-
Notifications
You must be signed in to change notification settings - Fork 3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
d21fa9c
commit 834a40f
Showing
4 changed files
with
149 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
41 changes: 41 additions & 0 deletions
41
Parsers/ASimAuthentication/Parsers/ASimAuthenticationNative.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| Parser: | ||
| Title: Authentication Event ASIM parser for Microsoft Sentinel native Authentication table | ||
| Version: '0.1.1' | ||
| LastUpdated: Dece 10, 2024 | ||
| Product: | ||
| Name: Native | ||
| Normalization: | ||
| Schema: Authentication | ||
| Version: '0.1.1' | ||
| References: | ||
| - Title: ASIM Authentication Schema | ||
| Link: https://aka.ms/ASimAuthenticationDoc | ||
| - Title: ASIM | ||
| Link: https://aka.ms/AboutASIM | ||
| Description: | | ||
| This ASIM parser supports normalizing the native Microsoft Sentinel Authentication table (ASimAuthenticationEventLogs) to the ASIM Authentication Event normalized schema. While the native table is ASIM compliant, the parser is needed to add capabilities, such as aliases, available only at query time. | ||
| ParserName: ASimAuthenticationNative | ||
| EquivalentBuiltInParser: _ASim_Authentication_Native | ||
| ParserParams: | ||
| - Name: disabled | ||
| Type: bool | ||
| Default: false | ||
| ParserQuery: | | ||
| let parser=(disabled:bool=false) | ||
| { | ||
| ASimAuthenticationEventLogs | where not(disabled) | ||
| | project-rename | ||
| EventUid = _ItemId | ||
| | extend | ||
| User = TargetUsername, | ||
| Src = coalesce (SrcDvcId, SrcHostname, or SrcIpAddr), | ||
| IpAddr=SrcIpAddr, | ||
| LogonTarget= coalesce (TargetAppName, TargetUrl, TargetHostname), | ||
| Dst = coalesce (TargerDvcId, TargetHostname, TargetIpAddr, TargetAppId,TargetAppName), | ||
| Rule = coalesce(NetworkRuleName, tostring(NetworkRuleNumber)), | ||
| EventStartTime = TimeGenerated, | ||
| EventSchema = "Authentication" | ||
| | project-away | ||
| TenantId, SourceSystem, _ResourceId, _SubscriptionId | ||
| }; | ||
| parser (disabled=disabled) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
100 changes: 100 additions & 0 deletions
100
Parsers/ASimAuthentication/Parsers/vimAuthenticationNative.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| Parser: | ||
| Title: Authentication Event ASIM filtering parser for Microsoft Sentinel native Authentication table | ||
| Version: '0.1.1' | ||
| LastUpdated: Dece 10, 2024 | ||
| Product: | ||
| Name: Native | ||
| Normalization: | ||
| Schema: Authentication | ||
| Version: '0.1.1' | ||
| References: | ||
| - Title: ASIM Authentication Schema | ||
| Link: https://aka.ms/ASimAuthenticationDoc | ||
| - Title: ASIM | ||
| Link: https://aka.ms/AboutASIM | ||
| Description: | | ||
| This ASIM parser supports filtering and normalizing the native Microsoft Sentinel Authentication table (ASimAuthenticationEventLogs) to the ASIM Authentication Event normalized schema. While the native table is ASIM compliant, the parser is needed to add capabilities, such as aliases, available only at query time. | ||
| ParserName: vimAuthenticationNative | ||
| EquivalentBuiltInParser: _Im_Authentication_Native | ||
| ParserParams: | ||
| - Name: starttime | ||
| Type: datetime | ||
| Default: datetime(null) | ||
| - Name: endtime | ||
| Type: datetime | ||
| Default: datetime(null) | ||
| - Name: srcipaddr | ||
| Type: string | ||
| Default: '*' | ||
| - Name: domain_has_any | ||
| Type: dynamic | ||
| Default: dynamic([]) | ||
| - Name: responsecodename | ||
| Type: string | ||
| Default: '*' | ||
| - Name: response_has_ipv4 | ||
| Type: string | ||
| Default: '*' | ||
| - Name: response_has_any_prefix | ||
| Type: dynamic | ||
| Default: dynamic([]) | ||
| - Name: eventtype | ||
| Type: string | ||
| Default: 'Query' | ||
| - Name: disabled | ||
| Type: bool | ||
| Default: false | ||
|
|
||
| ParserQuery: | | ||
| let parser= | ||
| ( | ||
| starttime: datetime=datetime(null), | ||
| endtime: datetime=datetime(null), | ||
| username_has_any: dynamic = dynamic([]), | ||
| targetappname_has_any: dynamic = dynamic([]), | ||
| srcipaddr_has_any_prefix: dynamic = dynamic([]), | ||
| srchostname_has_any: dynamic = dynamic([]), | ||
| eventtype_in: dynamic = dynamic([]), | ||
| eventresultdetails_in: dynamic = dynamic([]), | ||
| eventresult: string = '*', | ||
| disabled: bool=false | ||
| ) | ||
| { | ||
| ASimAuthenticationEventLogs | where not(disabled) | ||
| // -- Pre-parsing filtering: | ||
| | where | ||
| (isnull(starttime) or TimeGenerated >= starttime) | ||
| and (isnull(endtime) or TimeGenerated <= endtime) | ||
| and ((array_length(username_has_any) == 0) or ActorUsername has_any (username_has_any)) | ||
| and (array_length(targetappname_has_any) == 0) // TargetAppName not available in source | ||
| and ((array_length(srcipaddr_has_any_prefix) == 0) or (has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix))) | ||
| and (array_length(srchostname_has_any) == 0) // SrcHostname not available in source | ||
| and ((array_length(eventtype_in) == 0) or EventType in~ (eventtype_in)) | ||
| and (array_length(eventresultdetails_in) == 0) | ||
| and (eventresult == "*" or (EventResult == eventresult)) | ||
| // -- | ||
| | project-rename | ||
| EventUid = _ItemId | ||
| | extend | ||
| User = TargetUsername, | ||
| Src = coalesce (SrcDvcId, SrcHostname, or SrcIpAddr), | ||
| IpAddr=SrcIpAddr, | ||
| LogonTarget= coalesce (TargetAppName, TargetUrl, TargetHostname), | ||
| Dst = coalesce (TargerDvcId, TargetHostname, TargetIpAddr, TargetAppId,TargetAppName), | ||
| Rule = coalesce(NetworkRuleName, tostring(NetworkRuleNumber)), | ||
| EventStartTime = TimeGenerated, | ||
| EventEndTime = TimeGenerated, | ||
| EventSchema = "Authentication" | ||
| | project-away | ||
| TenantId, SourceSystem, _ResourceId, _SubscriptionId | ||
| }; | ||
| parser (starttime=starttime, | ||
| endtime=endtime, | ||
| username_has_any=username_has_any, | ||
| targetappname_has_any=targetappname_has_any, | ||
| srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, | ||
| srchostname_has_any=srchostname_has_any, | ||
| eventtype_in=eventtype_in, | ||
| eventresultdetails_in=eventresultdetails_in, | ||
| eventresult=eventresult, | ||
| disabled=disable) |