker\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"label\":\"Time Range Picker\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| where EventResult == 'Blocked' and MalwareDetected == 1\\r\\n| where isnotempty(ThreatName)\\r\\n| summarize count() by ThreatName\",\"size\":2,\"showAnalytics\":true,\"title\":\"Top Malware Detection Families\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - malware variants\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| where MalwareDetected == 1 or CNCDetected == 1\\r\\n| extend EventType = case(MalwareDetected == 1, \\\"Malware\\\", CNCDetected == 1, \\\"C2\\\", \\\"NA\\\")\\r\\n| make-series Detections = count() default = 0 on EventTime from {time_range_picker:start} to {time_range_picker:end} step {time_range_picker:grain} by EventType\",\"size\":0,\"showAnalytics\":true,\"title\":\"Malware & C2 Traffic\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"customWidth\":\"50\",\"name\":\"query - malware and c2 detections\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| where MalwareDetected == 1\\r\\n| project EventTime\\r\\n , SrcUsername\\r\\n , SrcIpAddr\\r\\n , SrcPortNumber\\r\\n , DstIpAddr\\r\\n , DstPortNumber\\r\\n , FileName\\r\\n , FileSHA256\\r\\n , ThreatName\\r\\n| order by EventTime desc\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Malware Detections\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - malware detections\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| where CNCDetected == 1\\r\\n| project EventTime\\r\\n , SrcUsername\\r\\n , SrcIpAddr\\r\\n , SrcPortNumber\\r\\n , DstIpAddr\\r\\n , DstPortNumber\\r\\n , Url\\r\\n| order by EventTime desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"C2 Detections\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - c2 detections\"}],\"fromTemplateId\":\"sentinel-ibossMalwareAndC2Workbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## iboss Malware and C2 Detections\\n\\n**NOTE:** This workbook uses a parser based on a Kusto Function to normalize fields. [Follow these steps](https://aka.ms/sentinel-iboss-parser) to create the Kusto function alias **ibossUrlEvent**.\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"7cf056ef-64cd-41a5-85e0-90c0ec529434\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"time_range_picker\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"label\":\"Time Range Picker\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| where EventResult == 'Blocked' and MalwareDetected == 1\\r\\n| where isnotempty(ThreatName)\\r\\n| summarize count() by ThreatName\",\"size\":2,\"showAnalytics\":true,\"title\":\"Top Malware Detection Families\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - malware variants\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| where MalwareDetected == 1 or CNCDetected == 1\\r\\n| extend EventType = case(MalwareDetected == 1, \\\"Malware\\\", CNCDetected == 1, \\\"C2\\\", \\\"NA\\\")\\r\\n| make-series Detections = count() default = 0 on EventTime from {time_range_picker:start} to {time_range_picker:end} step {time_range_picker:grain} by EventType\",\"size\":0,\"showAnalytics\":true,\"title\":\"Malware & C2 Traffic\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"customWidth\":\"50\",\"name\":\"query - malware and c2 detections\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| where MalwareDetected == 1\\r\\n| project EventTime\\r\\n , SrcUsername\\r\\n , SrcIpAddr\\r\\n , SrcPortNumber\\r\\n , DstIpAddr\\r\\n , DstPortNumber\\r\\n , FileName\\r\\n , FileSHA256\\r\\n , ThreatName\\r\\n| order by EventTime desc\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Malware Detections\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - malware detections\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| where CNCDetected == 1\\r\\n| project EventTime\\r\\n , SrcUsername\\r\\n , SrcIpAddr\\r\\n , SrcPortNumber\\r\\n , DstIpAddr\\r\\n , DstPortNumber\\r\\n , Url\\r\\n| order by EventTime desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"C2 Detections\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - c2 detections\"}],\"fromTemplateId\":\"sentinel-ibossMalwareAndC2Workbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -615,41 +943,43 @@ "email": "support@iboss.com", "tier": "Partner", "link": "https://www.iboss.com/contact-us/" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "ibossAma", + "kind": "DataConnector" + } + ] } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('workbookTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "properties": { - "description": "iboss