Salesforce-asim-authentication parser #6167

rushriva · 2022-09-16T11:52:12Z

Required items, please complete

Change(s):

Added asim authentication parser for Salesforce

Reason for Change(s):

Salesforce content enrichment

Version Updated:

NA

Testing Completed:

yes

Checked that the validations are passing and have addressed any issues that are present:

NA

Guidance <- remove section before submitting

oshezaf · 2022-09-16T13:23:02Z

Hi @rushriva: to help me review -

Where are the sample logs located?
Did you run the ASIM testers? If so, can you share the restults?

rushriva · 2022-09-20T14:31:59Z

Hi @rushriva: to help me review -

Where are the sample logs located?

Did you run the ASIM testers? If so, can you share the restults?

@oshezaf - Please find response in-line

Sample logs - I will mail you workspace with sample logs in separate mail
ASIM tester output - attached in this comment.
ASimtester-output-SalesforceSC.csv

oshezaf

First, while there are many comments... You did a very good job. Don't let the many comments here deter you.

As to the comments:

You need to create the vim parser as well. Can be a second step after this one is finished.
Did you add sample data based on the workspace to either the public repository or the private one (Prateek can help with the datails)?
You probably did not run the data tester.
I noticed that you added the project statement after testing, which is good. Notice a missing field (see later).
I need to update testing. There are fields that need setting and are not flagged. Will do it ASAP. It might lead to additional notes.
Additional mappings
- api_version_s -> EventProductVersion
- organization_id_s -> TargetUserScope (this is a very new additional to the schema, needed for UEBA)
- cipher_suite_s -> TlsCipher (not yet defined, but seems useful, will be added)
- tls_protocol_s -> TlsVersion (not yet defined, but seems useful, will be added)
- Do you know what login_key_s is?

Parsers/ASimAuthentication/Parsers/ASimAuthenticationSalesforceSC.yaml

rushriva · 2022-09-30T10:16:00Z

First, while there are many comments... You did a very good job. Don't let the many comments here deter you.

As to the comments:

You need to create the vim parser as well. Can be a second step after this one is finished.

Did you add sample data based on the workspace to either the public repository or the private one (Prateek can help with the datails)?

You probably did not run the data tester.

I noticed that you added the project statement after testing, which is good. Notice a missing field (see later).

I need to update testing. There are fields that need setting and are not flagged. Will do it ASAP. It might lead to additional notes.

Additional mappings

api_version_s -> EventProductVersion

organization_id_s -> TargetUserScope (this is a very new additional to the schema, needed for UEBA)

cipher_suite_s -> TlsCipher (not yet defined, but seems useful, will be added)

tls_protocol_s -> TlsVersion (not yet defined, but seems useful, will be added)

Do you know what login_key_s is?

@oshezaf - I will create vim parser once asim parser is approved with changes.
I have executed data tester, following fields need to be added -
EventProduct - Salesforce Service Cloud
TargetUserIdType - SalesforceId

v-prasadboke · 2023-05-03T05:17:09Z

Hello @v-sabiraj please look into this

v-prasadboke · 2023-05-05T05:18:05Z

Hello @v-sabiraj any updates on the above

v-prasadboke · 2023-05-09T12:18:16Z

Hello @v-sabiraj waiting for your feedback

v-prasadboke · 2023-05-18T16:28:30Z

Hello @oshezaf please look into the changes

…tionSalesforceSC

…ML files.

github-actions · 2023-06-28T19:11:03Z

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files.
To find the new ARM templates, pull your branch.

…com/Azure/Azure-Sentinel into asim-ASimAuthenticationSalesforceSC

…ML files.

…com/Azure/Azure-Sentinel into asim-ASimAuthenticationSalesforceSC

vakohl · 2023-12-08T10:37:26Z

@microsoft-github-policy-service agree [company="Microsoft"]

vakohl · 2023-12-08T10:37:56Z

@rushriva please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement

@microsoft-github-policy-service agree [company="Microsoft"]

vakohl · 2023-12-08T10:38:45Z

@rushriva please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement

@microsoft-github-policy-service agree company="Microsoft"

…com/Azure/Azure-Sentinel into asim-ASimAuthenticationSalesforceSC

…tionSalesforceSC

…ML files.

vakohl · 2023-12-10T06:23:54Z

@rushriva please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement

@microsoft-github-policy-service agree [company="Microsoft"]

@microsoft-github-policy-service agree

@microsoft-github-policy-service agree company="Microsoft"

vakohl · 2024-01-08T11:56:47Z

@anki-narravula can you please validate the comments?

