diff --git a/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_Audit_Events_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_Audit_Events_CL.json index 8ff9e4f4239..2943d45b242 100644 --- a/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_Audit_Events_CL.json +++ b/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_Audit_Events_CL.json @@ -440,6 +440,10 @@ { "name": "AdditionalFields", "type": "dynamic" + }, + { + "name": "Type", + "type": "string" } ] } \ No newline at end of file diff --git a/Parsers/ASimAuditEvent/ARM/ASimAuditEvent/ASimAuditEvent.json b/Parsers/ASimAuditEvent/ARM/ASimAuditEvent/ASimAuditEvent.json index 856552c060a..1d849ed46fb 100644 --- a/Parsers/ASimAuditEvent/ARM/ASimAuditEvent/ASimAuditEvent.json +++ b/Parsers/ASimAuditEvent/ARM/ASimAuditEvent/ASimAuditEvent.json @@ -27,7 +27,7 @@ "displayName": "Audit event ASIM parser", "category": "ASIM", "FunctionAlias": "ASimAuditEvent", - "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAuditEvent') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet BuiltInDisabled=toscalar('ExcludeASimAuditEventBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers));\nunion isfuzzy=true\n vimAuditEventEmpty,\n ASimAuditEventMicrosoftExchangeAdmin365 (BuiltInDisabled or ('ExcludeASimAuditEventMicrosoftExchangeAdmin365' in (DisabledParsers))),\n ASimAuditEventMicrosoftWindowsEvents (BuiltInDisabled or ('ExcludeASimAuditEventMicrosoftWindowsEvents' in (DisabledParsers))),\n ASimAuditEventMicrosoftSecurityEvents (BuiltInDisabled or ('ExcludeASimAuditEventMicrosoftSecurityEvents' in (DisabledParsers))),\n ASimAuditEventMicrosoftEvent (BuiltInDisabled or ('ExcludeASimAuditEventMicrosoftEvent' in (DisabledParsers))),\n ASimAuditEventAzureActivity (BuiltInDisabled or ('ExcludeASimAuditEventAzureActivity' in (DisabledParsers))),\n ASimAuditEventCiscoMeraki (BuiltInDisabled or ('ExcludeASimAuditEventCiscoMeraki' in (DisabledParsers))),\n ASimAuditEventCiscoMerakiSyslog (BuiltInDisabled or ('ExcludeASimAuditEventCiscoMerakiSyslog' in (DisabledParsers))),\n ASimAuditEventBarracudaWAF (BuiltInDisabled or ('ExcludeASimAuditEventBarracudaWAF' in (DisabledParsers))),\n ASimAuditEventBarracudaCEF (BuiltInDisabled or ('ExcludeASimAuditEventBarracudaCEF' in (DisabledParsers))),\n ASimAuditEventCiscoISE (BuiltInDisabled or ('ExcludeASimAuditEventCiscoISE' in (DisabledParsers))),\n ASimAuditEventVectraXDRAudit(BuiltInDisabled or ('ExcludeASimAuditEventVectraXDRAudit' in (DisabledParsers))),\n ASimAuditEventSentinelOne (BuiltInDisabled or ('ExcludeASimAuditEventSentinelOne' in (DisabledParsers))),\n ASimAuditEventCrowdStrikeFalconHost(BuiltInDisabled or ('ExcludeASimAuditEventCrowdStrikeFalconHost' in (DisabledParsers))),\n ASimAuditEventVMwareCarbonBlackCloud(BuiltInDisabled or ('ExcludeASimAuditEventVMwareCarbonBlackCloud' in (DisabledParsers))),\n ASimAuditEventInfobloxBloxOne(BuiltInDisabled or ('ExcludeASimAuditEventInfobloxBloxOne' in (DisabledParsers))),\n ASimAuditEventIllumioSaaSCore(BuiltInDisabled or ('ExcludeASimAuditEventIllumioSaaSCore' in (DisabledParsers))),\n ASimAuditEventNative(BuiltInDisabled or ('ExcludeASimAuditEventNative' in (DisabledParsers))),\n ASimAuditEventAWSCloudTrail(BuiltInDisabled or ('ExcludeASimAuditEventAWSCloudTrail' in (DisabledParsers)), pack=pack),\n ASimAuditEventAzureKeyVault(BuiltInDisabled or ('ExcludeASimAuditEventAzureKeyVault' in (DisabledParsers))),\n ASimAuditEventSQLSecurityAudit(BuiltInDisabled or ('ExcludeASimAuditEventSQLSecurityAudit' in (DisabledParsers)), pack=pack),\n ASimAuditEventAlibabaCloudActionTrail(BuiltInDisabled or ('ExcludeASimAuditEventAlibabaCloudActionTrail' in (DisabledParsers)), pack=pack),\n ASimAuditEventOracleOCI(BuiltInDisabled or ('ExcludeASimAuditEventOracleOCI' in (DisabledParsers)), pack=pack),\n ASimAuditEventSalesforceAuditTrail(BuiltInDisabled or ('ExcludeASimAuditEventSalesforceAuditTrail' in (DisabledParsers)), pack=pack)", + "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAuditEvent') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet BuiltInDisabled=toscalar('ExcludeASimAuditEventBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers));\nunion isfuzzy=true\n vimAuditEventEmpty,\n ASimAuditEventMicrosoftExchangeAdmin365 (BuiltInDisabled or ('ExcludeASimAuditEventMicrosoftExchangeAdmin365' in (DisabledParsers))),\n ASimAuditEventMicrosoftWindowsEvents (BuiltInDisabled or ('ExcludeASimAuditEventMicrosoftWindowsEvents' in (DisabledParsers))),\n ASimAuditEventMicrosoftSecurityEvents (BuiltInDisabled or ('ExcludeASimAuditEventMicrosoftSecurityEvents' in (DisabledParsers))),\n ASimAuditEventMicrosoftEvent (BuiltInDisabled or ('ExcludeASimAuditEventMicrosoftEvent' in (DisabledParsers))),\n ASimAuditEventAzureActivity (BuiltInDisabled or ('ExcludeASimAuditEventAzureActivity' in (DisabledParsers))),\n ASimAuditEventCiscoMeraki (BuiltInDisabled or ('ExcludeASimAuditEventCiscoMeraki' in (DisabledParsers))),\n ASimAuditEventCiscoMerakiSyslog (BuiltInDisabled or ('ExcludeASimAuditEventCiscoMerakiSyslog' in (DisabledParsers))),\n ASimAuditEventBarracudaWAF (BuiltInDisabled or ('ExcludeASimAuditEventBarracudaWAF' in (DisabledParsers))),\n ASimAuditEventBarracudaCEF (BuiltInDisabled or ('ExcludeASimAuditEventBarracudaCEF' in (DisabledParsers))),\n ASimAuditEventCiscoISE (BuiltInDisabled or ('ExcludeASimAuditEventCiscoISE' in (DisabledParsers))),\n ASimAuditEventVectraXDRAudit(BuiltInDisabled or ('ExcludeASimAuditEventVectraXDRAudit' in (DisabledParsers))),\n ASimAuditEventSentinelOne (BuiltInDisabled or ('ExcludeASimAuditEventSentinelOne' in (DisabledParsers))),\n ASimAuditEventCrowdStrikeFalconHost(BuiltInDisabled or ('ExcludeASimAuditEventCrowdStrikeFalconHost' in (DisabledParsers))),\n ASimAuditEventCrowdStrikeFalconDataReplicator(disabled=(BuiltInDisabled or ('ExcludeASimAuditEventCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack),\n ASimAuditEventVMwareCarbonBlackCloud(BuiltInDisabled or ('ExcludeASimAuditEventVMwareCarbonBlackCloud' in (DisabledParsers))),\n ASimAuditEventInfobloxBloxOne(BuiltInDisabled or ('ExcludeASimAuditEventInfobloxBloxOne' in (DisabledParsers))),\n ASimAuditEventIllumioSaaSCore(BuiltInDisabled or ('ExcludeASimAuditEventIllumioSaaSCore' in (DisabledParsers))),\n ASimAuditEventNative(BuiltInDisabled or ('ExcludeASimAuditEventNative' in (DisabledParsers))),\n ASimAuditEventAWSCloudTrail(BuiltInDisabled or ('ExcludeASimAuditEventAWSCloudTrail' in (DisabledParsers)), pack=pack),\n ASimAuditEventAzureKeyVault(BuiltInDisabled or ('ExcludeASimAuditEventAzureKeyVault' in (DisabledParsers))),\n ASimAuditEventSQLSecurityAudit(BuiltInDisabled or ('ExcludeASimAuditEventSQLSecurityAudit' in (DisabledParsers)), pack=pack),\n ASimAuditEventAlibabaCloudActionTrail(BuiltInDisabled or ('ExcludeASimAuditEventAlibabaCloudActionTrail' in (DisabledParsers)), pack=pack),\n ASimAuditEventOracleOCI(BuiltInDisabled or ('ExcludeASimAuditEventOracleOCI' in (DisabledParsers)), pack=pack),\n ASimAuditEventSalesforceAuditTrail(BuiltInDisabled or ('ExcludeASimAuditEventSalesforceAuditTrail' in (DisabledParsers)), pack=pack)", "version": 1, "functionParameters": "pack:bool=False" } diff --git a/Parsers/ASimAuditEvent/ARM/ASimAuditEventCrowdStrikeFalconDataReplicator/ASimAuditEventCrowdStrikeFalconDataReplicator.json b/Parsers/ASimAuditEvent/ARM/ASimAuditEventCrowdStrikeFalconDataReplicator/ASimAuditEventCrowdStrikeFalconDataReplicator.json new file mode 100644 index 00000000000..4edcc74cfb7 --- /dev/null +++ b/Parsers/ASimAuditEvent/ARM/ASimAuditEventCrowdStrikeFalconDataReplicator/ASimAuditEventCrowdStrikeFalconDataReplicator.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/ASimAuditEventCrowdStrikeFalconDataReplicator')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "Audit Event ASIM parser for CrowdStrike Falcon Data Replicator", + "category": "ASIM", + "FunctionAlias": "ASimAuditEventCrowdStrikeFalconDataReplicator", + "query": "let EventMap = datatable(event_simpleName:string, EventType:string, ObjectType:string, ObjectCategory:string) [\n \"FirewallDeleteRule\", \"Delete\", \"Policy Rule\", \"FirewallRule\",\n \"FirewallSetRule\", \"Set\", \"Policy Rule\", \"FirewallRule\",\n \"FirewallChangeOption\", \"Set\", \"Configuration Atom\", \"FirewallOption\",\n \"FirewallEnabled\", \"Enable\", \"Configuration Atom\", \"Firewall\",\n \"FirewallDisabled\", \"Disable\", \"Configuration Atom\", \"Firewall\",\n \"ConfigStateUpdate\", \"Set\", \"Configuration Atom\", \"Configuration\",\n \"CriticalEnvironmentVariableChanged\", \"Set\", \"Configuration Atom\", \"EnvironmentVariable\",\n \"HostnameChanged\", \"Set\", \"Configuration Atom\", \"Hostname\",\n \"MemoryScanEnabled\", \"Enable\", \"Configuration Atom\", \"MemoryScan\",\n \"FileVaultStatus\", \"Read\", \"Configuration Atom\", \"FileVault\",\n \"ActiveDirectoryAccountCreated\", \"Create\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountEnabled\", \"Enable\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountDisabled\", \"Disable\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountLocked\", \"Set\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountUnlocked\", \"Set\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountPasswordUpdate\", \"Set\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountDepartmentUpdate\", \"Set\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountNameUpdate\", \"Set\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountOuUpdate\", \"Set\", \"Directory Service Object\", \"Account\",\n \"NetShareAdd\", \"Create\", \"Other\", \"Share\",\n \"NetShareDelete\", \"Delete\", \"Other\", \"Share\",\n \"NetShareSecurityModify\", \"Set\", \"Other\", \"Share\",\n \"EventLogCleared\", \"Clear\", \"Event Log\", \"EventLog\",\n \"VolumeSnapshotCreated\", \"Create\", \"Other\", \"VolumeSnapshot\",\n \"VolumeSnapshotDeleted\", \"Delete\", \"Other\", \"VolumeSnapshot\",\n \"DcUsbDeviceWhitelisted\", \"Set\", \"Policy Rule\", \"UsbDevice\",\n \"DcUsbDeviceDisconnected\", \"Stop\", \"Other\", \"UsbDevice\",\n \"DcBluetoothDeviceConnected\", \"Start\", \"Other\", \"BluetoothDevice\",\n \"DcBluetoothDeviceDisconnected\", \"Stop\", \"Other\", \"BluetoothDevice\",\n \"IOServiceRegister\", \"Create\", \"Service\", \"IOService\",\n \"ProvisioningStarted\", \"Start\", \"Service\", \"Provisioning\",\n \"ProvisioningEnded\", \"Stop\", \"Service\", \"Provisioning\",\n \"ManifestDownloadComplete\", \"Other\", \"Other\", \"ManifestDownload\",\n \"InstallBundleDownloadComplete\", \"Other\", \"Other\", \"InstallBundleDownload\",\n \"InstallServiceDownloadComplete\", \"Other\", \"Other\", \"InstallServiceDownload\",\n \"OsfmDownloadComplete\", \"Other\", \"Other\", \"OsfmDownload\",\n \"LfoUploadStart\", \"Start\", \"Other\", \"Upload\",\n \"FileCreateInfo\", \"Create\", \"Other\", \"File\",\n \"FileDeleteInfo\", \"Delete\", \"Other\", \"File\",\n \"FileRenameInfo\", \"Set\", \"Other\", \"File\",\n \"FileOpenInfo\", \"Read\", \"Other\", \"File\",\n \"SmbClientShareOpenedEtw\", \"Start\", \"Other\", \"SmbShare\",\n \"SmbClientShareClosedEtw\", \"Stop\", \"Other\", \"SmbShare\",\n \"SmbServerShareOpenedEtw\", \"Start\", \"Other\", \"SmbShare\",\n \"IoSessionConnected\", \"Start\", \"Other\", \"IoSession\"\n];\nCrowdStrike_Audit_Events_CL\n| where not(disabled)\n| where isnotempty(event_simpleName)\n| lookup kind=leftouter EventMap on event_simpleName\n| extend EventType=coalesce(EventType, \"Other\"), ObjectType=coalesce(ObjectType, \"Other\"),\n ObjectCategory=coalesce(ObjectCategory, \"Unclassified\")\n| extend _Host=coalesce(ComputerName, tostring(AdditionalFields.ComputerName)),\n _LocalIp=tostring(AdditionalFields.LocalAddressIP4),\n _RemoteIp=coalesce(RemoteAddressIP4, RemoteAddressIP6),\n _EventTime=coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated)\n| extend _Hostname=tostring(split(_Host, \".\")[0]),\n _SrcHostname=tostring(split(coalesce(ClientComputerName, SmbClientName), \".\")[0])\n| extend DvcHostname=iff(_Hostname matches regex @\"^[a-zA-Z0-9-]{1,61}$\", _Hostname, \"\"),\n DvcDomain=iff(_Host contains \".\", substring(_Host, indexof(_Host, \".\")+1), \"\"),\n DvcFQDN=iff(_Host contains \".\", _Host, \"\"),\n DvcIpAddr=coalesce(_LocalIp, aip),\n SrcHostname=iff(_SrcHostname matches regex @\"^[a-zA-Z0-9-]{1,61}$\", _SrcHostname, \"\"),\n SrcFQDN=iff(coalesce(ClientComputerName, SmbClientName) contains \".