Workbook with template", - "displayName": "iboss workbook template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('workbookTemplateSpecName2'),'/',variables('workbookVersion2'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName2'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ibossWebUsageWorkbook Workbook with template version 2.0.2", + "description": "ibossWebUsageWorkbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -667,7 +997,7 @@ }, "properties": { "displayName": "[parameters('workbook2-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## iboss Web Usage\\r\\n\\r\\n**NOTE:** This workbook uses a parser based on a Kusto Function to normalize fields. [Follow these steps](https://aka.ms/sentinel-iboss-parser) to create the Kusto function alias **ibossUrlEvent**.\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"7cf056ef-64cd-41a5-85e0-90c0ec529434\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"time_range_picker\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"label\":\"Time Range Picker\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| where isnotempty(UrlCategory) and UrlCategory != \\\"-\\\"\\r\\n| extend UrlCategory = split(UrlCategory, \\\", \\\")\\r\\n| mv-expand UrlCategory\\r\\n| summarize count() by tostring(UrlCategory)\",\"size\":3,\"showAnalytics\":true,\"title\":\"URL Categories\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"UrlCategory\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - categories query\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| sort by EventTime\\r\\n| summarize sum(DstBytes), sum(SrcBytes) by bin(EventTime,{time_range_picker:grain})\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Bandwidth ({time_range_picker:grain} interval)\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"sum_DstBytes\",\"label\":\"Received Bytes\"},{\"seriesName\":\"sum_SrcBytes\",\"label\":\"Sent Bytes\"}],\"showDataPoints\":true,\"ySettings\":{\"numberFormatSettings\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"50\",\"name\":\"query - bandwidth\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| where isnotempty(Domain)\\r\\n| summarize count() by Domain\\r\\n| sort by count_ desc\\r\\n| project Domain = Domain, count = count_\\r\\n| limit 20\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top 20 Domains\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Domain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"rowLimit\":20,\"sortCriteriaField\":\"count\",\"size\":\"auto\"}},\"name\":\"query - top 20 domains\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker} and DvcAction == \\\"Blocked\\\"\\r\\n| make-series Trend = count() default = 0 on EventTime step {time_range_picker:grain} by Domain\\r\\n| join kind = inner (ibossUrlEvent\\r\\n | where EventTime {time_range_picker}\\r\\n | where DvcAction == \\\"Blocked\\\"\\r\\n | summarize Requests = count() by Domain\\r\\n ) on Domain\\r\\n| project Domain, Requests, Trend\\r\\n| order by Requests desc\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top Blocked Domains\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Requests\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"redBright\",\"compositeBarSettings\":{\"labelText\":\"\"}},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"DeviceCustomDate1\",\"formatter\":5,\"formatOptions\":{\"aggregation\":\"Count\"}}]}},\"customWidth\":\"50\",\"name\":\"query - top blocked domains\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker} and DvcAction == \\\"Blocked\\\"\\r\\n| make-series Trend = count() default = 0 on EventTime step {time_range_picker:grain} by SrcUsername\\r\\n| join kind = inner (ibossUrlEvent\\r\\n | where EventTime {time_range_picker}\\r\\n | where DvcAction == \\\"Blocked\\\"\\r\\n | summarize Requests = count() by SrcUsername\\r\\n ) on SrcUsername\\r\\n| extend User = SrcUsername\\r\\n| project User, Requests, Trend\\r\\n| order by Requests desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top Blocked Users\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Requests\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"redBright\"}}]}},\"customWidth\":\"50\",\"name\":\"query - top blocked users\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| summarize sum(DstBytes), sum(SrcBytes), sum(NetworkBytes) by SrcUsername\\r\\n| join kind = inner (ibossUrlEvent\\r\\n | where EventTime {time_range_picker}\\r\\n | make-series Trend = sum(NetworkBytes) default = 0 on EventTime