…ML files.

contentautomationbot

KQL Best Practices Suggestions for: ASimAuthentication.yaml

Consider using the materialize() function for the 'ASimAuthenticationDisabled' variable if its assignment involves computation or calculation. This can improve performance.
Consider using more specific operators before materialize() to reduce the materialized data set while preserving query semantics.

Disclaimer: These suggestions are offered to enhance query efficiency and adherence to best practices. It is recommended to consider applying them for improved code quality, but their application is optional and context-dependent.

contentautomationbot

KQL Best Practices Suggestions for: ASimAuthenticationSalesforceSC.yaml

Use the 'in' operator instead of 'in~' for case-sensitive comparisons.
Don't use '*' for searching text. Look in a specific column.
Consider using the materialize() function for the 'disabled' variable if its assignment involves computation or calculation. This can improve performance.
Consider using the materialize() function for the 'EventResultLookup' variable if its assignment involves computation or calculation. This can improve performance.

Disclaimer: These suggestions are offered to enhance query efficiency and adherence to best practices. It is recommended to consider applying them for improved code quality, but their application is optional and context-dependent.

contentautomationbot

KQL Best Practices Suggestions for: imAuthentication.yaml

Don't use '*' for searching text. Look in a specific column.
Consider using the materialize() function for the 'starttime' variable if its assignment involves computation or calculation. This can improve performance.
Consider using the materialize() function for the 'endtime' variable if its assignment involves computation or calculation. This can improve performance.
Consider using the materialize() function for the 'targetusername_has' variable if its assignment involves computation or calculation. This can improve performance.
Consider using the materialize() function for the 'DisabledParsers' variable if its assignment involves computation or calculation. This can improve performance.
Consider using the materialize() function for the 'imAuthenticationDisabled' variable if its assignment involves computation or calculation. This can improve performance.
Consider using more specific operators before materialize() to reduce the materialized data set while preserving query semantics.

Disclaimer: These suggestions are offered to enhance query efficiency and adherence to best practices. It is recommended to consider applying them for improved code quality, but their application is optional and context-dependent.

contentautomationbot

KQL Best Practices Suggestions for: vimAuthenticationSalesforceSC.yaml

Use the 'in' operator instead of 'in~' for case-sensitive comparisons.
Don't use '*' for searching text. Look in a specific column.
Consider using the materialize() function for the 'starttime' variable if its assignment involves computation or calculation. This can improve performance.
Consider using the materialize() function for the 'endtime' variable if its assignment involves computation or calculation. This can improve performance.
Consider using the materialize() function for the 'targetusername_has' variable if its assignment involves computation or calculation. This can improve performance.
Consider using the materialize() function for the 'disabled' variable if its assignment involves computation or calculation. This can improve performance.
Consider using the materialize() function for the 'EventResultLookup' variable if its assignment involves computation or calculation. This can improve performance.

Disclaimer: These suggestions are offered to enhance query efficiency and adherence to best practices. It is recommended to consider applying them for improved code quality, but their application is optional and context-dependent.

v-sudkharat · 2024-02-19T06:19:00Z

Hi @vakohl, This branch has conflicts. Could you please check and resolve it. Thanks!

… asim-ASimAuthenticationSalesforceSC

…ML files.

v-sudkharat · 2024-02-21T09:36:08Z

@microsoft-github-policy-service agree [company="Microsoft"]

all changes are incorporated

Salesforce-asim-authentication parser

49a2a61

rushriva requested review from a team as code owners September 16, 2022 11:52

oshezaf self-assigned this Sep 16, 2022

oshezaf added the ASIM label Sep 16, 2022

rushriva added 3 commits September 20, 2022 16:31

Update ASimAuthenticationSalesforceSC.yaml

85bc87c

Update ASimAuthenticationSalesforceSC.yaml

25b1e7f

Update ASimAuthenticationSalesforceSC.yaml

b127b00

oshezaf previously requested changes Sep 20, 2022

View reviewed changes

Update ASimAuthenticationSalesforceSC.yaml

b342acc

v-atulyadav assigned v-sabiraj May 3, 2023

oshezaf assigned devikamehra May 22, 2023

v-atulyadav marked this pull request as draft June 23, 2023 10:59

devikamehra and others added 3 commits June 29, 2023 00:37

Merging master

72a40c9

Merge remote-tracking branch 'origin/master' into asim-ASimAuthentica…

8417945

…tionSalesforceSC

[ASIM Parsers] Generate deployable ARM templates from KQL function YA…

92395cf

…ML files.

devikamehra and others added 5 commits June 29, 2023 00:46

Updated EventType

71368f6

Merge branch 'asim-ASimAuthenticationSalesforceSC' of https://github.…

976f516

…com/Azure/Azure-Sentinel into asim-ASimAuthenticationSalesforceSC

[ASIM Parsers] Generate deployable ARM templates from KQL function YA…

ad303dc

…ML files.