\", coalesce(ClientComputerName, SmbClientName), \"\"),\n SrcDomain=iff(coalesce(ClientComputerName, SmbClientName) contains \".\", substring(coalesce(ClientComputerName, SmbClientName), indexof(coalesce(ClientComputerName, SmbClientName), \".\")+1), \"\"),\n ActorUsernameType=case(isempty(UserName), \"\", UserName contains \"\\\\\", \"Windows\", UserName contains \"@\", \"UPN\", \"Simple\"),\n DvcOs=case(event_platform == \"Win\", \"Windows\", event_platform == \"Mac\", \"macOS\", event_platform == \"Lin\", \"Linux\", \"\"),\n EventResult=case(Status in~ (\"Success\", \"Succeeded\"), \"Success\", Status in~ (\"Failure\", \"Failed\"), \"Failure\", \"NA\")\n| extend Object=case(\n ObjectCategory == \"FirewallRule\", coalesce(FirewallRule, FirewallRuleId),\n ObjectCategory == \"FirewallOption\", FirewallOption,\n ObjectCategory == \"EnvironmentVariable\", EnvironmentVariableName,\n ObjectCategory == \"Account\", coalesce(SamAccountName, AccountObjectSid, AccountObjectGuid),\n ObjectCategory in (\"Share\", \"SmbShare\"), coalesce(SharePath, ShareName, SmbShareName),\n ObjectCategory == \"File\", coalesce(SourceFileName, TargetFileName),\n ObjectCategory == \"VolumeSnapshot\", coalesce(VolumeSnapshotName, VolumeName),\n ObjectCategory == \"UsbDevice\", coalesce(DeviceInstanceId, DeviceSerialNumber, DeviceProduct),\n ObjectCategory == \"BluetoothDevice\", coalesce(BluetoothDeviceAddress, DeviceInstanceId),\n ObjectCategory == \"IOService\", coalesce(IOServiceName, IOServicePath),\n ObjectCategory == \"Upload\", UploadId,\n ObjectCategory == \"IoSession\", SessionId,\n ObjectCategory == \"Unclassified\", \"\",\n ObjectCategory),\n ObjectId=case(\n ObjectCategory == \"FirewallRule\", FirewallRuleId,\n ObjectCategory == \"Account\", coalesce(AccountObjectGuid, AccountObjectSid),\n ObjectCategory in (\"UsbDevice\", \"BluetoothDevice\"), DeviceInstanceId,\n \"\"),\n NewValue=case(\n event_simpleName == \"FirewallChangeOption\", coalesce(FirewallOptionStringValue, FirewallOptionNumericValue),\n event_simpleName == \"CriticalEnvironmentVariableChanged\", EnvironmentVariableValue,\n event_simpleName == \"ConfigStateUpdate\", ConfigStateData,\n event_simpleName == \"FileRenameInfo\", TargetFileName,\n event_simpleName == \"ActiveDirectoryAccountDepartmentUpdate\", ActiveDirectoryDepartment,\n event_simpleName == \"ActiveDirectoryAccountOuUpdate\", ActiveDirectoryOuDn,\n event_simpleName == \"ActiveDirectoryAccountNameUpdate\", SamAccountName,\n event_simpleName == \"NetShareSecurityModify\", ShareData,\n event_simpleName == \"FileVaultStatus\" and isnotnull(FileVaultIsEnabled), tostring(FileVaultIsEnabled),\n event_simpleName in (\"FirewallEnabled\", \"MemoryScanEnabled\", \"ActiveDirectoryAccountEnabled\"), \"true\",\n event_simpleName in (\"FirewallDisabled\", \"ActiveDirectoryAccountDisabled\"), \"false\",\n event_simpleName == \"HostnameChanged\", _Host,\n \"\")\n| extend _Packed=iff(pack, bag_pack(\n \"timestamp\", timestamp, \"aip\", aip, \"aid\", aid, \"UserName\", UserName, \"event_platform\", event_platform,\n \"ContextTimeStamp\", ContextTimeStamp, \"name\", name, \"ConfigBuild\", ConfigBuild, \"CrowdStrikeId\", CrowdStrikeId,\n \"ConfigStateHash\", ConfigStateHash, \"ContextProcessId\", ContextProcessId, \"ContextThreadId\", ContextThreadId,\n \"BoundingLimitCount\", BoundingLimitCount, \"BoundingLimitDuration\", BoundingLimitDuration, \"Entitlements\", Entitlements,\n \"EffectiveTransmissionClass\", EffectiveTransmissionClass, \"cid\", cid, \"OciContainerId\", OciContainerId,\n \"TreeId\", TreeId, \"VolumeSnapshotName\", VolumeSnapshotName, \"SmbShareName\", SmbShareName, \"ShareName\", ShareName,\n \"UploadId\", UploadId, \"SessionId\", SessionId, \"ComputerName\", ComputerName, \"FirewallRule\", FirewallRule,\n \"FirewallRuleId\", FirewallRuleId, \"FirewallOption\", FirewallOption, \"SourceFileName\", SourceFileName,\n \"TargetFileName\", TargetFileName, \"DeviceVendorId\", DeviceVendorId, \"DeviceProductId\", DeviceProductId,\n \"DeviceSerialNumber\", DeviceSerialNumber, \"BluetoothDeviceAddress\", BluetoothDeviceAddress,\n \"EnvironmentVariableName\", EnvironmentVariableName, \"SamAccountName\", SamAccountName,\n \"FirewallOptionNumericValue\", FirewallOptionNumericValue, \"FirewallOptionStringValue\", FirewallOptionStringValue,\n \"FileVaultIsEnabled\", FileVaultIsEnabled, \"EnvironmentVariableValue\", EnvironmentVariableValue,\n \"ConfigStateData\", ConfigStateData, \"ActiveDirectoryOuDn\", ActiveDirectoryOuDn,\n \"ActiveDirectoryDepartment\", ActiveDirectoryDepartment, \"SHA256HashData\", SHA256HashData, \"CommandLine\", CommandLine,\n \"VolumeName\", VolumeName, \"VolumeDriveLetter\", VolumeDriveLetter, \"TokenType\", TokenType, \"InterfaceGuid\", InterfaceGuid,\n \"RpcClientProcessId\", RpcClientProcessId, \"InterfaceVersion\", InterfaceVersion, \"RpcClientThreadId\", RpcClientThreadId,\n \"AuthenticationId\", AuthenticationId, \"ImageFileName\", ImageFileName, \"RpcOpNum\", RpcOpNum,\n \"RpcNestingLevel\", RpcNestingLevel, \"ClientComputerName\", ClientComputerName, \"DomainName\", DomainName,\n \"RemoteAddressIP6\", RemoteAddressIP6, \"RemoteAddressIP4\", RemoteAddressIP4, \"SmbClientName\", SmbClientName,\n \"AgentLoadFlags\", AgentLoadFlags, \"ProvisioningDuration\", ProvisioningDuration, \"Status\", Status,\n \"ErrorText\", ErrorText, \"CloudErrorCode\", CloudErrorCode, \"SharePath\", SharePath, \"ShareMaxCount\", ShareMaxCount,\n \"ShareRemark\", ShareRemark, \"ShareData\", ShareData, \"IntelTDTEnabled\", IntelTDTEnabled,\n \"FalconServiceState\", FalconServiceState, \"LfoUploadFlags\", LfoUploadFlags, \"AttemptNumber\", AttemptNumber,\n \"Size\", Size, \"Tags\", Tags, \"CloudRequestId\", CloudRequestId, \"LocalSession\", LocalSession,\n \"IOServiceClass\", IOServiceClass, \"IOServicePath\", IOServicePath, \"IOServiceProperties\", IOServiceProperties,\n \"IOServiceName\", IOServiceName, \"Protocol\", Protocol, \"ChannelDiffStatusList\", ChannelDiffStatusList,\n \"AccountDomain\", AccountDomain, \"AccountObjectGuid\", AccountObjectGuid, \"AccountObjectSid\", AccountObjectSid,\n \"TotalCount\", TotalCount, \"ErrorCode\", ErrorCode, \"EventOrigin\", EventOrigin, \"AddressFamily\", AddressFamily,\n \"BluetoothDeviceType\", BluetoothDeviceType, \"DeviceTimeStamp\", DeviceTimeStamp, \"DeviceInstanceId\", DeviceInstanceId,\n \"BluetoothDeviceAddressType\", BluetoothDeviceAddressType, \"DeviceVersion\", DeviceVersion,\n \"DeviceDescriptorSetHash\", DeviceDescriptorSetHash, \"DeviceManufacturer\", DeviceManufacturer,\n \"DeviceProduct\", DeviceProduct, \"DeviceUserSid\", DeviceUserSid, \"DeviceUserAuthenticationId\", DeviceUserAuthenticationId,\n \"FirewallProfile\", FirewallProfile, \"ShareAccess\", ShareAccess, \"DesiredAccess\", DesiredAccess, \"GID\", GID,\n \"UID\", UID, \"UnixMode\", UnixMode, \"OriginalAdditionalFields\", AdditionalFields), dynamic({}))\n| project-rename Operation=event_simpleName, DvcId=aid, DvcScopeId=cid, ActorUsername=UserName,\n ActorSessionId=AuthenticationId, ActingAppId=ContextProcessId, ActingAppName=ImageFileName,\n EventOriginalUid=CrowdStrikeId, EventMessage=ErrorText\n| extend Dvc=coalesce(_Host, DvcId, DvcIpAddr), DvcIdType=iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType=iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcIpAddr=_RemoteIp, SrcDomainType=iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src=coalesce(SrcFQDN, SrcHostname, _RemoteIp),\n ActingAppType=iff(isnotempty(ActingAppId) or isnotempty(ActingAppName), \"Process\", \"\"),\n EventOriginalResultDetails=coalesce(Status, ErrorCode, CloudErrorCode),\n EventStartTime=_EventTime, EventEndTime=_EventTime,\n EventCount=int(1), EventSchema=\"AuditEvent\", EventSchemaVersion=\"1.0.0\",\n EventVendor=\"CrowdStrike\", EventProduct=\"Falcon Data Replicator\", EventSeverity=\"Informational\",\n TargetHostname=DvcHostname, TargetFQDN=DvcFQDN, TargetDomain=DvcDomain,\n TargetDomainType=iff(isnotempty(DvcDomain), \"FQDN\", \"\"), TargetIpAddr=DvcIpAddr,\n TargetDvcId=DvcId, TargetDvcIdType=iff(isnotempty(DvcId), \"Other\", \"\"), TargetDvcOs=DvcOs,\n TargetDvcScopeId=DvcScopeId, OriginalObjectType=ObjectCategory,\n ActorUserEntityKey=\"\", SrcSystemEntityKey=\"\", TargetSystemEntityKey=\"\", DvcEntityKey=\"\",\n ActingApplicationEntityKey=\"\", TargetApplicationEntityKey=\"\",\n ActorUserAdditionalIds=dynamic([]), AdditionalEntities=dynamic([])\n| extend User=ActorUsername, IpAddr=SrcIpAddr, Value=NewValue, Dst=Dvc\n| project TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, EventType, EventResult,\n EventSchema, EventSchemaVersion, EventVendor, EventProduct, EventSeverity,\n EventOriginalUid, EventOriginalResultDetails, EventMessage, Operation,\n Object, ObjectId, ObjectType, OriginalObjectType, NewValue, Value,\n Dvc, DvcId, DvcIdType, DvcScopeId, DvcHostname, DvcFQDN, DvcDomain, DvcDomainType, DvcIpAddr, DvcOs,\n ActorUsername, ActorUsernameType, ActorSessionId, User, ActingAppId, ActingAppName, ActingAppType,\n Src, SrcIpAddr, SrcHostname, SrcFQDN, SrcDomain, SrcDomainType, IpAddr,\n TargetHostname, TargetFQDN, TargetDomain, TargetDomainType, TargetIpAddr,\n TargetDvcId, TargetDvcIdType, TargetDvcOs, TargetDvcScopeId, Dst,\n ActorUserEntityKey, SrcSystemEntityKey, TargetSystemEntityKey, DvcEntityKey,\n ActingApplicationEntityKey, TargetApplicationEntityKey, ActorUserAdditionalIds, AdditionalEntities,\n AdditionalFields=_Packed\n", + "version": 1, + "functionParameters": "disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimAuditEvent/ARM/ASimAuditEventCrowdStrikeFalconDataReplicator/README.md b/Parsers/ASimAuditEvent/ARM/ASimAuditEventCrowdStrikeFalconDataReplicator/README.md new file mode 100644 index 00000000000..ccb9ae0198a --- /dev/null +++ b/Parsers/ASimAuditEvent/ARM/ASimAuditEventCrowdStrikeFalconDataReplicator/README.md @@ -0,0 +1,28 @@ +# CrowdStrike Falcon Data Replicator ASIM AuditEvent Normalization Parser + +ARM template for ASIM AuditEvent schema parser for CrowdStrike Falcon Data Replicator. + +Normalizes CrowdStrike_Audit_Events_CL to the ASIM Audit Event schema, including +configuration, policy, account, file, share, and device audit operations. +Only event_simpleName identifies operations; records with an empty value are excluded. +Unknown event names map to Other. Undocumented numeric enumerations are retained +without guessing their meanings. Missing device or object values remain empty. +Use pack=true to retain original source fields, including currently empty columns. +The source-IP prefix parameter in the filtering parser supports IPv4 prefixes. +This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. + + +The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. + +For more information, see: + +- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) +- [Deploy all of ASIM](https://aka.ms/DeployASIM) +- [ASIM AuditEvent normalization schema reference](https://aka.ms/ASimAuditEventDoc) + +For the changelog, see: +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuditEvent/CHANGELOG/ASimAuditEventCrowdStrikeFalconDataReplicator.md) + +