step {time_range_picker:grain} by SrcUsername\\r\\n ) on SrcUsername\\r\\n| order by sum_NetworkBytes desc\\r\\n| project Username=SrcUsername\\r\\n, Received=sum_DstBytes\\r\\n, Sent=sum_SrcBytes\\r\\n, Total=sum_NetworkBytes\\r\\n, Trend\",\"size\":0,\"showAnalytics\":true,\"title\":\"Bandwidth By User\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Received\",\"formatter\":8,\"formatOptions\":{\"palette\":\"green\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Sent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"green\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total\",\"formatter\":8,\"formatOptions\":{\"palette\":\"green\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"query - bandwidth by user\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| make-series Trend = count() default = 0 on EventTime step {time_range_picker:grain} by SrcUsername\\r\\n| join kind = inner (ibossUrlEvent\\r\\n | where EventTime {time_range_picker}\\r\\n | summarize Requests = count() by SrcUsername\\r\\n ) on SrcUsername\\r\\n| extend User = SrcUsername\\r\\n| project User, Requests, Trend\\r\\n| order by Requests desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Connections by User\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Requests\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"query - connections by user\"}],\"fromTemplateId\":\"sentinel-ibossWebUsageWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## iboss Web Usage\\r\\n\\r\\n**NOTE:** This workbook uses a parser based on a Kusto Function to normalize fields. [Follow these steps](https://aka.ms/sentinel-iboss-parser) to create the Kusto function alias **ibossUrlEvent**.\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"7cf056ef-64cd-41a5-85e0-90c0ec529434\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"time_range_picker\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"label\":\"Time Range Picker\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| where isnotempty(UrlCategory) and UrlCategory != \\\"-\\\"\\r\\n| extend UrlCategory = split(UrlCategory, \\\", \\\")\\r\\n| mv-expand UrlCategory\\r\\n| summarize count() by tostring(UrlCategory)\",\"size\":3,\"showAnalytics\":true,\"title\":\"URL Categories\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"UrlCategory\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - categories query\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| sort by EventTime\\r\\n| summarize sum(DstBytes), sum(SrcBytes) by bin(EventTime,{time_range_picker:grain})\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Bandwidth ({time_range_picker:grain} interval)\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"sum_DstBytes\",\"label\":\"Received Bytes\"},{\"seriesName\":\"sum_SrcBytes\",\"label\":\"Sent Bytes\"}],\"showDataPoints\":true,\"ySettings\":{\"numberFormatSettings\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"50\",\"name\":\"query - bandwidth\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| where isnotempty(Domain)\\r\\n| summarize count() by Domain\\r\\n| sort by count_ desc\\r\\n| project Domain = Domain, count = count_\\r\\n| limit 20\",\"size\":1,\"showAnalytics\":true,\"title\":\"Top 20 Domains\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Domain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"rowLimit\":20,\"sortCriteriaField\":\"count\",\"size\":\"auto\"}},\"name\":\"query - top 20 domains\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker} and DvcAction == \\\"Blocked\\\"\\r\\n| make-series Trend = count() default = 0 on EventTime step {time_range_picker:grain} by Domain\\r\\n| join kind = inner (ibossUrlEvent\\r\\n | where EventTime {time_range_picker}\\r\\n | where DvcAction == \\\"Blocked\\\"\\r\\n | summarize Requests = count() by Domain\\r\\n ) on Domain\\r\\n| project Domain, Requests, Trend\\r\\n| order by Requests desc\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top Blocked Domains\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Requests\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"redBright\",\"compositeBarSettings\":{\"labelText\":\"\"}},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"DeviceCustomDate1\",\"formatter\":5,\"formatOptions\":{\"aggregation\":\"Count\"}}]}},\"customWidth\":\"50\",\"name\":\"query - top blocked domains\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker} and DvcAction == \\\"Blocked\\\"\\r\\n| make-series Trend = count() default = 0 on EventTime step {time_range_picker:grain} by SrcUsername\\r\\n| join