-
Notifications
You must be signed in to change notification settings - Fork 3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
c6c1afd
commit b41352e
Showing
10 changed files
with
142 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| Parser: | ||
| Title: Audit Event ASIM parser for Microsoft Sentinel native Audit Event table | ||
| Version: '0.1.1' | ||
| LastUpdated: Dec 13, 2024 | ||
| Product: | ||
| Name: Native | ||
| Normalization: | ||
| Schema: AuditEvent | ||
| Version: '0.1' | ||
| References: | ||
| - Title: ASIM Audit Event Schema | ||
| Link: https://aka.ms/ASimAuditEventDoc | ||
| - Title: ASIM | ||
| Link: https://aka.ms/AboutASIM | ||
| Description: | | ||
| This ASIM parser supports normalizing the native Microsoft Sentinel Audit Event table (ASimAuditEventLogs) to the ASIM Audit Event normalized schema. While the native table is ASIM compliant, the parser is needed to add capabilities, such as aliases, available only at query time. | ||
| ParserName: ASimAuditEventNative | ||
| EquivalentBuiltInParser: _ASim_AuditEvent_Native | ||
| ParserParams: | ||
| - Name: disabled | ||
| Type: bool | ||
| Default: false | ||
| ParserQuery: | | ||
| let parser=(disabled:bool=false) | ||
| { | ||
| ASimAuditEventLogs | where not(disabled) | ||
| | project-rename | ||
| EventUid = _ItemId | ||
| | extend | ||
| Value = NewValue, | ||
| User = ActorUsername, | ||
| Application = TargetAppName, | ||
| Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName) | ||
| | project-away | ||
| TenantId, SourceSystem, _ResourceId, _SubscriptionId | ||
| }; | ||
| parser (disabled=disabled) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| Parser: | ||
| Title: Audit Event ASIM filtering parser for Microsoft Sentinel native Audit Event table | ||
| Version: '0.1.1' | ||
| LastUpdated: Dec 13, 2024 | ||
| Product: | ||
| Name: Native | ||
| Normalization: | ||
| Schema: AuditEvent | ||
| Version: '0.1' | ||
| References: | ||
| - Title: ASIM Audit Event Schema | ||
| Link: https://aka.ms/ASimAuditEventDoc | ||
| - Title: ASIM | ||
| Link: https://aka.ms/AboutASIM | ||
| Description: | | ||
| This ASIM parser supports filtering and normalizing the native Microsoft Sentinel Audit Event table (ASimAuditEventLogs) to the ASIM Audit Event normalized schema. While the native table is ASIM compliant, the parser is needed to add capabilities, such as aliases, available only at query time. | ||
| ParserName: vimAuditEventNative | ||
| EquivalentBuiltInParser: _Im_AuditEvent_Native | ||
| ParserParams: | ||
| - Name: starttime | ||
| Type: datetime | ||
| Default: datetime(null) | ||
| - Name: endtime | ||
| Type: datetime | ||
| Default: datetime(null) | ||
| - Name: srcipaddr_has_any_prefix | ||
| Type: dynamic | ||
| Default: dynamic([]) | ||
| - Name: actorusername_has_any | ||
| Type: dynamic | ||
| Default: dynamic([]) | ||
| - Name: operation_has_any | ||
| Type: dynamic | ||
| Default: dynamic([]) | ||
| - Name: eventtype_in | ||
| Type: dynamic | ||
| Default: dynamic([]) | ||
| - Name: eventresult | ||
| Type: string | ||
| Default: "*" | ||
| - Name: object_has_any | ||
| Type: dynamic | ||
| Default: dynamic([]) | ||
| - Name: newvalue_has_any | ||
| Type: dynamic | ||
| Default: dynamic([]) | ||
| - Name: disabled | ||
| Type: bool | ||
| Default: false | ||
|
|
||
| ParserQuery: | | ||
| let parser= | ||
| ( | ||
| starttime: datetime=datetime(null), | ||
| endtime: datetime=datetime(null), | ||
| srcipaddr_has_any_prefix: dynamic=dynamic([]), | ||
| eventtype_in: dynamic=dynamic([]), | ||
| eventresult: string='*', | ||
| actorusername_has_any: dynamic=dynamic([]), | ||
| operation_has_any: dynamic=dynamic([]), | ||
| object_has_any: dynamic=dynamic([]), | ||
| newvalue_has_any: dynamic=dynamic([]), | ||
| disabled: bool = false | ||
| ) | ||
| { | ||
| ASimAuditEventLogs | where not(disabled) | ||
| | where (isnull(starttime) or TimeGenerated >= starttime) | ||
| and (isnull(endtime) or TimeGenerated <= endtime) | ||
| and (array_length(srcipaddr_has_any_prefix) == 0) | ||
| and (array_length(actorusername_has_any) == 0 or EventData has_any (actorusername_has_any)) | ||
| and (array_length(newvalue_has_any) == 0 or EventData has_any (newvalue_has_any)) | ||
| and (array_length(eventtype_in) == 0 or 'Delete' in (eventtype_in)) | ||
| and (array_length(operation_has_any) == 0 or 'Delete Logs' has_any (operation_has_any)) | ||
| and (eventresult == '*' or 'Success' =~ eventresult) | ||
| and (array_length(object_has_any) == 0 or Object has_any (object_has_any)) | ||
| | project-rename | ||
| EventUid = _ItemId | ||
| | extend | ||
| Value = NewValue, | ||
| User = ActorUsername, | ||
| Application = TargetAppName, | ||
| Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName) | ||
| | project-away | ||
| TenantId, SourceSystem, _ResourceId, _SubscriptionId | ||
| }; | ||
| parser( | ||
| starttime=starttime, | ||
| endtime=endtime, | ||
| srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, | ||
| eventtype_in=eventtype_in, | ||
| eventresult=eventresult, | ||
| actorusername_has_any=actorusername_has_any, | ||
| operation_has_any=operation_has_any, | ||
| object_has_any=object_has_any, | ||
| newvalue_has_any=newvalue_has_any, | ||
| disabled=disabled | ||
| ) |
Binary file not shown.
Binary file not shown.
Binary file modified
BIN
+104 KB
(180%)
Solutions/Infoblox NIOS/TSG/TSG-Infoblox-Delete Existing Funtions.docx
Binary file not shown.
Binary file modified
BIN
+112 KB
(110%)
Solutions/Salesforce Service Cloud/TSG/Salesforce Service Cloud Account Setup.docx
Binary file not shown.
Binary file not shown.
Binary file not shown.