+ +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuditEvent%2FARM%2FASimAuditEventCrowdStrikeFalconDataReplicator%2FASimAuditEventCrowdStrikeFalconDataReplicator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuditEvent%2FARM%2FASimAuditEventCrowdStrikeFalconDataReplicator%2FASimAuditEventCrowdStrikeFalconDataReplicator.json) diff --git a/Parsers/ASimAuditEvent/ARM/FullDeploymentAuditEvent.json b/Parsers/ASimAuditEvent/ARM/FullDeploymentAuditEvent.json index 07c212d89fe..081261cf780 100644 --- a/Parsers/ASimAuditEvent/ARM/FullDeploymentAuditEvent.json +++ b/Parsers/ASimAuditEvent/ARM/FullDeploymentAuditEvent.json @@ -218,6 +218,26 @@ } } }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "linkedASimAuditEventCrowdStrikeFalconDataReplicator", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuditEvent/ARM/ASimAuditEventCrowdStrikeFalconDataReplicator/ASimAuditEventCrowdStrikeFalconDataReplicator.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "Workspace": { + "value": "[parameters('Workspace')]" + }, + "WorkspaceRegion": { + "value": "[parameters('WorkspaceRegion')]" + } + } + } + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", @@ -698,6 +718,26 @@ } } }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "linkedvimAuditEventCrowdStrikeFalconDataReplicator", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuditEvent/ARM/vimAuditEventCrowdStrikeFalconDataReplicator/vimAuditEventCrowdStrikeFalconDataReplicator.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "Workspace": { + "value": "[parameters('Workspace')]" + }, + "WorkspaceRegion": { + "value": "[parameters('WorkspaceRegion')]" + } + } + } + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", diff --git a/Parsers/ASimAuditEvent/ARM/imAuditEvent/imAuditEvent.json b/Parsers/ASimAuditEvent/ARM/imAuditEvent/imAuditEvent.json index 5c6a06fde1c..18b2956fd5d 100644 --- a/Parsers/ASimAuditEvent/ARM/imAuditEvent/imAuditEvent.json +++ b/Parsers/ASimAuditEvent/ARM/imAuditEvent/imAuditEvent.json @@ -27,7 +27,7 @@ "displayName": "Audit event ASIM filtering parser.", "category": "ASIM", "FunctionAlias": "imAuditEvent", - "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers')\n | where SearchKey in ('Any', 'ExcludevimAuditEvent')\n | extend SourceSpecificParser=column_ifexists('SourceSpecificParser', '')\n | distinct SourceSpecificParser);\nlet BuiltInDisabled=toscalar('ExcludevimAuditEventBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers));\nunion isfuzzy=true\n vimAuditEventEmpty,\n vimAuditEventMicrosoftExchangeAdmin365 (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventMicrosoftExchangeAdmin365' in (DisabledParsers)))),\n vimAuditEventMicrosoftWindowsEvents (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventMicrosoftWindowsEvents' in (DisabledParsers)))),\n vimAuditEventMicrosoftSecurityEvents (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventMicrosoftSecurityEvents' in (DisabledParsers)))),\n vimAuditEventMicrosoftEvent (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventMicrosoftEvent' in (DisabledParsers)))),\n vimAuditEventAzureActivity (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventAzureActivity' in (DisabledParsers)))),\n vimAuditEventCiscoMeraki (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventCiscoMeraki' in (DisabledParsers)))),\n vimAuditEventCiscoMerakiSyslog (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventCiscoMerakiSyslog' in (DisabledParsers)))),\n vimAuditEventBarracudaWAF (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, object_has_any=object_has_any, operation_has_any=operation_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventBarracudaWAF' in (DisabledParsers)))),\n vimAuditEventBarracudaCEF (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, object_has_any=object_has_any, operation_has_any=operation_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventBarracudaCEF' in (DisabledParsers)))),\n vimAuditEventCiscoISE (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventCiscoISE' in (DisabledParsers)))),\n vimAuditEventVectraXDRAudit (starttime=starttime, endtime=endtime, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventVectraXDRAudit' in (DisabledParsers)))),\n vimAuditEventSentinelOne (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventSentinelOne' in (DisabledParsers)))),\n vimAuditEventCrowdStrikeFalconHost(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventCrowdStrikeFalconHost' in (DisabledParsers)))),\n vimAuditEventVMwareCarbonBlackCloud(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventVMwareCarbonBlackCloud' in (DisabledParsers)))),\n vimAuditEventInfbloxBloxOne(starttime=starttime, endtime=endtime, eventresult=eventresult,operation_has_any=operation_has_any, eventtype_in=eventtype_in, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, actorusername_has_any=actorusername_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventInfbloxBloxOne' in (DisabledParsers)))),\n vimAuditEventIllumioSaaSCore(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventIllumioSaaSCore' in (DisabledParsers)))),\n vimAuditEventNative(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventNative' in (DisabledParsers)))),\n vimAuditEventAWSCloudTrail(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventAWSCloudTrail' in (DisabledParsers))), pack=pack),\n vimAuditEventAzureKeyVault(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventAzureKeyVault' in (DisabledParsers)))),\n vimAuditEventSQLSecurityAudit(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventSQLSecurityAudit' in (DisabledParsers))), pack=pack),\n vimAuditEventAlibabaCloudActionTrail(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventAlibabaCloudActionTrail' in (DisabledParsers))), pack=pack),\n vimAuditEventOracleOCI(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventOracleOCI' in (DisabledParsers))), pack=pack),\n vimAuditEventSalesforceAuditTrail(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, eventtype_in=eventtype_in, eventresult=eventresult, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventSalesforceAuditTrail' in (DisabledParsers))), pack=pack)\n", + "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers')\n | where SearchKey in ('Any', 'ExcludevimAuditEvent')\n | extend SourceSpecificParser=column_ifexists('SourceSpecificParser', '')\n | distinct SourceSpecificParser);\nlet BuiltInDisabled=toscalar('ExcludevimAuditEventBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers));\nunion isfuzzy=true\n vimAuditEventEmpty,\n vimAuditEventMicrosoftExchangeAdmin365 (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventMicrosoftExchangeAdmin365' in (DisabledParsers)))),\n vimAuditEventMicrosoftWindowsEvents (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventMicrosoftWindowsEvents' in (DisabledParsers)))),\n vimAuditEventMicrosoftSecurityEvents (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventMicrosoftSecurityEvents' in (DisabledParsers)))),\n vimAuditEventMicrosoftEvent (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventMicrosoftEvent' in (DisabledParsers)))),\n vimAuditEventAzureActivity (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventAzureActivity' in (DisabledParsers)))),\n vimAuditEventCiscoMeraki (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventCiscoMeraki' in (DisabledParsers)))),\n vimAuditEventCiscoMerakiSyslog (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventCiscoMerakiSyslog' in (DisabledParsers)))),\n vimAuditEventBarracudaWAF (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, object_has_any=object_has_any, operation_has_any=operation_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventBarracudaWAF' in (DisabledParsers)))),\n vimAuditEventBarracudaCEF (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, object_has_any=object_has_any, operation_has_any=operation_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventBarracudaCEF' in (DisabledParsers)))),\n vimAuditEventCiscoISE (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventCiscoISE' in (DisabledParsers)))),\n vimAuditEventVectraXDRAudit (starttime=starttime, endtime=endtime, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventVectraXDRAudit' in (DisabledParsers)))),\n vimAuditEventSentinelOne (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventSentinelOne' in (DisabledParsers)))),\n vimAuditEventCrowdStrikeFalconHost(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventCrowdStrikeFalconHost' in (DisabledParsers)))),\n vimAuditEventCrowdStrikeFalconDataReplicator(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack),\n vimAuditEventVMwareCarbonBlackCloud(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventVMwareCarbonBlackCloud' in (DisabledParsers)))),\n vimAuditEventInfbloxBloxOne(starttime=starttime, endtime=endtime, eventresult=eventresult,operation_has_any=operation_has_any, eventtype_in=eventtype_in, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, actorusername_has_any=actorusername_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventInfbloxBloxOne' in (DisabledParsers)))),\n vimAuditEventIllumioSaaSCore(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventIllumioSaaSCore' in (DisabledParsers)))),\n vimAuditEventNative(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventNative' in (DisabledParsers)))),\n vimAuditEventAWSCloudTrail(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventAWSCloudTrail' in (DisabledParsers))), pack=pack),\n vimAuditEventAzureKeyVault(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventAzureKeyVault' in (DisabledParsers)))),\n vimAuditEventSQLSecurityAudit(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventSQLSecurityAudit' in (DisabledParsers))), pack=pack),\n vimAuditEventAlibabaCloudActionTrail(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventAlibabaCloudActionTrail' in (DisabledParsers))), pack=pack),\n vimAuditEventOracleOCI(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventOracleOCI' in (DisabledParsers))), pack=pack),\n vimAuditEventSalesforceAuditTrail(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, eventtype_in=eventtype_in, eventresult=eventresult, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventSalesforceAuditTrail' in (DisabledParsers))), pack=pack)\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr_has_any_prefix:dynamic=dynamic([]),actorusername_has_any:dynamic=dynamic([]),operation_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresult:string='*',object_has_any:dynamic=dynamic([]),newvalue_has_any:dynamic=dynamic([]),pack:bool=False" } diff --git a/Parsers/ASimAuditEvent/ARM/vimAuditEventCrowdStrikeFalconDataReplicator/README.md b/Parsers/ASimAuditEvent/ARM/vimAuditEventCrowdStrikeFalconDataReplicator/README.md new file mode 100644 index 00000000000..376f220e5ac --- /dev/null +++ b/Parsers/ASimAuditEvent/ARM/vimAuditEventCrowdStrikeFalconDataReplicator/README.md @@ -0,0 +1,28 @@ +# CrowdStrike Falcon Data Replicator ASIM AuditEvent Normalization Parser + +ARM template for ASIM AuditEvent schema parser for CrowdStrike Falcon Data Replicator. + +Normalizes CrowdStrike_Audit_Events_CL to the ASIM Audit Event schema, including +configuration, policy, account, file, share, and device audit operations. +Only event_simpleName identifies operations; records with an empty value are excluded. +Unknown event names map to Other. Undocumented numeric enumerations are retained +without guessing their meanings. Missing device or object values remain empty. +Use pack=true to retain original source fields, including currently empty columns. +The source-IP prefix parameter in the filtering parser supports IPv4 prefixes. +This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. + + +The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. + +For more information, see: + +- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) +- [Deploy all of ASIM](https://aka.ms/DeployASIM) +- [ASIM AuditEvent normalization schema reference](https://aka.ms/ASimAuditEventDoc) + +For the changelog, see: +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuditEvent/CHANGELOG/vimAuditEventCrowdStrikeFalconDataReplicator.md) + +