kind = inner (ibossUrlEvent\\r\\n | where EventTime {time_range_picker}\\r\\n | where DvcAction == \\\"Blocked\\\"\\r\\n | summarize Requests = count() by SrcUsername\\r\\n ) on SrcUsername\\r\\n| extend User = SrcUsername\\r\\n| project User, Requests, Trend\\r\\n| order by Requests desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top Blocked Users\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Requests\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"redBright\"}}]}},\"customWidth\":\"50\",\"name\":\"query - top blocked users\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| summarize sum(DstBytes), sum(SrcBytes), sum(NetworkBytes) by SrcUsername\\r\\n| join kind = inner (ibossUrlEvent\\r\\n | where EventTime {time_range_picker}\\r\\n | make-series Trend = sum(NetworkBytes) default = 0 on EventTime step {time_range_picker:grain} by SrcUsername\\r\\n ) on SrcUsername\\r\\n| order by sum_NetworkBytes desc\\r\\n| project Username=SrcUsername\\r\\n, Received=sum_DstBytes\\r\\n, Sent=sum_SrcBytes\\r\\n, Total=sum_NetworkBytes\\r\\n, Trend\",\"size\":0,\"showAnalytics\":true,\"title\":\"Bandwidth By User\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Received\",\"formatter\":8,\"formatOptions\":{\"palette\":\"green\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Sent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"green\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total\",\"formatter\":8,\"formatOptions\":{\"palette\":\"green\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"query - bandwidth by user\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ibossUrlEvent\\r\\n| where EventTime {time_range_picker}\\r\\n| make-series Trend = count() default = 0 on EventTime step {time_range_picker:grain} by SrcUsername\\r\\n| join kind = inner (ibossUrlEvent\\r\\n | where EventTime {time_range_picker}\\r\\n | summarize Requests = count() by SrcUsername\\r\\n ) on SrcUsername\\r\\n| extend User = SrcUsername\\r\\n| project User, Requests, Trend\\r\\n| order by Requests desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Connections by User\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Requests\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"query - connections by user\"}],\"fromTemplateId\":\"sentinel-ibossWebUsageWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -696,21 +1026,48 @@ "email": "support@iboss.com", "tier": "Partner", "link": "https://www.iboss.com/contact-us/" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "ibossAma", + "kind": "DataConnector" + } + ] } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId2')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook2-name')]", + "contentProductId": "[variables('_workbookcontentProductId2')]", + "id": "[variables('_workbookcontentProductId2')]", + "version": "[variables('workbookVersion2')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.2", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "iboss", + "publisherDisplayName": "iboss", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The iboss Solution provides means to connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.

\n
    \n

  1. Iboss via AMA - This data connector helps in ingesting Iboss logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. Iboss via Legacy Agent - This data connector helps in ingesting Iboss logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends installation of Iboss via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 2, Parsers: 1, Workbooks: 2

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { @@ -735,6 +1092,11 @@ "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId2')]", + "version": "[variables('dataConnectorVersion2')]" + }, { "kind": "Parser", "contentId": "[variables('_parserContentId1')]", diff --git a/Solutions/iboss/ReleaseNotes.md b/Solutions/iboss/ReleaseNotes.md new file mode 100644 index 00000000000..d5844af2e3b --- /dev/null +++ b/Solutions/iboss/ReleaseNotes.md @@ -0,0 +1,5 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------| +| 3.0.0 | 20-09-2023 | Addition of new Iboss AMA **Data Connector** | | + + diff --git a/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json b/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json index 8aad7a5b0af..e6cde3022d9 100644 --- a/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json +++ b/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json @@ -1544,7 +1544,8 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "CyberArk" + "CyberArk", + "CyberArkAma" ], "previewImagesFileNames": [ "CyberArkActivitiesWhite.PNG", @@ -1930,7 +1931,8 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "DelineaSecretServer_CEF" + "DelineaSecretServer_CEF", + "DelineaSecretServerAma" ], "previewImagesFileNames": [ "DelineaWorkbookWhite.PNG", @@ -2825,7 +2827,8 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "TrendMicroApexOne" + "TrendMicroApexOne", + "TrendMicroApexOneAma" ], "previewImagesFileNames": [ "TrendMicroApexOneBlack.png", @@ -2892,7 +2895,8 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "PaloAltoCDL" + "PaloAltoCDL", + "PaloAltoCDLAma" ], "previewImagesFileNames": [ "PaloAltoBlack.png", @@ -4793,7 +4797,9 @@ "logoFileName": "", "description": "A workbook providing insights into malware and C2 activity detected by iboss.", "dataTypesDependencies": [], - "dataConnectorsDependencies": [], + "dataConnectorsDependencies": [ + "ibossAma" + ], "previewImagesFileNames": [], "version": "1.0.0", "title": "iboss Malware and C2", @@ -4806,7 +4812,9 @@ "logoFileName": "", "description": "A workbook providing insights into web usage activity detected by iboss.", "dataTypesDependencies": [], - "dataConnectorsDependencies": [], + "dataConnectorsDependencies": [ + "ibossAma" + ], "previewImagesFileNames": [], "version": "1.0.0", "title": "iboss Web Usage", @@ -5024,7 +5032,7 @@ ], "dataConnectorsDependencies": [ "CyberArkEPM" - ], + ], "previewImagesFileNames": [ "CyberArkEPMBlack.png", "CyberArkEPMWhite.png" @@ -5408,6 +5416,24 @@ "subtitle": "", "provider": "SalemCyber" }, +{ + "workbookKey": "MimecastSEGWorkbook", + "logoFileName": "Mimecast.svg", + "description": "A workbook providing insights into Mimecast Secure Email Gateway.", + "dataTypesDependencies": [ + "MimecastDLP_CL", + "MimecastSIEM_CL" + ], + "previewImagesFileNames": [ + "MimecastSEGBlack.png", + "MimecastSEGWhite.png" + ], + "version": "1.0.0", + "title": "MimecastSEG", + "templateRelativePath": "MimecastSEGworkbook.json", + "subtitle": "Mimecast Secure Email Gateway", + "provider": "Mimecast" +}, { "workbookKey": "MimecastTTPWorkbook", "logoFileName": "Mimecast.svg", diff --git a/Workbooks/Images/Logos/ionix-logo.svg b/Workbooks/Images/Logos/ionix-logo.svg new file mode 100644 index 00000000000..26f7d3cb422 --- /dev/null +++ b/Workbooks/Images/Logos/ionix-logo.svg @@ -0,0 +1,14 @@ + + + + diff --git a/Workbooks/Images/Preview/IONIXActionItemsBlack.png b/Workbooks/Images/Preview/IONIXActionItemsBlack.png new file mode 100644 index 00000000000..e3eb2a2621b Binary files /dev/null and b/Workbooks/Images/Preview/IONIXActionItemsBlack.png differ diff --git a/Workbooks/Images/Preview/IONIXActionItemsWhite.png b/Workbooks/Images/Preview/IONIXActionItemsWhite.png new file mode 100644 index 00000000000..5887b4bcc5b Binary files /dev/null and b/Workbooks/Images/Preview/IONIXActionItemsWhite.png differ diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 1d56351eaed..69c72846082 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -2367,8 +2367,8 @@ }, { "workbookKey": "CyberpionOverviewWorkbook", - "logoFileName": "cyberpion_logo.svg", - "description": "Use Cyberpion's Security Logs and this workbook, to get an overview of your online assets, gain insights into their current state, and find ways to better secure your ecosystem.", + "logoFileName": "ionix-logo.svg", + "description": "Use IONIX's Security Logs and this workbook, to get an overview of your online assets, gain insights into their current state, and find ways to better secure your ecosystem.", "dataTypesDependencies": [ "CyberpionActionItems_CL" ], @@ -2376,14 +2376,14 @@ "CyberpionSecurityLogs" ], "previewImagesFileNames": [ - "CyberpionActionItemsBlack.png", - "CyberpionActionItemsWhite.png" + "IONIXActionItemsBlack.png", + "IONIXActionItemsWhite.png" ], - "version": "1.0.0", - "title": "Cyberpion Overview", - "templateRelativePath": "CyberpionOverviewWorkbook.json", + "version": "1.0.1", + "title": "IONIX Overview", + "templateRelativePath": "IONIXOverviewWorkbook.json", "subtitle": "", - "provider": "Cyberpion" + "provider": "IONIX" }, { "workbookKey": "SolarWindsPostCompromiseHuntingWorkbook", @@ -6645,6 +6645,20 @@ "title": "DoD Zero Trust Strategy Workbook", "templateRelativePath": "DoDZeroTrustWorkbook.json", "subtitle": "", - "provider": "Microsoft" + "provider": "Microsoft", + "support": { + "tier": "Microsoft" + }, + "author": { + "name": "Lili Davoudian, Chhorn Lim, Jay Pelletier, Michael Crane" + }, + "source": { + "kind": "Community" + }, + "categories": { + "domains": [ + "IT Operations" + ] +} } ]