Change time generated

09187fc

Merge branch 'asim-ASimAuthenticationSalesforceSC' of https://github.…

11f8a18

…com/Azure/Azure-Sentinel into asim-ASimAuthenticationSalesforceSC

vakohl and others added 6 commits December 8, 2023 16:55

updating test results

2e1883e

Merge branch 'asim-ASimAuthenticationSalesforceSC' of https://github.…

6ec9791

…com/Azure/Azure-Sentinel into asim-ASimAuthenticationSalesforceSC

Merge remote-tracking branch 'origin/master' into asim-ASimAuthentica…

1fd53f6

…tionSalesforceSC

[ASIM Parsers] Generate deployable ARM templates from KQL function YA…

d76775e

…ML files.

indentation fix on union parsers

45bd832

[ASIM Parsers] Generate deployable ARM templates from KQL function YA…

46e0c30

…ML files.

vakohl and others added 2 commits January 8, 2024 17:35

Merge branch 'master' into asim-ASimAuthenticationSalesforceSC

6bd92ab

[ASIM Parsers] Generate deployable ARM templates from KQL function YA…

eef1e8e

…ML files.

contentautomationbot bot reviewed Jan 8, 2024

View reviewed changes

anki-narravula previously approved these changes Feb 13, 2024

View reviewed changes

Merge branch 'master' into asim-ASimAuthenticationSalesforceSC

f7d84a2

vakohl dismissed anki-narravula’s stale review via f7d84a2 February 19, 2024 07:18

vakohl and others added 2 commits February 20, 2024 15:19

Merge branch 'master' of https://github.com/Azure/Azure-Sentinel into…

918fd56

… asim-ASimAuthenticationSalesforceSC

[ASIM Parsers] Generate deployable ARM templates from KQL function YA…

f51ec31

…ML files.

anki-narravula approved these changes Feb 21, 2024

View reviewed changes

Merge branch 'master' into asim-ASimAuthenticationSalesforceSC

536d988

v-atulyadav approved these changes Feb 21, 2024

View reviewed changes

v-atulyadav merged commit 4a85974 into master Feb 21, 2024
30 checks passed

v-sudkharat mentioned this pull request Feb 21, 2024

V sudkharat/salesforce asim authentication parser #10003

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Salesforce-asim-authentication parser #6167

Salesforce-asim-authentication parser #6167

rushriva commented Sep 16, 2022

oshezaf commented Sep 16, 2022

rushriva commented Sep 20, 2022

oshezaf left a comment

rushriva commented Sep 30, 2022 •

edited

Loading

v-prasadboke commented May 3, 2023

v-prasadboke commented May 5, 2023

v-prasadboke commented May 9, 2023

v-prasadboke commented May 18, 2023

github-actions bot commented Jun 28, 2023

vakohl commented Dec 8, 2023

vakohl commented Dec 8, 2023

vakohl commented Dec 8, 2023

vakohl commented Dec 10, 2023

vakohl commented Jan 8, 2024

contentautomationbot bot left a comment

contentautomationbot bot left a comment

contentautomationbot bot left a comment

contentautomationbot bot left a comment

v-sudkharat commented Feb 19, 2024

v-sudkharat commented Feb 21, 2024

Salesforce-asim-authentication parser #6167

Salesforce-asim-authentication parser #6167

Conversation

rushriva commented Sep 16, 2022

Guidance <- remove section before submitting

oshezaf commented Sep 16, 2022

rushriva commented Sep 20, 2022

oshezaf left a comment

Choose a reason for hiding this comment

rushriva commented Sep 30, 2022 • edited Loading

v-prasadboke commented May 3, 2023

v-prasadboke commented May 5, 2023

v-prasadboke commented May 9, 2023

v-prasadboke commented May 18, 2023

github-actions bot commented Jun 28, 2023

vakohl commented Dec 8, 2023

vakohl commented Dec 8, 2023

vakohl commented Dec 8, 2023

vakohl commented Dec 10, 2023

vakohl commented Jan 8, 2024

contentautomationbot bot left a comment

Choose a reason for hiding this comment

contentautomationbot bot left a comment

Choose a reason for hiding this comment

contentautomationbot bot left a comment

Choose a reason for hiding this comment

contentautomationbot bot left a comment

Choose a reason for hiding this comment

v-sudkharat commented Feb 19, 2024

v-sudkharat commented Feb 21, 2024

rushriva commented Sep 30, 2022 •

edited

Loading