+ +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuditEvent%2FARM%2FvimAuditEventCrowdStrikeFalconDataReplicator%2FvimAuditEventCrowdStrikeFalconDataReplicator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuditEvent%2FARM%2FvimAuditEventCrowdStrikeFalconDataReplicator%2FvimAuditEventCrowdStrikeFalconDataReplicator.json) diff --git a/Parsers/ASimAuditEvent/ARM/vimAuditEventCrowdStrikeFalconDataReplicator/vimAuditEventCrowdStrikeFalconDataReplicator.json b/Parsers/ASimAuditEvent/ARM/vimAuditEventCrowdStrikeFalconDataReplicator/vimAuditEventCrowdStrikeFalconDataReplicator.json new file mode 100644 index 00000000000..42b52d7ff2f --- /dev/null +++ b/Parsers/ASimAuditEvent/ARM/vimAuditEventCrowdStrikeFalconDataReplicator/vimAuditEventCrowdStrikeFalconDataReplicator.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/vimAuditEventCrowdStrikeFalconDataReplicator')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "Audit Event ASIM filtering parser for CrowdStrike Falcon Data Replicator", + "category": "ASIM", + "FunctionAlias": "vimAuditEventCrowdStrikeFalconDataReplicator", + "query": "let EventMap = datatable(event_simpleName:string, EventType:string, ObjectType:string, ObjectCategory:string) [\n \"FirewallDeleteRule\", \"Delete\", \"Policy Rule\", \"FirewallRule\",\n \"FirewallSetRule\", \"Set\", \"Policy Rule\", \"FirewallRule\",\n \"FirewallChangeOption\", \"Set\", \"Configuration Atom\", \"FirewallOption\",\n \"FirewallEnabled\", \"Enable\", \"Configuration Atom\", \"Firewall\",\n \"FirewallDisabled\", \"Disable\", \"Configuration Atom\", \"Firewall\",\n \"ConfigStateUpdate\", \"Set\", \"Configuration Atom\", \"Configuration\",\n \"CriticalEnvironmentVariableChanged\", \"Set\", \"Configuration Atom\", \"EnvironmentVariable\",\n \"HostnameChanged\", \"Set\", \"Configuration Atom\", \"Hostname\",\n \"MemoryScanEnabled\", \"Enable\", \"Configuration Atom\", \"MemoryScan\",\n \"FileVaultStatus\", \"Read\", \"Configuration Atom\", \"FileVault\",\n \"ActiveDirectoryAccountCreated\", \"Create\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountEnabled\", \"Enable\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountDisabled\", \"Disable\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountLocked\", \"Set\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountUnlocked\", \"Set\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountPasswordUpdate\", \"Set\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountDepartmentUpdate\", \"Set\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountNameUpdate\", \"Set\", \"Directory Service Object\", \"Account\",\n \"ActiveDirectoryAccountOuUpdate\", \"Set\", \"Directory Service Object\", \"Account\",\n \"NetShareAdd\", \"Create\", \"Other\", \"Share\",\n \"NetShareDelete\", \"Delete\", \"Other\", \"Share\",\n \"NetShareSecurityModify\", \"Set\", \"Other\", \"Share\",\n \"EventLogCleared\", \"Clear\", \"Event Log\", \"EventLog\",\n \"VolumeSnapshotCreated\", \"Create\", \"Other\", \"VolumeSnapshot\",\n \"VolumeSnapshotDeleted\", \"Delete\", \"Other\", \"VolumeSnapshot\",\n \"DcUsbDeviceWhitelisted\", \"Set\", \"Policy Rule\", \"UsbDevice\",\n \"DcUsbDeviceDisconnected\", \"Stop\", \"Other\", \"UsbDevice\",\n \"DcBluetoothDeviceConnected\", \"Start\", \"Other\", \"BluetoothDevice\",\n \"DcBluetoothDeviceDisconnected\", \"Stop\", \"Other\", \"BluetoothDevice\",\n \"IOServiceRegister\", \"Create\", \"Service\", \"IOService\",\n \"ProvisioningStarted\", \"Start\", \"Service\", \"Provisioning\",\n \"ProvisioningEnded\", \"Stop\", \"Service\", \"Provisioning\",\n \"ManifestDownloadComplete\", \"Other\", \"Other\", \"ManifestDownload\",\n \"InstallBundleDownloadComplete\", \"Other\", \"Other\", \"InstallBundleDownload\",\n \"InstallServiceDownloadComplete\", \"Other\", \"Other\", \"InstallServiceDownload\",\n \"OsfmDownloadComplete\", \"Other\", \"Other\", \"OsfmDownload\",\n \"LfoUploadStart\", \"Start\", \"Other\", \"Upload\",\n \"FileCreateInfo\", \"Create\", \"Other\", \"File\",\n \"FileDeleteInfo\", \"Delete\", \"Other\", \"File\",\n \"FileRenameInfo\", \"Set\", \"Other\", \"File\",\n \"FileOpenInfo\", \"Read\", \"Other\", \"File\",\n \"SmbClientShareOpenedEtw\", \"Start\", \"Other\", \"SmbShare\",\n \"SmbClientShareClosedEtw\", \"Stop\", \"Other\", \"SmbShare\",\n \"SmbServerShareOpenedEtw\", \"Start\", \"Other\", \"SmbShare\",\n \"IoSessionConnected\", \"Start\", \"Other\", \"IoSession\"\n];\nCrowdStrike_Audit_Events_CL\n| where not(disabled)\n| where (isnull(starttime) or TimeGenerated >= starttime) and (isnull(endtime) or TimeGenerated <= endtime)\n| where isnotempty(event_simpleName)\n| where array_length(operation_has_any) == 0 or event_simpleName has_any (operation_has_any)\n| where array_length(actorusername_has_any) == 0 or UserName has_any (actorusername_has_any)\n| where array_length(srcipaddr_has_any_prefix) == 0\n or has_any_ipv4_prefix(coalesce(RemoteAddressIP4, RemoteAddressIP6), srcipaddr_has_any_prefix)\n| lookup kind=leftouter EventMap on event_simpleName\n| extend EventType=coalesce(EventType, \"Other\"), ObjectType=coalesce(ObjectType, \"Other\"),\n ObjectCategory=coalesce(ObjectCategory, \"Unclassified\")\n| where array_length(eventtype_in) == 0 or EventType in (eventtype_in)\n| extend EventResult=case(Status in~ (\"Success\", \"Succeeded\"), \"Success\", Status in~ (\"Failure\", \"Failed\"), \"Failure\", \"NA\")\n| where eventresult in (\"\", \"*\") or EventResult == eventresult\n| extend _Host=coalesce(ComputerName, tostring(AdditionalFields.ComputerName)),\n _LocalIp=tostring(AdditionalFields.LocalAddressIP4),\n _RemoteIp=coalesce(RemoteAddressIP4, RemoteAddressIP6),\n _EventTime=coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated)\n| extend _Hostname=tostring(split(_Host, \".\")[0]),\n _SrcHostname=tostring(split(coalesce(ClientComputerName, SmbClientName), \".\")[0])\n| extend DvcHostname=iff(_Hostname matches regex @\"^[a-zA-Z0-9-]{1,61}$\", _Hostname, \"\"),\n DvcDomain=iff(_Host contains \".\", substring(_Host, indexof(_Host, \".\")+1), \"\"),\n DvcFQDN=iff(_Host contains \".\", _Host, \"\"),\n DvcIpAddr=coalesce(_LocalIp, aip),\n SrcHostname=iff(_SrcHostname matches regex @\"^[a-zA-Z0-9-]{1,61}$\", _SrcHostname, \"\"),\n SrcFQDN=iff(coalesce(ClientComputerName, SmbClientName) contains \".\", coalesce(ClientComputerName, SmbClientName), \"\"),\n SrcDomain=iff(coalesce(ClientComputerName, SmbClientName) contains \".\", substring(coalesce(ClientComputerName, SmbClientName), indexof(coalesce(ClientComputerName, SmbClientName), \".\")+1), \"\"),\n ActorUsernameType=case(isempty(UserName), \"\", UserName contains \"\\\\\", \"Windows\", UserName contains \"@\", \"UPN\", \"Simple\"),\n DvcOs=case(event_platform == \"Win\", \"Windows\", event_platform == \"Mac\", \"macOS\", event_platform == \"Lin\", \"Linux\", \"\")\n| extend Object=case(\n ObjectCategory == \"FirewallRule\", coalesce(FirewallRule, FirewallRuleId),\n ObjectCategory == \"FirewallOption\", FirewallOption,\n ObjectCategory == \"EnvironmentVariable\", EnvironmentVariableName,\n ObjectCategory == \"Account\", coalesce(SamAccountName, AccountObjectSid, AccountObjectGuid),\n ObjectCategory in (\"Share\", \"SmbShare\"), coalesce(SharePath, ShareName, SmbShareName),\n ObjectCategory == \"File\", coalesce(SourceFileName, TargetFileName),\n ObjectCategory == \"VolumeSnapshot\", coalesce(VolumeSnapshotName, VolumeName),\n ObjectCategory == \"UsbDevice\", coalesce(DeviceInstanceId, DeviceSerialNumber, DeviceProduct),\n ObjectCategory == \"BluetoothDevice\", coalesce(BluetoothDeviceAddress, DeviceInstanceId),\n ObjectCategory == \"IOService\", coalesce(IOServiceName, IOServicePath),\n ObjectCategory == \"Upload\", UploadId,\n ObjectCategory == \"IoSession\", SessionId,\n ObjectCategory == \"Unclassified\", \"\",\n ObjectCategory),\n ObjectId=case(\n ObjectCategory == \"FirewallRule\", FirewallRuleId,\n ObjectCategory == \"Account\", coalesce(AccountObjectGuid, AccountObjectSid),\n ObjectCategory in (\"UsbDevice\", \"BluetoothDevice\"), DeviceInstanceId,\n \"\"),\n NewValue=case(\n event_simpleName == \"FirewallChangeOption\", coalesce(FirewallOptionStringValue, FirewallOptionNumericValue),\n event_simpleName == \"CriticalEnvironmentVariableChanged\", EnvironmentVariableValue,\n event_simpleName == \"ConfigStateUpdate\", ConfigStateData,\n event_simpleName == \"FileRenameInfo\", TargetFileName,\n event_simpleName == \"ActiveDirectoryAccountDepartmentUpdate\", ActiveDirectoryDepartment,\n event_simpleName == \"ActiveDirectoryAccountOuUpdate\", ActiveDirectoryOuDn,\n event_simpleName == \"ActiveDirectoryAccountNameUpdate\", SamAccountName,\n event_simpleName == \"NetShareSecurityModify\", ShareData,\n event_simpleName == \"FileVaultStatus\" and isnotnull(FileVaultIsEnabled), tostring(FileVaultIsEnabled),\n event_simpleName in (\"FirewallEnabled\", \"MemoryScanEnabled\", \"ActiveDirectoryAccountEnabled\"), \"true\",\n event_simpleName in (\"FirewallDisabled\", \"ActiveDirectoryAccountDisabled\"), \"false\",\n event_simpleName == \"HostnameChanged\", _Host,\n \"\")\n| where array_length(object_has_any) == 0 or Object has_any (object_has_any)\n| where array_length(newvalue_has_any) == 0 or NewValue has_any (newvalue_has_any)\n| extend _Packed=iff(pack, bag_pack(\n \"timestamp\", timestamp, \"aip\", aip, \"aid\", aid, \"UserName\", UserName, \"event_platform\", event_platform,\n \"ContextTimeStamp\", ContextTimeStamp, \"name\", name, \"ConfigBuild\", ConfigBuild, \"CrowdStrikeId\", CrowdStrikeId,\n \"ConfigStateHash\", ConfigStateHash, \"ContextProcessId\", ContextProcessId, \"ContextThreadId\", ContextThreadId,\n \"BoundingLimitCount\", BoundingLimitCount, \"BoundingLimitDuration\", BoundingLimitDuration, \"Entitlements\", Entitlements,\n \"EffectiveTransmissionClass\", EffectiveTransmissionClass, \"cid\", cid, \"OciContainerId\", OciContainerId,\n \"TreeId\", TreeId, \"VolumeSnapshotName\", VolumeSnapshotName, \"SmbShareName\", SmbShareName, \"ShareName\", ShareName,\n \"UploadId\", UploadId, \"SessionId\", SessionId, \"ComputerName\", ComputerName, \"FirewallRule\", FirewallRule,\n \"FirewallRuleId\", FirewallRuleId, \"FirewallOption\", FirewallOption, \"SourceFileName\", SourceFileName,\n \"TargetFileName\", TargetFileName, \"DeviceVendorId\", DeviceVendorId, \"DeviceProductId\", DeviceProductId,\n \"DeviceSerialNumber\", DeviceSerialNumber, \"BluetoothDeviceAddress\", BluetoothDeviceAddress,\n \"EnvironmentVariableName\", EnvironmentVariableName, \"SamAccountName\", SamAccountName,\n \"FirewallOptionNumericValue\", FirewallOptionNumericValue, \"FirewallOptionStringValue\", FirewallOptionStringValue,\n \"FileVaultIsEnabled\", FileVaultIsEnabled, \"EnvironmentVariableValue\", EnvironmentVariableValue,\n \"ConfigStateData\", ConfigStateData, \"ActiveDirectoryOuDn\", ActiveDirectoryOuDn,\n \"ActiveDirectoryDepartment\", ActiveDirectoryDepartment, \"SHA256HashData\", SHA256HashData, \"CommandLine\", CommandLine,\n \"VolumeName\", VolumeName, \"VolumeDriveLetter\", VolumeDriveLetter, \"TokenType\", TokenType, \"InterfaceGuid\", InterfaceGuid,\n \"RpcClientProcessId\", RpcClientProcessId, \"InterfaceVersion\", InterfaceVersion, \"RpcClientThreadId\", RpcClientThreadId,\n \"AuthenticationId\", AuthenticationId, \"ImageFileName\", ImageFileName, \"RpcOpNum\", RpcOpNum,\n \"RpcNestingLevel\", RpcNestingLevel, \"ClientComputerName\", ClientComputerName, \"DomainName\", DomainName,\n \"RemoteAddressIP6\", RemoteAddressIP6, \"RemoteAddressIP4\", RemoteAddressIP4, \"SmbClientName\", SmbClientName,\n \"AgentLoadFlags\", AgentLoadFlags, \"ProvisioningDuration\", ProvisioningDuration, \"Status\", Status,\n \"ErrorText\", ErrorText, \"CloudErrorCode\", CloudErrorCode, \"SharePath\", SharePath, \"ShareMaxCount\", ShareMaxCount,\n \"ShareRemark\", ShareRemark, \"ShareData\", ShareData, \"IntelTDTEnabled\", IntelTDTEnabled,\n \"FalconServiceState\", FalconServiceState, \"LfoUploadFlags\", LfoUploadFlags, \"AttemptNumber\", AttemptNumber,\n \"Size\", Size, \"Tags\", Tags, \"CloudRequestId\", CloudRequestId, \"LocalSession\", LocalSession,\n \"IOServiceClass\", IOServiceClass, \"IOServicePath\", IOServicePath, \"IOServiceProperties\", IOServiceProperties,\n \"IOServiceName\", IOServiceName, \"Protocol\", Protocol, \"ChannelDiffStatusList\", ChannelDiffStatusList,\n \"AccountDomain\", AccountDomain, \"AccountObjectGuid\", AccountObjectGuid, \"AccountObjectSid\", AccountObjectSid,\n \"TotalCount\", TotalCount, \"ErrorCode\", ErrorCode, \"EventOrigin\", EventOrigin, \"AddressFamily\", AddressFamily,\n \"BluetoothDeviceType\", BluetoothDeviceType, \"DeviceTimeStamp\", DeviceTimeStamp, \"DeviceInstanceId\", DeviceInstanceId,\n \"BluetoothDeviceAddressType\", BluetoothDeviceAddressType, \"DeviceVersion\", DeviceVersion,\n \"DeviceDescriptorSetHash\", DeviceDescriptorSetHash, \"DeviceManufacturer\", DeviceManufacturer,\n \"DeviceProduct\", DeviceProduct, \"DeviceUserSid\", DeviceUserSid, \"DeviceUserAuthenticationId\", DeviceUserAuthenticationId,\n \"FirewallProfile\", FirewallProfile, \"ShareAccess\", ShareAccess, \"DesiredAccess\", DesiredAccess, \"GID\", GID,\n \"UID\", UID, \"UnixMode\", UnixMode, \"OriginalAdditionalFields\", AdditionalFields), dynamic({}))\n| project-rename Operation=event_simpleName, DvcId=aid, DvcScopeId=cid, ActorUsername=UserName,\n ActorSessionId=AuthenticationId, ActingAppId=ContextProcessId, ActingAppName=ImageFileName,\n EventOriginalUid=CrowdStrikeId, EventMessage=ErrorText\n| extend Dvc=coalesce(_Host, DvcId, DvcIpAddr), DvcIdType=iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType=iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcIpAddr=_RemoteIp, SrcDomainType=iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src=coalesce(SrcFQDN, SrcHostname, _RemoteIp),\n ActingAppType=iff(isnotempty(ActingAppId) or isnotempty(ActingAppName), \"Process\", \"\"),\n