Skip to content

[ASIM] Fix for AWS User Management Parser- #15413 #15413

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Brandon Qiao (Microsoft) (bqiao-microsoft) merged 9 commits into from
Oct 23, 2026
Merged

[ASIM] Fix for AWS User Management Parser- #15413 #15413

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
0239143
fix
bqiao-microsoft Oct 23, 2026
e417c81
Merge remote-tracking branch 'origin/master' into fix/asim-awscloudtr…
Oct 23, 2026
88df5dd
[ASIM Parsers] Generate deployable ARM templates from KQL function YA…
Oct 23, 2026
c4b3c1b
semicolon fix
bqiao-microsoft Oct 23, 2026
18ca46e
Merge branch 'fix/asim-awscloudtrail-untaguser-duplicates' of https:/…
bqiao-microsoft Oct 23, 2026
56ce96d
[ASIM Parsers] Generate deployable ARM templates from KQL function YA…
Oct 23, 2026
f6d734a
changelog
bqiao-microsoft Oct 23, 2026
f3ac636
Merge branch 'fix/asim-awscloudtrail-untaguser-duplicates' of https:/…
bqiao-microsoft Oct 23, 2026
ca7beac
new docs
bqiao-microsoft Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...imUserManagement/ARM/ASimUserManagementAWSCloudTrail/ASimUserManagementAWSCloudTrail.json
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion ...ASimUserManagement/ARM/vimUserManagementAWSCloudTrail/vimUserManagementAWSCloudTrail.json
View file
Open in desktop

Large diffs are not rendered by default.

5 changes: 5 additions & 0 deletions Parsers/ASimUserManagement/CHANGELOG/ASimUserManagementAWSCloudTrail.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,10 @@
# Changelog for ASimUserManagementAWSCloudTrail.yaml

## Version 0.1.1

- (2026-10-23) Remove the duplicate IAM lookup entry for UntagUser so each matching event produces one UserModified output row. - [PR #15413](https://github.com/Azure/Azure-Sentinel/pull/15413)
- Remove the trailing semicolon from the parser invocation so callers and KQL validation can append pipeline operators.

## Version 0.1.0
- (2026-01-26) [ASIM] UserManagement - AWSCloudTrail (New Parser) - [PR #13503](https://github.com/Azure/Azure-Sentinel/pull/13503)
- Create parser for AWSCloudTrail
Expand Down
4 changes: 4 additions & 0 deletions Parsers/ASimUserManagement/CHANGELOG/vimUserManagementAWSCloudTrail.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
# Changelog for vimUserManagementAWSCloudTrail.yaml

## Version 0.1.1

- (2026-10-23) Remove the duplicate IAM lookup entry for UntagUser so each matching event produces one UserModified output row. - [PR #15413](https://github.com/Azure/Azure-Sentinel/pull/15413)

## Version 0.1.0
- (2026-01-26) [ASIM] UserManagement - AWSCloudTrail (New Parser) - [PR #13503](https://github.com/Azure/Azure-Sentinel/pull/13503)
- Create parser for AWSCloudTrail
Expand Down
7 changes: 3 additions & 4 deletions Parsers/ASimUserManagement/Parsers/ASimUserManagementAWSCloudTrail.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Parser:
Title: User Management ASIM parser for AWS Cloud Trail
Version: '0.1.0'
LastUpdated: Jan 26, 2026
Version: '0.1.1'
LastUpdated: Oct 23, 2026
Product:
Name: AWS Cloud Trail
Normalization:
Expand Down Expand Up @@ -67,7 +67,6 @@ ParserQuery: |
"TagRole", "UserModified",
"TagUser", "UserModified",
"UntagUser", "UserModified",
"UntagUser", "UserModified",
"UpdateGroup", "GroupModified",
"UpdateLoginProfile", "PasswordChanged",
"UpdateRole", "UserModified",
Expand Down Expand Up @@ -272,4 +271,4 @@ ParserQuery: |
IpAddr,
AdditionalFields
};
parser(disabled = disabled, pack = pack);
parser(disabled = disabled, pack = pack)
6 changes: 2 additions & 4 deletions Parsers/ASimUserManagement/Parsers/vimUserManagementAWSCloudTrail.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Parser:
Title: User Management ASIM filtering parser for AWS Cloud Trail
Version: '0.1.0'
LastUpdated: Jan 26, 2026
Version: '0.1.1'
LastUpdated: Oct 23, 2026
Product:
Name: AWS Cloud Trail
Normalization:
Expand Down Expand Up @@ -85,7 +85,6 @@ ParserQuery: |
"TagRole", "UserModified",
"TagUser", "UserModified",
"UntagUser", "UserModified",
"UntagUser", "UserModified",
"UpdateGroup", "GroupModified",
"UpdateLoginProfile", "PasswordChanged",
"UpdateRole", "UserModified",
Expand Down Expand Up @@ -321,4 +320,3 @@ ParserQuery: |
disabled = disabled,
pack = pack
)

Loading