ASIM Process Event schema parser with its sample and test data for SentinelOne

[jayeshprajapaticrest]

Required items, please complete

Change(s):

• Added ASIM Process Event schema parser for SentinelOne based on API Data

Reason for Change(s):

• Initial version ASIM Process Event Parser

Version Updated:

• Initial version

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[v-sudkharat]

Hello @jayeshprajapaticrest, thank you for raising Pull Request with us! We will review it internally and get back to you by shortly.

[vakohl]

ETA: for review by 18th Aug

[v-rbajaj]

Hi @jayeshprajapaticrest, can you please make the above suggested changes?

[v-rbajaj]

Hi @jayeshprajapaticrest, please make the above suggested changes.

[v-rbajaj]

Hi @jayeshprajapaticrest, can you please make the suggested changes ?

[v-rbajaj]

Hi @jayeshprajapaticrest, can you please make the suggested changes ?

[jayeshprajapaticrest]

Hi @jayeshprajapaticrest, can you please make the suggested changes ?

Suggested changes are made in commit 868ebb8 and unifying parser related changes are done in commit e94a8d9

[v-atulyadav]

Hi @jayeshprajapaticrest,
KQL validations are failing for the items mentioned below. Please have a look at them. Thanks

[jayeshprajapaticrest]

@v-atulyadav Two validation error gets resolved. And the currently getting error is not because of our code implementation. As I check its in the other ASIM parser added in the unifying parser file.

[niralishah-crest]

@vakohl we have mapped the inspection fields below in the ProcessCreate parser, which we found from SentinelOne Alerts logs.
RuleName
Rule
ThreatConfidence
ThreatOriginalConfidence

[vakohl]

@v-atulyadav can you check the validation error?

[vakohl]

@v-atulyadav Two validation error gets resolved. And the currently getting error is not because of our code implementation. As I check its in the other ASIM parser added in the unifying parser file.

@jayeshprajapaticrest can you pull the latest files from github. there might be some changes done recently for the process union parsers files. See if this resolves the error

[v-atulyadav]

Hi @vakohl @jayeshprajapaticrest,
It still fails for the below error after pulling the latest master from this branch. Thanks

[jayeshprajapaticrest]

Hi @vakohl @jayeshprajapaticrest, It still fails for the below error after pulling the latest master from this branch. Thanks

@vakohl @v-atulyadav I also merged latest from master to the PR but it gives error