EventOriginalResultDetails=coalesce(Status, ErrorCode, CloudErrorCode),\n EventStartTime=_EventTime, EventEndTime=_EventTime,\n EventCount=int(1), EventSchema=\"AuditEvent\", EventSchemaVersion=\"1.0.0\",\n EventVendor=\"CrowdStrike\", EventProduct=\"Falcon Data Replicator\", EventSeverity=\"Informational\",\n TargetHostname=DvcHostname, TargetFQDN=DvcFQDN, TargetDomain=DvcDomain,\n TargetDomainType=iff(isnotempty(DvcDomain), \"FQDN\", \"\"), TargetIpAddr=DvcIpAddr,\n TargetDvcId=DvcId, TargetDvcIdType=iff(isnotempty(DvcId), \"Other\", \"\"), TargetDvcOs=DvcOs,\n TargetDvcScopeId=DvcScopeId, OriginalObjectType=ObjectCategory,\n ActorUserEntityKey=\"\", SrcSystemEntityKey=\"\", TargetSystemEntityKey=\"\", DvcEntityKey=\"\",\n ActingApplicationEntityKey=\"\", TargetApplicationEntityKey=\"\",\n ActorUserAdditionalIds=dynamic([]), AdditionalEntities=dynamic([])\n| extend User=ActorUsername, IpAddr=SrcIpAddr, Value=NewValue, Dst=Dvc\n| project TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, EventType, EventResult,\n EventSchema, EventSchemaVersion, EventVendor, EventProduct, EventSeverity,\n EventOriginalUid, EventOriginalResultDetails, EventMessage, Operation,\n Object, ObjectId, ObjectType, OriginalObjectType, NewValue, Value,\n Dvc, DvcId, DvcIdType, DvcScopeId, DvcHostname, DvcFQDN, DvcDomain, DvcDomainType, DvcIpAddr, DvcOs,\n ActorUsername, ActorUsernameType, ActorSessionId, User, ActingAppId, ActingAppName, ActingAppType,\n Src, SrcIpAddr, SrcHostname, SrcFQDN, SrcDomain, SrcDomainType, IpAddr,\n TargetHostname, TargetFQDN, TargetDomain, TargetDomainType, TargetIpAddr,\n TargetDvcId, TargetDvcIdType, TargetDvcOs, TargetDvcScopeId, Dst,\n ActorUserEntityKey, SrcSystemEntityKey, TargetSystemEntityKey, DvcEntityKey,\n ActingApplicationEntityKey, TargetApplicationEntityKey, ActorUserAdditionalIds, AdditionalEntities,\n AdditionalFields=_Packed\n", + "version": 1, + "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr_has_any_prefix:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresult:string='*',actorusername_has_any:dynamic=dynamic([]),operation_has_any:dynamic=dynamic([]),object_has_any:dynamic=dynamic([]),newvalue_has_any:dynamic=dynamic([]),disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimAuditEvent/CHANGELOG/ASimAuditEvent.md b/Parsers/ASimAuditEvent/CHANGELOG/ASimAuditEvent.md index b17f08b50bc..afcf56c7661 100644 --- a/Parsers/ASimAuditEvent/CHANGELOG/ASimAuditEvent.md +++ b/Parsers/ASimAuditEvent/CHANGELOG/ASimAuditEvent.md @@ -1,5 +1,10 @@ # Changelog for ASimAuditEvent.yaml +## Version 0.1.13 + +- (2026-10-23) Add the CrowdStrike Falcon Data Replicator AuditEvent parser - [PR #15414](https://github.com/Azure/Azure-Sentinel/pull/15414) +- Forward pack and honor its source-specific disable watchlist key. + ## Version 0.1.12 - (2026-10-08) Corrected the Microsoft Event parser disable watchlist key - [PR #15291](https://github.com/Azure/Azure-Sentinel/pull/15291) diff --git a/Parsers/ASimAuditEvent/CHANGELOG/ASimAuditEventCrowdStrikeFalconDataReplicator.md b/Parsers/ASimAuditEvent/CHANGELOG/ASimAuditEventCrowdStrikeFalconDataReplicator.md new file mode 100644 index 00000000000..5240b3c048c --- /dev/null +++ b/Parsers/ASimAuditEvent/CHANGELOG/ASimAuditEventCrowdStrikeFalconDataReplicator.md @@ -0,0 +1,10 @@ +# Changelog for ASimAuditEventCrowdStrikeFalconDataReplicator.yaml + +## Version 0.1.0 + +- (2026-10-23) Initial creation of the CrowdStrike Falcon Data Replicator AuditEvent parser - [PR #15414](https://github.com/Azure/Azure-Sentinel/pull/15414) +- Normalize 45 source event names using event_simpleName only; do not use the versioned name as a fallback. +- Account for all 113 source columns, including currently empty columns; retain original fields with pack=true. +- Preserve unknown numeric enumerations without inventing meanings and leave unavailable device and object values empty. +- Use an explicit output projection and preserve one output record per accepted input record. +- Tolerate absent ingestion metadata columns while retaining the declared source table in Type. diff --git a/Parsers/ASimAuditEvent/CHANGELOG/imAuditEvent.md b/Parsers/ASimAuditEvent/CHANGELOG/imAuditEvent.md index e523f6c70ff..8774627ba03 100644 --- a/Parsers/ASimAuditEvent/CHANGELOG/imAuditEvent.md +++ b/Parsers/ASimAuditEvent/CHANGELOG/imAuditEvent.md @@ -1,5 +1,10 @@ # Changelog for imAuditEvent.yaml +## Version 0.1.13 + +- (2026-10-23) Add the CrowdStrike Falcon Data Replicator AuditEvent filtering parser - [PR #15414](https://github.com/Azure/Azure-Sentinel/pull/15414) +- Forward all AuditEvent filters and pack; honor its source-specific disable watchlist key. + ## Version 0.1.12 - (2026-10-10) Forward actorusername_has_any and object_has_any to both Barracuda AuditEvent filtering parsers. - [PR #15298](https://github.com/Azure/Azure-Sentinel/pull/15298) diff --git a/Parsers/ASimAuditEvent/CHANGELOG/vimAuditEventCrowdStrikeFalconDataReplicator.md b/Parsers/ASimAuditEvent/CHANGELOG/vimAuditEventCrowdStrikeFalconDataReplicator.md new file mode 100644 index 00000000000..227dba9c061 --- /dev/null +++ b/Parsers/ASimAuditEvent/CHANGELOG/vimAuditEventCrowdStrikeFalconDataReplicator.md @@ -0,0 +1,9 @@ +# Changelog for vimAuditEventCrowdStrikeFalconDataReplicator.yaml + +## Version 0.1.0 + +- (2026-10-23) Initial creation of the CrowdStrike Falcon Data Replicator AuditEvent filtering parser - [PR #15414](https://github.com/Azure/Azure-Sentinel/pull/15414) +- Add TimeGenerated bounds, IPv4 source-address prefixes, event type and result, actor, operation, object, and new-value filters. +- Preserve parameterless normalization and support disabled and pack controls. +- Apply source-column filters before parsing and object/new-value filters before optional packing. +- Tolerate absent ingestion metadata columns while retaining the declared source table in Type. diff --git a/Parsers/ASimAuditEvent/Parsers/ASimAuditEvent.yaml b/Parsers/ASimAuditEvent/Parsers/ASimAuditEvent.yaml index b503194dac5..d43d7168a72 100644 --- a/Parsers/ASimAuditEvent/Parsers/ASimAuditEvent.yaml +++ b/Parsers/ASimAuditEvent/Parsers/ASimAuditEvent.yaml @@ -1,7 +1,7 @@ Parser: Title: Audit event ASIM parser - Version: '0.1.12' - LastUpdated: Oct 08, 2026 + Version: '0.1.13' + LastUpdated: Oct 23, 2026 Product: Name: Source agnostic Normalization: @@ -31,6 +31,7 @@ Parsers: - _ASim_AuditEvent_BarracudaWAF - _ASim_AuditEvent_BarracudaCEF - _ASim_AuditEvent_CrowdStrikeFalconHost + - _ASim_AuditEvent_CrowdStrikeFalconDataReplicator - _ASim_AuditEvent_VectraXDRAudit - _ASim_AuditEvent_SentinelOne - _ASim_AuditEvent_VMwareCarbonBlackCloud @@ -63,6 +64,7 @@ ParserQuery: | ASimAuditEventVectraXDRAudit(BuiltInDisabled or ('ExcludeASimAuditEventVectraXDRAudit' in (DisabledParsers))), ASimAuditEventSentinelOne (BuiltInDisabled or ('ExcludeASimAuditEventSentinelOne' in (DisabledParsers))), ASimAuditEventCrowdStrikeFalconHost(BuiltInDisabled or ('ExcludeASimAuditEventCrowdStrikeFalconHost' in (DisabledParsers))), + ASimAuditEventCrowdStrikeFalconDataReplicator(disabled=(BuiltInDisabled or ('ExcludeASimAuditEventCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack), ASimAuditEventVMwareCarbonBlackCloud(BuiltInDisabled or ('ExcludeASimAuditEventVMwareCarbonBlackCloud' in (DisabledParsers))), ASimAuditEventInfobloxBloxOne(BuiltInDisabled or ('ExcludeASimAuditEventInfobloxBloxOne' in (DisabledParsers))), ASimAuditEventIllumioSaaSCore(BuiltInDisabled or ('ExcludeASimAuditEventIllumioSaaSCore' in (DisabledParsers))), diff --git a/Parsers/ASimAuditEvent/Parsers/ASimAuditEventCrowdStrikeFalconDataReplicator.yaml b/Parsers/ASimAuditEvent/Parsers/ASimAuditEventCrowdStrikeFalconDataReplicator.yaml new file mode 100644 index 00000000000..38a167df9c5 --- /dev/null +++ b/Parsers/ASimAuditEvent/Parsers/ASimAuditEventCrowdStrikeFalconDataReplicator.yaml @@ -0,0 +1,206 @@ +Parser: + Title: Audit Event ASIM parser for CrowdStrike Falcon Data Replicator + Version: '0.1.0' + LastUpdated: Oct 23, 2026 +Product: + Name: CrowdStrike Falcon Data Replicator +Normalization: + Schema: AuditEvent + Version: '1.0.0' +References: +- Title: ASIM Audit Event Schema + Link: https://aka.ms/ASimAuditEventDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: CrowdStrike Falcon Data Replicator connector documentation + Link: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/CrowdStrikeS3FDR_ccp/DataConnectorDefinition.json +Description: | + Normalizes CrowdStrike_Audit_Events_CL to the ASIM Audit Event schema, including + configuration, policy, account, file, share, and device audit operations. + Only event_simpleName identifies operations; records with an empty value are excluded. + Unknown event names map to Other. Undocumented numeric enumerations are retained + without guessing their meanings. Missing device or object values remain empty. + Use pack=true to retain original source fields, including currently empty columns. + The source-IP prefix parameter in the filtering parser supports IPv4 prefixes. + This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. +ParserName: ASimAuditEventCrowdStrikeFalconDataReplicator +EquivalentBuiltInParser: _ASim_AuditEvent_CrowdStrikeFalconDataReplicator +ParserParams: + - Name: disabled + Type: bool + Default: false + - Name: pack + Type: bool + Default: false +ParserQuery: | + let EventMap = datatable(event_simpleName:string, EventType:string, ObjectType:string, ObjectCategory:string) [ + "FirewallDeleteRule", "Delete", "Policy Rule", "FirewallRule", + "FirewallSetRule", "Set", "Policy Rule", "FirewallRule", + "FirewallChangeOption", "Set", "Configuration Atom", "FirewallOption", + "FirewallEnabled", "Enable", "Configuration Atom", "Firewall", + "FirewallDisabled", "Disable", "Configuration Atom", "Firewall", + "ConfigStateUpdate", "Set", "Configuration Atom", "Configuration", + "CriticalEnvironmentVariableChanged", "Set", "Configuration Atom", "EnvironmentVariable", + "HostnameChanged", "Set", "Configuration Atom", "Hostname", + "MemoryScanEnabled", "Enable", "Configuration Atom", "MemoryScan", + "FileVaultStatus", "Read", "Configuration Atom", "FileVault", + "ActiveDirectoryAccountCreated", "Create", "Directory Service Object", "Account", + "ActiveDirectoryAccountEnabled", "Enable", "Directory Service Object", "Account", + "ActiveDirectoryAccountDisabled", "Disable", "Directory Service Object", "Account", + "ActiveDirectoryAccountLocked", "Set", "Directory Service Object", "Account", + "ActiveDirectoryAccountUnlocked", "Set", "Directory Service Object", "Account", + "ActiveDirectoryAccountPasswordUpdate", "Set", "Directory Service Object", "Account", + "ActiveDirectoryAccountDepartmentUpdate", "Set", "Directory Service Object", "Account", + "ActiveDirectoryAccountNameUpdate", "Set", "Directory Service Object", "Account", + "ActiveDirectoryAccountOuUpdate", "Set", "Directory Service Object", "Account", + "NetShareAdd", "Create", "Other", "Share", + "NetShareDelete", "Delete", "Other", "Share", + "NetShareSecurityModify", "Set", "Other", "Share", + "EventLogCleared", "Clear", "Event Log", "EventLog", + "VolumeSnapshotCreated", "Create", "Other", "VolumeSnapshot", + "VolumeSnapshotDeleted", "Delete", "Other", "VolumeSnapshot", + "DcUsbDeviceWhitelisted", "Set", "Policy Rule", "UsbDevice", + "DcUsbDeviceDisconnected", "Stop", "Other", "UsbDevice", + "DcBluetoothDeviceConnected", "Start", "Other", "BluetoothDevice", + "DcBluetoothDeviceDisconnected", "Stop", "Other", "BluetoothDevice", + "IOServiceRegister", "Create", "Service", "IOService", + "ProvisioningStarted", "Start", "Service", "Provisioning", + "ProvisioningEnded", "Stop", "Service", "Provisioning", + "ManifestDownloadComplete", "Other", "Other", "ManifestDownload", + "InstallBundleDownloadComplete", "Other", "Other", "InstallBundleDownload", + "InstallServiceDownloadComplete", "Other", "Other", "InstallServiceDownload", + "OsfmDownloadComplete", "Other", "Other", "OsfmDownload", + "LfoUploadStart", "Start", "Other", "Upload", + "FileCreateInfo", "Create", "Other", "File", + "FileDeleteInfo", "Delete", "Other", "File", + "FileRenameInfo", "Set", "Other", "File", + "FileOpenInfo", "Read", "Other", "File", + "SmbClientShareOpenedEtw", "Start", "Other", "SmbShare", + "SmbClientShareClosedEtw", "Stop", "Other", "SmbShare", + "SmbServerShareOpenedEtw", "Start", "Other", "SmbShare", + "IoSessionConnected", "Start", "Other", "IoSession" + ]; + CrowdStrike_Audit_Events_CL + | where not(disabled) + | where isnotempty(event_simpleName) + | lookup kind=leftouter EventMap on event_simpleName + | extend EventType=coalesce(EventType, "Other"), ObjectType=coalesce(ObjectType, "Other"), + ObjectCategory=coalesce(ObjectCategory, "Unclassified") + | extend _Host=coalesce(ComputerName, tostring(AdditionalFields.ComputerName)), + _LocalIp=tostring(AdditionalFields.LocalAddressIP4), + _RemoteIp=coalesce(RemoteAddressIP4, RemoteAddressIP6), + _EventTime=coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated) + | extend _Hostname=tostring(split(_Host, ".")