/Solutions/Claroty/Parsers/ClarotyEvent.yaml does not parce out additional extensions for when threats are sent to Sentinal

[thibMP]

Describe the bug
Claroty delivers technical data related to threats triggered via a SNORT or Yara Rule but this log is partially parced. The following oare the Additional extensions that are delivered when a log is sent to Sentinal:

AdditionalExtensions

CtdSourceIp
CtdDestinationIp
CtdSourceMac
CtdDestinationMac
CtdSourceHost
CtdDestinationHost
CtdTimeGenerated
CtdExternalId
CtdDeviceExternalId
CtdMessage
CtdProtocol
CtdCategory
CtdSourceAssetType
CtdDestinationAssetType
CtdSourceZone
CtdDestinationZone
CtdAlertLink
CtdAlertId
CtdStoryId
CtdEventTypeId
CtdResolvedAs

https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Parsers/ClarotyEvent.yaml

To Reproduce
Steps to reproduce the behavior:
Review the parcer and notice that the AdditionalExtensions are not configured to be parced out.

Expected behavior
The extensions should be able to be queried.

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-muuppugund]

Hi @thibMP , Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 06/02/2024. Thanks!

[v-muuppugund]

Hi @thibMP ,Could you please share sample data to email id (v-muuppugund@microsoft.com),so can proceed with changes for additional extensions.

[thibMP]

Hi @v-muuppugund thanks I will get our SIEM engineering department to pull that info. Do you need raw data or is it ok if it is the info for what is in Sentinal today?

[v-muuppugund]

Hi @v-muuppugund thanks I will get our SIEM engineering department to pull that info. Do you need raw data or is it ok if it is the info for what is in Sentinal today?

Hi @thibMP , Please share both the data will do some data analysis ,so will have data points for updating the parser.

[v-muuppugund]

Hi @thibMP ,gentle reminder,Could you please share both the data will do some data analysis ,so will have data points for updating the parser.

[v-sudkharat]

Hi @thibMP, since we have not received a response in the last 5 days, we are closing your issue #9860 as per our standard operating procedures. If you still need support for this issue, feel free to re-open at any time. Thank you for your co-operation.