-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #11341 from Azure/Update-Windows-Auth-Parser
Updating Windows Auth Parser
- Loading branch information
Showing
12 changed files
with
1,425 additions
and
141 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
46 changes: 46 additions & 0 deletions
46
...thentication/ARM/ASimAuthenticationIllumioSaaSCore/ASimAuthenticationIllumioSaaSCore.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| { | ||
| "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", | ||
| "contentVersion": "1.0.0.0", | ||
| "parameters": { | ||
| "Workspace": { | ||
| "type": "string", | ||
| "metadata": { | ||
| "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." | ||
| } | ||
| }, | ||
| "WorkspaceRegion": { | ||
| "type": "string", | ||
| "defaultValue": "[resourceGroup().location]", | ||
| "metadata": { | ||
| "description": "The region of the selected workspace. The default value will use the Region selection above." | ||
| } | ||
| } | ||
| }, | ||
| "resources": [ | ||
| { | ||
| "type": "Microsoft.OperationalInsights/workspaces", | ||
| "apiVersion": "2017-03-15-preview", | ||
| "name": "[parameters('Workspace')]", | ||
| "location": "[parameters('WorkspaceRegion')]", | ||
| "resources": [ | ||
| { | ||
| "type": "savedSearches", | ||
| "apiVersion": "2020-08-01", | ||
| "name": "ASimAuthenticationIllumioSaaSCore", | ||
| "dependsOn": [ | ||
| "[concat('Microsoft.OperationalInsights/workspaces/', parameters('Workspace'))]" | ||
| ], | ||
| "properties": { | ||
| "etag": "*", | ||
| "displayName": "Authentication ASIM parser for Illumio SaaS Core", | ||
| "category": "ASIM", | ||
| "FunctionAlias": "ASimAuthenticationIllumioSaaSCore", | ||
| "query": "let EventTypeLookup = datatable(\n event_type: string, // what Illumio sends\n EventType: string, // an enumerated list [ Logon, Logoff, Elevate ] event type\n EventResultDetails: string,\n EventResult: string\n)\n[\n 'user.authenticate', 'Logon', 'Other', 'Success',\n 'user.login', 'Logon', 'Other', 'Success',\n 'user.logout', 'Logoff', 'Other', 'Success',\n 'user.sign_in', 'Logon', 'Other', 'Success',\n 'user.sign_out', 'Logoff', 'Other', 'Success',\n 'user.use_expired_password', 'Logon', 'Password expired', 'Success'\n];\nlet user_events = dynamic(['user.sigin', 'user.login', 'user.sign_out', 'user.logout', 'user.authenticate', 'user.use_expired_password']);\nlet parser=(disabled: bool=false) {\n Illumio_Auditable_Events_CL\n | where not(disabled) and event_type in (user_events) // limited to user signin, login, logoff, signoff events only\n | extend \n EventProduct='Core'\n ,\n EventVendor='Illumio'\n ,\n EventSchema = 'Authentication'\n ,\n EventCount=int(1)\n ,\n EventSchemaVersion='0.1.3'\n , \n EventOriginalUid = href\n | lookup EventTypeLookup on event_type //fetch EventType, EventResultDetails, EventResult\n | extend \n EventStartTime=TimeGenerated\n ,\n EventEndTime=TimeGenerated\n , \n TargetUsername = case( \n isnotnull(created_by.user), created_by.user.username, \n \"Unknown\"\n ),\n TargetUsernameType = \"Simple\",\n EventUid = _ItemId,\n SrcIpAddr = iff(action.src_ip == 'FILTERED', \"\", action.src_ip)\n // ** Aliases\n | extend \n Dvc=EventVendor\n ,\n IpAddr=SrcIpAddr\n ,\n User = TargetUsername\n | project-away \n TenantId,\n href,\n pce_fqdn,\n created_by,\n event_type,\n status,\n severity,\n action,\n resource_changes,\n notifications,\n version \n };\n parser(disabled = disabled)", | ||
| "version": 1, | ||
| "functionParameters": "disabled:bool=False" | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } |
18 changes: 18 additions & 0 deletions
18
Parsers/ASimAuthentication/ARM/ASimAuthenticationIllumioSaaSCore/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| # Illumio ASIM Authentication Normalization Parser | ||
|
|
||
| ARM template for ASIM Authentication schema parser for Illumio. | ||
|
|
||
| This ASIM parser supports normalizing Illumio sign in logs, stored in the Illumio_Auditable_Events_CL table, to the ASIM Authentication schema. | ||
|
|
||
|
|
||
| The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. | ||
|
|
||
| For more information, see: | ||
|
|
||
| - [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) | ||
| - [Deploy all of ASIM](https://aka.ms/DeployASIM) | ||
| - [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc) | ||
|
|
||
| <br> | ||
|
|
||
| [](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationIllumioSaaSCore%2FASimAuthenticationIllumioSaaSCore.json) [](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationIllumioSaaSCore%2FASimAuthenticationIllumioSaaSCore.json) |
Oops, something went wrong.