[0]), + _SrcHostname=tostring(split(coalesce(ClientComputerName, SmbClientName), ".")[0]) + | extend DvcHostname=iff(_Hostname matches regex @"^[a-zA-Z0-9-]{1,61}$", _Hostname, ""), + DvcDomain=iff(_Host contains ".", substring(_Host, indexof(_Host, ".")+1), ""), + DvcFQDN=iff(_Host contains ".", _Host, ""), + DvcIpAddr=coalesce(_LocalIp, aip), + SrcHostname=iff(_SrcHostname matches regex @"^[a-zA-Z0-9-]{1,61}$", _SrcHostname, ""), + SrcFQDN=iff(coalesce(ClientComputerName, SmbClientName) contains ".", coalesce(ClientComputerName, SmbClientName), ""), + SrcDomain=iff(coalesce(ClientComputerName, SmbClientName) contains ".", substring(coalesce(ClientComputerName, SmbClientName), indexof(coalesce(ClientComputerName, SmbClientName), ".")+1), ""), + ActorUsernameType=case(isempty(UserName), "", UserName contains "\\", "Windows", UserName contains "@", "UPN", "Simple"), + DvcOs=case(event_platform == "Win", "Windows", event_platform == "Mac", "macOS", event_platform == "Lin", "Linux", ""), + EventResult=case(Status in~ ("Success", "Succeeded"), "Success", Status in~ ("Failure", "Failed"), "Failure", "NA") + | extend Object=case( + ObjectCategory == "FirewallRule", coalesce(FirewallRule, FirewallRuleId), + ObjectCategory == "FirewallOption", FirewallOption, + ObjectCategory == "EnvironmentVariable", EnvironmentVariableName, + ObjectCategory == "Account", coalesce(SamAccountName, AccountObjectSid, AccountObjectGuid), + ObjectCategory in ("Share", "SmbShare"), coalesce(SharePath, ShareName, SmbShareName), + ObjectCategory == "File", coalesce(SourceFileName, TargetFileName), + ObjectCategory == "VolumeSnapshot", coalesce(VolumeSnapshotName, VolumeName), + ObjectCategory == "UsbDevice", coalesce(DeviceInstanceId, DeviceSerialNumber, DeviceProduct), + ObjectCategory == "BluetoothDevice", coalesce(BluetoothDeviceAddress, DeviceInstanceId), + ObjectCategory == "IOService", coalesce(IOServiceName, IOServicePath), + ObjectCategory == "Upload", UploadId, + ObjectCategory == "IoSession", SessionId, + ObjectCategory == "Unclassified", "", + ObjectCategory), + ObjectId=case( + ObjectCategory == "FirewallRule", FirewallRuleId, + ObjectCategory == "Account", coalesce(AccountObjectGuid, AccountObjectSid), + ObjectCategory in ("UsbDevice", "BluetoothDevice"), DeviceInstanceId, + ""), + NewValue=case( + event_simpleName == "FirewallChangeOption", coalesce(FirewallOptionStringValue, FirewallOptionNumericValue), + event_simpleName == "CriticalEnvironmentVariableChanged", EnvironmentVariableValue, + event_simpleName == "ConfigStateUpdate", ConfigStateData, + event_simpleName == "FileRenameInfo", TargetFileName, + event_simpleName == "ActiveDirectoryAccountDepartmentUpdate", ActiveDirectoryDepartment, + event_simpleName == "ActiveDirectoryAccountOuUpdate", ActiveDirectoryOuDn, + event_simpleName == "ActiveDirectoryAccountNameUpdate", SamAccountName, + event_simpleName == "NetShareSecurityModify", ShareData, + event_simpleName == "FileVaultStatus" and isnotnull(FileVaultIsEnabled), tostring(FileVaultIsEnabled), + event_simpleName in ("FirewallEnabled", "MemoryScanEnabled", "ActiveDirectoryAccountEnabled"), "true", + event_simpleName in ("FirewallDisabled", "ActiveDirectoryAccountDisabled"), "false", + event_simpleName == "HostnameChanged", _Host, + "") + | extend _Packed=iff(pack, bag_pack( + "timestamp", timestamp, "aip", aip, "aid", aid, "UserName", UserName, "event_platform", event_platform, + "ContextTimeStamp", ContextTimeStamp, "name", name, "ConfigBuild", ConfigBuild, "CrowdStrikeId", CrowdStrikeId, + "ConfigStateHash", ConfigStateHash, "ContextProcessId", ContextProcessId, "ContextThreadId", ContextThreadId, + "BoundingLimitCount", BoundingLimitCount, "BoundingLimitDuration", BoundingLimitDuration, "Entitlements", Entitlements, + "EffectiveTransmissionClass", EffectiveTransmissionClass, "cid", cid, "OciContainerId", OciContainerId, + "TreeId", TreeId, "VolumeSnapshotName", VolumeSnapshotName, "SmbShareName", SmbShareName, "ShareName", ShareName, + "UploadId", UploadId, "SessionId", SessionId, "ComputerName", ComputerName, "FirewallRule", FirewallRule, + "FirewallRuleId", FirewallRuleId, "FirewallOption", FirewallOption, "SourceFileName", SourceFileName, + "TargetFileName", TargetFileName, "DeviceVendorId", DeviceVendorId, "DeviceProductId", DeviceProductId, + "DeviceSerialNumber", DeviceSerialNumber, "BluetoothDeviceAddress", BluetoothDeviceAddress, + "EnvironmentVariableName", EnvironmentVariableName, "SamAccountName", SamAccountName, + "FirewallOptionNumericValue", FirewallOptionNumericValue, "FirewallOptionStringValue", FirewallOptionStringValue, + "FileVaultIsEnabled", FileVaultIsEnabled, "EnvironmentVariableValue", EnvironmentVariableValue, + "ConfigStateData", ConfigStateData, "ActiveDirectoryOuDn", ActiveDirectoryOuDn, + "ActiveDirectoryDepartment", ActiveDirectoryDepartment, "SHA256HashData", SHA256HashData, "CommandLine", CommandLine, + "VolumeName", VolumeName, "VolumeDriveLetter", VolumeDriveLetter, "TokenType", TokenType, "InterfaceGuid", InterfaceGuid, + "RpcClientProcessId", RpcClientProcessId, "InterfaceVersion", InterfaceVersion, "RpcClientThreadId", RpcClientThreadId, + "AuthenticationId", AuthenticationId, "ImageFileName", ImageFileName, "RpcOpNum", RpcOpNum, + "RpcNestingLevel", RpcNestingLevel, "ClientComputerName", ClientComputerName, "DomainName", DomainName, + "RemoteAddressIP6", RemoteAddressIP6, "RemoteAddressIP4", RemoteAddressIP4, "SmbClientName", SmbClientName, + "AgentLoadFlags", AgentLoadFlags, "ProvisioningDuration", ProvisioningDuration, "Status", Status, + "ErrorText", ErrorText, "CloudErrorCode", CloudErrorCode, "SharePath", SharePath, "ShareMaxCount", ShareMaxCount, + "ShareRemark", ShareRemark, "ShareData", ShareData, "IntelTDTEnabled", IntelTDTEnabled, + "FalconServiceState", FalconServiceState, "LfoUploadFlags", LfoUploadFlags, "AttemptNumber", AttemptNumber, + "Size", Size, "Tags", Tags, "CloudRequestId", CloudRequestId, "LocalSession", LocalSession, + "IOServiceClass", IOServiceClass, "IOServicePath", IOServicePath, "IOServiceProperties", IOServiceProperties, + "IOServiceName", IOServiceName, "Protocol", Protocol, "ChannelDiffStatusList", ChannelDiffStatusList, + "AccountDomain", AccountDomain, "AccountObjectGuid", AccountObjectGuid, "AccountObjectSid", AccountObjectSid, + "TotalCount", TotalCount, "ErrorCode", ErrorCode, "EventOrigin", EventOrigin, "AddressFamily", AddressFamily, + "BluetoothDeviceType", BluetoothDeviceType, "DeviceTimeStamp", DeviceTimeStamp, "DeviceInstanceId", DeviceInstanceId, + "BluetoothDeviceAddressType", BluetoothDeviceAddressType, "DeviceVersion", DeviceVersion, + "DeviceDescriptorSetHash", DeviceDescriptorSetHash, "DeviceManufacturer", DeviceManufacturer, + "DeviceProduct", DeviceProduct, "DeviceUserSid", DeviceUserSid, "DeviceUserAuthenticationId", DeviceUserAuthenticationId, + "FirewallProfile", FirewallProfile, "ShareAccess", ShareAccess, "DesiredAccess", DesiredAccess, "GID", GID, + "UID", UID, "UnixMode", UnixMode, "OriginalAdditionalFields", AdditionalFields), dynamic({})) + | project-rename Operation=event_simpleName, DvcId=aid, DvcScopeId=cid, ActorUsername=UserName, + ActorSessionId=AuthenticationId, ActingAppId=ContextProcessId, ActingAppName=ImageFileName, + EventOriginalUid=CrowdStrikeId, EventMessage=ErrorText + | extend Dvc=coalesce(_Host, DvcId, DvcIpAddr), DvcIdType=iff(isnotempty(DvcId), "Other", ""), + DvcDomainType=iff(isnotempty(DvcDomain), "FQDN", ""), + SrcIpAddr=_RemoteIp, SrcDomainType=iff(isnotempty(SrcDomain), "FQDN", ""), + Src=coalesce(SrcFQDN, SrcHostname, _RemoteIp), + ActingAppType=iff(isnotempty(ActingAppId) or isnotempty(ActingAppName), "Process", ""), + EventOriginalResultDetails=coalesce(Status, ErrorCode, CloudErrorCode), + EventStartTime=_EventTime, EventEndTime=_EventTime, + EventCount=int(1), EventSchema="AuditEvent", EventSchemaVersion="1.0.0", + EventVendor="CrowdStrike", EventProduct="Falcon Data Replicator", EventSeverity="Informational", + TargetHostname=DvcHostname, TargetFQDN=DvcFQDN, TargetDomain=DvcDomain, + TargetDomainType=iff(isnotempty(DvcDomain), "FQDN", ""), TargetIpAddr=DvcIpAddr, + TargetDvcId=DvcId, TargetDvcIdType=iff(isnotempty(DvcId), "Other", ""), TargetDvcOs=DvcOs, + TargetDvcScopeId=DvcScopeId, OriginalObjectType=ObjectCategory, + ActorUserEntityKey="", SrcSystemEntityKey="", TargetSystemEntityKey="", DvcEntityKey="", + ActingApplicationEntityKey="", TargetApplicationEntityKey="", + ActorUserAdditionalIds=dynamic([]), AdditionalEntities=dynamic([]) + | extend User=ActorUsername, IpAddr=SrcIpAddr, Value=NewValue, Dst=Dvc + | project TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, EventType, EventResult, + EventSchema, EventSchemaVersion, EventVendor, EventProduct, EventSeverity, + EventOriginalUid, EventOriginalResultDetails, EventMessage, Operation, + Object, ObjectId, ObjectType, OriginalObjectType, NewValue, Value, + Dvc, DvcId, DvcIdType, DvcScopeId, DvcHostname, DvcFQDN, DvcDomain, DvcDomainType, DvcIpAddr, DvcOs, + ActorUsername, ActorUsernameType, ActorSessionId, User, ActingAppId, ActingAppName, ActingAppType, + Src, SrcIpAddr, SrcHostname, SrcFQDN, SrcDomain, SrcDomainType, IpAddr, + TargetHostname, TargetFQDN, TargetDomain, TargetDomainType, TargetIpAddr, + TargetDvcId, TargetDvcIdType, TargetDvcOs, TargetDvcScopeId, Dst, + ActorUserEntityKey, SrcSystemEntityKey, TargetSystemEntityKey, DvcEntityKey, + ActingApplicationEntityKey, TargetApplicationEntityKey, ActorUserAdditionalIds, AdditionalEntities, + AdditionalFields=_Packed diff --git a/Parsers/ASimAuditEvent/Parsers/imAuditEvent.yaml b/Parsers/ASimAuditEvent/Parsers/imAuditEvent.yaml index 71be6d1f35e..d079dbc4640 100644 --- a/Parsers/ASimAuditEvent/Parsers/imAuditEvent.yaml +++ b/Parsers/ASimAuditEvent/Parsers/imAuditEvent.yaml @@ -1,7 +1,7 @@ Parser: Title: Audit event ASIM filtering parser. - Version: '0.1.12' - LastUpdated: Oct 10, 2026 + Version: '0.1.13' + LastUpdated: Oct 23, 2026 Product: Name: Source agnostic Normalization: @@ -31,6 +31,7 @@ Parsers: - _Im_AuditEvent_BarracudaWAF - _Im_AuditEvent_BarracudaCEF - _Im_AuditEvent_CrowdStrikeFalconHost + - _Im_AuditEvent_CrowdStrikeFalconDataReplicator - _Im_AuditEvent_VectraXDRAudit - _Im_AuditEvent_SentinelOne - _Im_AuditEvent_VMwareCarbonBlackCloud @@ -94,6 +95,7 @@ ParserQuery: | vimAuditEventVectraXDRAudit (starttime=starttime, endtime=endtime, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventVectraXDRAudit' in (DisabledParsers)))), vimAuditEventSentinelOne (starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventSentinelOne' in (DisabledParsers)))), vimAuditEventCrowdStrikeFalconHost(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventCrowdStrikeFalconHost' in (DisabledParsers)))), + vimAuditEventCrowdStrikeFalconDataReplicator(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack), vimAuditEventVMwareCarbonBlackCloud(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventVMwareCarbonBlackCloud' in (DisabledParsers)))), vimAuditEventInfbloxBloxOne(starttime=starttime, endtime=endtime, eventresult=eventresult,operation_has_any=operation_has_any, eventtype_in=eventtype_in, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, actorusername_has_any=actorusername_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventInfbloxBloxOne' in (DisabledParsers)))), vimAuditEventIllumioSaaSCore(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, eventtype_in=eventtype_in, eventresult=eventresult, actorusername_has_any=actorusername_has_any, operation_has_any=operation_has_any, object_has_any=object_has_any, newvalue_has_any=newvalue_has_any, disabled=(BuiltInDisabled or ('ExcludevimAuditEventIllumioSaaSCore' in (DisabledParsers)))), diff --git a/Parsers/ASimAuditEvent/Parsers/vimAuditEventCrowdStrikeFalconDataReplicator.yaml b/Parsers/ASimAuditEvent/Parsers/vimAuditEventCrowdStrikeFalconDataReplicator.yaml new file mode 100644 index 00000000000..4cda64fb7f2 --- /dev/null +++ b/Parsers/ASimAuditEvent/Parsers/vimAuditEventCrowdStrikeFalconDataReplicator.yaml @@ -0,0 +1,242 @@ +Parser: + Title: Audit Event ASIM filtering parser for CrowdStrike Falcon Data Replicator + Version: '0.1.0' + LastUpdated: Oct 23, 2026 +Product: + Name: CrowdStrike Falcon Data Replicator +Normalization: + Schema: AuditEvent + Version: '1.0.0' +References: +- Title: ASIM Audit Event Schema + Link: https://aka.ms/ASimAuditEventDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: CrowdStrike Falcon Data Replicator connector documentation + Link: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/CrowdStrikeS3FDR_ccp/DataConnectorDefinition.json +Description: | + Normalizes CrowdStrike_Audit_Events_CL to the ASIM Audit Event schema, including + configuration, policy, account, file, share, and device audit operations. + Only event_simpleName identifies operations; records with an empty value are excluded. + Unknown event names map to Other. Undocumented numeric enumerations are retained + without guessing their meanings. Missing device or object values remain empty. + Use pack=true to retain original source fields, including currently empty columns. + The source-IP prefix parameter in the filtering parser supports IPv4 prefixes. + This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. +ParserName: vimAuditEventCrowdStrikeFalconDataReplicator +EquivalentBuiltInParser: _Im_AuditEvent_CrowdStrikeFalconDataReplicator +ParserParams: + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: srcipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: eventtype_in + Type: dynamic + Default: dynamic([]) + - Name: eventresult + Type: string + Default: '*' + - Name: actorusername_has_any + Type: dynamic + Default: dynamic([]) + - Name: operation_has_any + Type: dynamic + Default: dynamic([]) + - Name: object_has_any + Type: dynamic + Default: dynamic([]) + - Name: newvalue_has_any + Type: dynamic + Default: dynamic([]) + - Name: disabled + Type: bool + Default: false + - Name: pack + Type: bool + Default: false +ParserQuery: | + let EventMap = datatable(event_simpleName:string, EventType:string, ObjectType:string, ObjectCategory:string) [ + "FirewallDeleteRule", "Delete", "Policy Rule", "FirewallRule", + "FirewallSetRule", "Set", "Policy Rule", "FirewallRule", + "FirewallChangeOption", "Set", "Configuration Atom", "FirewallOption", + "FirewallEnabled", "Enable", "Configuration Atom", "Firewall", + "FirewallDisabled", "Disable", "Configuration Atom", "Firewall", + "ConfigStateUpdate", "Set", "Configuration Atom", "Configuration", + "CriticalEnvironmentVariableChanged", "Set", "Configuration Atom", "EnvironmentVariable", + "HostnameChanged", "Set", "Configuration Atom", "Hostname", + "MemoryScanEnabled", "Enable", "Configuration Atom", "MemoryScan", + "FileVaultStatus", "Read", "Configuration Atom", "FileVault", + "ActiveDirectoryAccountCreated", "Create", "Directory Service Object", "Account", + "ActiveDirectoryAccountEnabled", "Enable", "Directory Service Object", "Account", + "ActiveDirectoryAccountDisabled", "Disable", "Directory Service Object", "Account", + "ActiveDirectoryAccountLocked", "Set", "Directory Service Object", "Account", + "ActiveDirectoryAccountUnlocked", "Set", "Directory Service Object", "Account", + "ActiveDirectoryAccountPasswordUpdate", "Set", "Directory Service Object", "Account", + "ActiveDirectoryAccountDepartmentUpdate", "Set", "Directory Service Object", "Account", + "ActiveDirectoryAccountNameUpdate", "Set", "Directory Service Object", "Account", + "ActiveDirectoryAccountOuUpdate", "Set", "Directory Service Object", "Account", + "NetShareAdd", "Create", "Other", "Share", + "NetShareDelete", "Delete", "Other", "Share", + "NetShareSecurityModify", "Set", "Other", "Share", + "EventLogCleared", "Clear", "Event Log", "EventLog", + "VolumeSnapshotCreated", "Create", "Other", "VolumeSnapshot", + "VolumeSnapshotDeleted", "Delete", "Other", "VolumeSnapshot", + "DcUsbDeviceWhitelisted", "Set", "Policy Rule", "UsbDevice", + "DcUsbDeviceDisconnected", "Stop", "Other", "UsbDevice", + "DcBluetoothDeviceConnected", "Start", "Other", "BluetoothDevice", + "DcBluetoothDeviceDisconnected", "Stop", "Other", "BluetoothDevice", + "IOServiceRegister", "Create", "Service", "IOService", + "ProvisioningStarted", "Start", "Service", "Provisioning", + "ProvisioningEnded", "Stop", "Service", "Provisioning", + "ManifestDownloadComplete", "Other", "Other", "ManifestDownload", + "InstallBundleDownloadComplete", "Other", "Other", "InstallBundleDownload", + "InstallServiceDownloadComplete", "Other", "Other", "InstallServiceDownload", + "OsfmDownloadComplete", "Other", "Other", "OsfmDownload", + "LfoUploadStart", "Start", "Other", "Upload", + "FileCreateInfo", "Create", "Other", "File", + "FileDeleteInfo", "Delete", "Other", "File", + "FileRenameInfo", "Set", "Other", "File", + "FileOpenInfo", "Read", "Other", "File", + "SmbClientShareOpenedEtw", "Start", "Other", "SmbShare", + "SmbClientShareClosedEtw", "Stop", "Other", "SmbShare", + "SmbServerShareOpenedEtw", "Start", "Other", "SmbShare", + "IoSessionConnected", "Start", "Other", "IoSession" + ]; + CrowdStrike_Audit_Events_CL + | where not(disabled) + | where (isnull(starttime) or TimeGenerated >= starttime) and (isnull(endtime) or TimeGenerated <= endtime) + | where isnotempty(event_simpleName) + | where array_length(operation_has_any) == 0 or event_simpleName has_any (operation_has_any) + | where array_length(actorusername_has_any) == 0 or UserName has_any (actorusername_has_any) + | where array_length(srcipaddr_has_any_prefix) == 0 + or has_any_ipv4_prefix(coalesce(RemoteAddressIP4, RemoteAddressIP6), srcipaddr_has_any_prefix) + | lookup kind=leftouter EventMap on event_simpleName + | extend EventType=coalesce(EventType, "Other"), ObjectType=coalesce(ObjectType, "Other"), + ObjectCategory=coalesce(ObjectCategory, "Unclassified") + | where array_length(eventtype_in) == 0 or EventType in (eventtype_in) + | extend EventResult=case(Status in~ ("Success", "Succeeded"), "Success", Status in~ ("Failure", "Failed"), "Failure", "NA") + | where eventresult in ("", "*") or EventResult == eventresult + | extend _Host=coalesce(ComputerName, tostring(AdditionalFields.ComputerName)), + _LocalIp=tostring(AdditionalFields.LocalAddressIP4), + _RemoteIp=coalesce(RemoteAddressIP4, RemoteAddressIP6), + _EventTime=coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated) + | extend _Hostname=tostring(split(_Host, ".")[0]), + _SrcHostname=tostring(split(coalesce(ClientComputerName, SmbClientName), ".")[0]) + | extend DvcHostname=iff(_Hostname matches regex @"^[a-zA-Z0-9-]{1,61}$", _Hostname, ""), + DvcDomain=iff(_Host contains ".", substring(_Host, indexof(_Host, ".")+1), ""), + DvcFQDN=iff(_Host contains ".", _Host, ""), + DvcIpAddr=coalesce(_LocalIp, aip), + SrcHostname=iff(_SrcHostname matches regex @"^[a-zA-Z0-9-]{1,61}$", _SrcHostname, ""), + SrcFQDN=iff(coalesce(ClientComputerName, SmbClientName) contains ".", coalesce(ClientComputerName, SmbClientName), ""), + SrcDomain=iff(coalesce(ClientComputerName, SmbClientName) contains ".", substring(coalesce(ClientComputerName, SmbClientName), indexof(coalesce(ClientComputerName, SmbClientName), ".")+1), ""), + ActorUsernameType=case(isempty(UserName), "", UserName contains "\\", "Windows", UserName contains "@", "UPN", "Simple"), + DvcOs=case(event_platform == "Win", "Windows", event_platform == "Mac", "macOS", event_platform == "Lin", "Linux", "") + | extend Object=case( + ObjectCategory == "FirewallRule", coalesce(FirewallRule, FirewallRuleId), + ObjectCategory == "FirewallOption", FirewallOption, + ObjectCategory == "EnvironmentVariable", EnvironmentVariableName, + ObjectCategory == "Account", coalesce(SamAccountName, AccountObjectSid, AccountObjectGuid), + ObjectCategory in ("Share", "SmbShare"), coalesce(SharePath, ShareName, SmbShareName), + ObjectCategory == "File", coalesce(SourceFileName, TargetFileName), + ObjectCategory == "VolumeSnapshot", coalesce(VolumeSnapshotName, VolumeName), + ObjectCategory == "UsbDevice", coalesce(DeviceInstanceId, DeviceSerialNumber, DeviceProduct), + ObjectCategory == "BluetoothDevice", coalesce(BluetoothDeviceAddress, DeviceInstanceId), + ObjectCategory == "IOService", coalesce(IOServiceName, IOServicePath), + ObjectCategory == "Upload", UploadId, + ObjectCategory == "IoSession", SessionId, + ObjectCategory == "Unclassified", "", + ObjectCategory), + ObjectId=case( + ObjectCategory == "FirewallRule", FirewallRuleId, + ObjectCategory == "Account", coalesce(AccountObjectGuid, AccountObjectSid), + ObjectCategory in ("UsbDevice", "BluetoothDevice"), DeviceInstanceId, + ""), + NewValue=case( + event_simpleName == "FirewallChangeOption", coalesce(FirewallOptionStringValue, FirewallOptionNumericValue), + event_simpleName == "CriticalEnvironmentVariableChanged", EnvironmentVariableValue, + event_simpleName == "ConfigStateUpdate", ConfigStateData, + event_simpleName == "FileRenameInfo", TargetFileName, + event_simpleName == "ActiveDirectoryAccountDepartmentUpdate", ActiveDirectoryDepartment, + event_simpleName == "ActiveDirectoryAccountOuUpdate", ActiveDirectoryOuDn, + event_simpleName == "ActiveDirectoryAccountNameUpdate", SamAccountName, + event_simpleName == "NetShareSecurityModify", ShareData, + event_simpleName == "FileVaultStatus" and isnotnull(FileVaultIsEnabled), tostring(FileVaultIsEnabled), + event_simpleName in ("FirewallEnabled", "MemoryScanEnabled", "ActiveDirectoryAccountEnabled"), "true", + event_simpleName in ("FirewallDisabled", "ActiveDirectoryAccountDisabled"), "false", + event_simpleName == "HostnameChanged", _Host, + "") + | where array_length(object_has_any) == 0 or Object has_any (object_has_any) + | where array_length(newvalue_has_any) == 0 or NewValue has_any (newvalue_has_any) + | extend _Packed=iff(pack, bag_pack( + "timestamp", timestamp, "aip", aip, "aid", aid, "UserName", UserName, "event_platform", event_platform, + "ContextTimeStamp", ContextTimeStamp, "name", name, "ConfigBuild", ConfigBuild, "CrowdStrikeId", CrowdStrikeId, + "ConfigStateHash", ConfigStateHash, "ContextProcessId", ContextProcessId, "ContextThreadId", ContextThreadId, + "BoundingLimitCount", BoundingLimitCount, "BoundingLimitDuration", BoundingLimitDuration, "Entitlements", Entitlements, + "EffectiveTransmissionClass", EffectiveTransmissionClass, "cid", cid, "OciContainerId", OciContainerId, + "TreeId", TreeId, "VolumeSnapshotName", VolumeSnapshotName, "SmbShareName", SmbShareName, "ShareName", ShareName, + "UploadId", UploadId, "SessionId", SessionId, "ComputerName", ComputerName, "FirewallRule", FirewallRule, + "FirewallRuleId", FirewallRuleId, "FirewallOption", FirewallOption, "SourceFileName", SourceFileName, + "TargetFileName", TargetFileName, "DeviceVendorId", DeviceVendorId, "DeviceProductId", DeviceProductId, + "DeviceSerialNumber", DeviceSerialNumber, "BluetoothDeviceAddress", BluetoothDeviceAddress, + "EnvironmentVariableName", EnvironmentVariableName, "SamAccountName", SamAccountName, + "FirewallOptionNumericValue", FirewallOptionNumericValue, "FirewallOptionStringValue", FirewallOptionStringValue, + "FileVaultIsEnabled", FileVaultIsEnabled, "EnvironmentVariableValue", EnvironmentVariableValue, + "ConfigStateData", ConfigStateData, "ActiveDirectoryOuDn", ActiveDirectoryOuDn, + "ActiveDirectoryDepartment", ActiveDirectoryDepartment, "SHA256HashData", SHA256HashData, "CommandLine", CommandLine, + "VolumeName", VolumeName, "VolumeDriveLetter", VolumeDriveLetter, "TokenType", TokenType, "InterfaceGuid", InterfaceGuid, + "RpcClientProcessId", RpcClientProcessId, "InterfaceVersion", InterfaceVersion, "RpcClientThreadId", RpcClientThreadId, + "AuthenticationId", AuthenticationId, "ImageFileName", ImageFileName, "RpcOpNum", RpcOpNum, + "RpcNestingLevel", RpcNestingLevel, "ClientComputerName", ClientComputerName, "DomainName", DomainName, + "RemoteAddressIP6", RemoteAddressIP6, "RemoteAddressIP4", RemoteAddressIP4, "SmbClientName", SmbClientName, + "AgentLoadFlags", AgentLoadFlags, "ProvisioningDuration", ProvisioningDuration, "Status", Status, + "ErrorText", ErrorText, "CloudErrorCode", CloudErrorCode, "SharePath", SharePath, "ShareMaxCount", ShareMaxCount, + "ShareRemark", ShareRemark, "ShareData", ShareData, "IntelTDTEnabled", IntelTDTEnabled, + "FalconServiceState", FalconServiceState, "LfoUploadFlags", LfoUploadFlags, "AttemptNumber", AttemptNumber, + "Size", Size, "Tags", Tags, "CloudRequestId", CloudRequestId, "LocalSession", LocalSession, + "IOServiceClass", IOServiceClass, "IOServicePath", IOServicePath, "IOServiceProperties", IOServiceProperties, + "IOServiceName", IOServiceName, "Protocol", Protocol, "ChannelDiffStatusList", ChannelDiffStatusList, + "AccountDomain", AccountDomain, "AccountObjectGuid", AccountObjectGuid, "AccountObjectSid", AccountObjectSid, + "TotalCount", TotalCount, "ErrorCode", ErrorCode, "EventOrigin", EventOrigin, "AddressFamily", AddressFamily, + "BluetoothDeviceType", BluetoothDeviceType, "DeviceTimeStamp", DeviceTimeStamp, "DeviceInstanceId", DeviceInstanceId, + "BluetoothDeviceAddressType", BluetoothDeviceAddressType, "DeviceVersion", DeviceVersion, + "DeviceDescriptorSetHash", DeviceDescriptorSetHash, "DeviceManufacturer", DeviceManufacturer, + "DeviceProduct", DeviceProduct, "DeviceUserSid", DeviceUserSid, "DeviceUserAuthenticationId", DeviceUserAuthenticationId, + "FirewallProfile", FirewallProfile, "ShareAccess", ShareAccess, "DesiredAccess", DesiredAccess, "GID", GID, + "UID", UID, "UnixMode", UnixMode, "OriginalAdditionalFields", AdditionalFields), dynamic({})) + | project-rename Operation=event_simpleName, DvcId=aid, DvcScopeId=cid, ActorUsername=UserName, + ActorSessionId=AuthenticationId, ActingAppId=ContextProcessId, ActingAppName=ImageFileName, + EventOriginalUid=CrowdStrikeId, EventMessage=ErrorText + | extend Dvc=coalesce(_Host, DvcId, DvcIpAddr), DvcIdType=iff(isnotempty(DvcId), "Other", ""), + DvcDomainType=iff(isnotempty(DvcDomain), "FQDN", ""), + SrcIpAddr=_RemoteIp, SrcDomainType=iff(isnotempty(SrcDomain), "FQDN", ""), + Src=coalesce(SrcFQDN, SrcHostname, _RemoteIp), + ActingAppType=iff(isnotempty(ActingAppId) or isnotempty(ActingAppName), "Process", ""), + EventOriginalResultDetails=coalesce(Status, ErrorCode, CloudErrorCode), + EventStartTime=_EventTime, EventEndTime=_EventTime, + EventCount=int(1), EventSchema="AuditEvent", EventSchemaVersion="1.0.0", + EventVendor="CrowdStrike", EventProduct="Falcon Data Replicator", EventSeverity="Informational", + TargetHostname=DvcHostname, TargetFQDN=DvcFQDN, TargetDomain=DvcDomain, + TargetDomainType=iff(isnotempty(DvcDomain), "FQDN", ""), TargetIpAddr=DvcIpAddr, + TargetDvcId=DvcId, TargetDvcIdType=iff(isnotempty(DvcId), "Other", ""), TargetDvcOs=DvcOs, + TargetDvcScopeId=DvcScopeId, OriginalObjectType=ObjectCategory, + ActorUserEntityKey="", SrcSystemEntityKey="", TargetSystemEntityKey="", DvcEntityKey="", + ActingApplicationEntityKey="", TargetApplicationEntityKey="", + ActorUserAdditionalIds=dynamic([]), AdditionalEntities=dynamic([]) + | extend User=ActorUsername, IpAddr=SrcIpAddr, Value=NewValue, Dst=Dvc + | project TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, EventType, EventResult, + EventSchema, EventSchemaVersion, EventVendor, EventProduct, EventSeverity, + EventOriginalUid, EventOriginalResultDetails, EventMessage, Operation, + Object, ObjectId, ObjectType, OriginalObjectType, NewValue, Value, + Dvc, DvcId, DvcIdType, DvcScopeId, DvcHostname, DvcFQDN, DvcDomain, DvcDomainType, DvcIpAddr, DvcOs, + ActorUsername, ActorUsernameType, ActorSessionId, User, ActingAppId, ActingAppName, ActingAppType, + Src, SrcIpAddr, SrcHostname, SrcFQDN, SrcDomain, SrcDomainType, IpAddr, + TargetHostname, TargetFQDN, TargetDomain, TargetDomainType, TargetIpAddr, + TargetDvcId, TargetDvcIdType, TargetDvcOs, TargetDvcScopeId, Dst, + ActorUserEntityKey, SrcSystemEntityKey, TargetSystemEntityKey, DvcEntityKey, + ActingApplicationEntityKey, TargetApplicationEntityKey, ActorUserAdditionalIds, AdditionalEntities, + AdditionalFields=_Packed diff --git a/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_AuditEvent_IngestedLogs.csv b/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_AuditEvent_IngestedLogs.csv new file mode 100644 index 00000000000..2052b899495 --- /dev/null +++ b/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_AuditEvent_IngestedLogs.csv @@ -0,0 +1,11 @@ +"TimeGenerated","event_simpleName","timestamp","aip","aid","UserName","event_platform","ContextTimeStamp","name","ConfigBuild","CrowdStrikeId","ConfigStateHash","ContextProcessId","ContextThreadId","BoundingLimitCount","BoundingLimitDuration","Entitlements","EffectiveTransmissionClass","cid","OciContainerId","TreeId","VolumeSnapshotName","SmbShareName","ShareName","UploadId","SessionId","ComputerName","FirewallRule","FirewallRuleId","FirewallOption","SourceFileName","TargetFileName","DeviceVendorId","DeviceProductId","DeviceSerialNumber","BluetoothDeviceAddress","EnvironmentVariableName","SamAccountName","FirewallOptionNumericValue","FirewallOptionStringValue","FileVaultIsEnabled","EnvironmentVariableValue","ConfigStateData","ActiveDirectoryOuDn","ActiveDirectoryDepartment","SHA256HashData","CommandLine","VolumeName","VolumeDriveLetter","TokenType","InterfaceGuid","RpcClientProcessId","InterfaceVersion","RpcClientThreadId","AuthenticationId","ImageFileName","RpcOpNum","RpcNestingLevel","ClientComputerName","DomainName","RemoteAddressIP6","RemoteAddressIP4","SmbClientName","AgentLoadFlags","ProvisioningDuration","Status","ErrorText","CloudErrorCode","SharePath","ShareMaxCount","ShareRemark","ShareData","IntelTDTEnabled","FalconServiceState","LfoUploadFlags","AttemptNumber","Size","Tags","CloudRequestId","LocalSession","IOServiceClass","IOServicePath","IOServiceProperties","IOServiceName","Protocol","ChannelDiffStatusList","AccountDomain","AccountObjectGuid","AccountObjectSid","TotalCount","ErrorCode","EventOrigin","AddressFamily","BluetoothDeviceType","DeviceTimeStamp","DeviceInstanceId","BluetoothDeviceAddressType","DeviceVersion","DeviceDescriptorSetHash","DeviceManufacturer","DeviceProduct","DeviceUserSid","DeviceUserAuthenticationId","FirewallProfile","ShareAccess","DesiredAccess","GID","UID","UnixMode","AdditionalFields","TenantId","Type","_ResourceId" +"2026-10-23T18:00:00.0000000Z","FirewallDeleteRule","1792778400000","192.0.2.10","00000000000000000000000000000001","alice@example.test","Win","1792778400","FirewallDeleteRuleV1","sample-ConfigBuild-0","00000000-0000-4000-8000-000000000001","sample-ConfigStateHash-0","100","sample-ContextThreadId-0","1","sample-BoundingLimitDuration-0","sample-Entitlements-0","sample-EffectiveTransmissionClass-0","00000000000000000000000000000001","sample-OciContainerId-0","sample-TreeId-0","sample-VolumeSnapshotName-0","sample-SmbShareName-0","sample-ShareName-0","sample-UploadId-0","sample-SessionId-0","host-0.example.test","Rule-0","1","EnableFirewall","C:\Audit\source-0.txt","C:\Audit\target-0.txt","sample-DeviceVendorId-0","sample-DeviceProductId-0","sample-DeviceSerialNumber-0","sample-BluetoothDeviceAddress-0","sample-EnvironmentVariableName-0","account-0","0","true","True","sample-EnvironmentVariableValue-0","{""setting"":""synthetic-value""}","sample-ActiveDirectoryOuDn-0","sample-ActiveDirectoryDepartment-0","0000000000000000000000000000000000000000000000000000000000000001","sample-CommandLine-0","sample-VolumeName-0","sample-VolumeDriveLetter-0","sample-TokenType-0","sample-InterfaceGuid-0","sample-RpcClientProcessId-0","sample-InterfaceVersion-0","sample-RpcClientThreadId-0","1000","C:\Program Files\Example\process-0.exe","sample-RpcOpNum-0","sample-RpcNestingLevel-0","client-0.example.test","example.test","2001:db8::1","198.51.100.10","client-0.example.test","sample-AgentLoadFlags-0","sample-ProvisioningDuration-0","Success","","sample-CloudErrorCode-0","\\server-0.example.test\share-0","1","sample-ShareRemark-0","{""access"":""synthetic-permission""}","1","1","sample-LfoUploadFlags-0","1","sample-Size-0","sample-Tags-0","sample-CloudRequestId-0","0","sample-IOServiceClass-0","sample-IOServicePath-0","sample-IOServiceProperties-0","sample-IOServiceName-0","sample-Protocol-0","sample-ChannelDiffStatusList-0","EXAMPLE","00000000-0000-4000-8000-000000000100","S-1-5-21-100-200-300-1000","1","0","sample-EventOrigin-0","sample-AddressFamily-0","sample-BluetoothDeviceType-0","1792778400","sample-DeviceInstanceId-0","sample-BluetoothDeviceAddressType-0","sample-DeviceVersion-0","sample-DeviceDescriptorSetHash-0","sample-DeviceManufacturer-0","sample-DeviceProduct-0","S-1-5-21-100-200-300-2000","sample-DeviceUserAuthenticationId-0","sample-FirewallProfile-0","sample-ShareAccess-0","sample-DesiredAccess-0","sample-GID-0","sample-UID-0","sample-UnixMode-0","{""LocalAddressIP4"":""192.0.2.50"",""ComputerName"":""host.example.test"",""EventOrigin"":""1""}","00000000-0000-4000-8000-000000000001","CrowdStrike_Audit_Events_CL","" +"2026-10-23T18:01:00.0000000Z","FirewallSetRule","1792778460000","192.0.2.11","00000000000000000000000000000002","EXAMPLE\bob","Mac","1792778460","FirewallSetRuleV1","sample-ConfigBuild-1","00000000-0000-4000-8000-000000000002","sample-ConfigStateHash-1","101","sample-ContextThreadId-1","2","sample-BoundingLimitDuration-1","sample-Entitlements-1","sample-EffectiveTransmissionClass-1","00000000000000000000000000000001","sample-OciContainerId-1","sample-TreeId-1","sample-VolumeSnapshotName-1","sample-SmbShareName-1","sample-ShareName-1","sample-UploadId-1","sample-SessionId-1","host-1.example.test","Rule-1","2","LogDroppedPackets","C:\Audit\source-1.txt","C:\Audit\target-1.txt","sample-DeviceVendorId-1","sample-DeviceProductId-1","sample-DeviceSerialNumber-1","sample-BluetoothDeviceAddress-1","sample-EnvironmentVariableName-1","account-1","1","false","False","sample-EnvironmentVariableValue-1","{""setting"":""synthetic-value""}","sample-ActiveDirectoryOuDn-1","sample-ActiveDirectoryDepartment-1","0000000000000000000000000000000000000000000000000000000000000002","sample-CommandLine-1","sample-VolumeName-1","sample-VolumeDriveLetter-1","sample-TokenType-1","sample-InterfaceGuid-1","sample-RpcClientProcessId-1","sample-InterfaceVersion-1","sample-RpcClientThreadId-1","1001","C:\Program Files\Example\process-1.exe","sample-RpcOpNum-1","sample-RpcNestingLevel-1","client-1.example.test","example.test","2001:db8::2","203.0.113.20","client-1.example.test","sample-AgentLoadFlags-1","sample-ProvisioningDuration-1","Failure","Synthetic access-denied example","sample-CloudErrorCode-1","\\server-1.example.test\share-1","2","sample-ShareRemark-1","{""access"":""synthetic-permission""}","2","1","sample-LfoUploadFlags-1","2","sample-Size-1","sample-Tags-1","sample-CloudRequestId-1","1","sample-IOServiceClass-1","sample-IOServicePath-1","sample-IOServiceProperties-1","sample-IOServiceName-1","sample-Protocol-1","sample-ChannelDiffStatusList-1","EXAMPLE","00000000-0000-4000-8000-000000000101","S-1-5-21-100-200-300-1001","2","5","sample-EventOrigin-1","sample-AddressFamily-1","sample-BluetoothDeviceType-1","1792778460","sample-DeviceInstanceId-1","sample-BluetoothDeviceAddressType-1","sample-DeviceVersion-1","sample-DeviceDescriptorSetHash-1","sample-DeviceManufacturer-1","sample-DeviceProduct-1","S-1-5-21-100-200-300-2001","sample-DeviceUserAuthenticationId-1","sample-FirewallProfile-1","sample-ShareAccess-1","sample-DesiredAccess-1","sample-GID-1","sample-UID-1","sample-UnixMode-1","{""LocalAddressIP4"":""192.0.2.50"",""ComputerName"":""host.example.test"",""EventOrigin"":""1""}","00000000-0000-4000-8000-000000000001","CrowdStrike_Audit_Events_CL","" +"2026-10-23T18:02:00.0000000Z","FirewallChangeOption","1792778520000","192.0.2.12","00000000000000000000000000000003","carol","Lin","1792778520","FirewallChangeOptionV1","sample-ConfigBuild-2","00000000-0000-4000-8000-000000000003","sample-ConfigStateHash-2","102","sample-ContextThreadId-2","3","sample-BoundingLimitDuration-2","sample-Entitlements-2","sample-EffectiveTransmissionClass-2","00000000000000000000000000000001","sample-OciContainerId-2","sample-TreeId-2","sample-VolumeSnapshotName-2","sample-SmbShareName-2","sample-ShareName-2","sample-UploadId-2","sample-SessionId-2","host-2.example.test","Rule-2","3","LogFilePath","C:\Audit\source-2.txt","C:\Audit\target-2.txt","sample-DeviceVendorId-2","sample-DeviceProductId-2","sample-DeviceSerialNumber-2","sample-BluetoothDeviceAddress-2","sample-EnvironmentVariableName-2","account-2","0","audit.log","True","sample-EnvironmentVariableValue-2","{""setting"":""synthetic-value""}","sample-ActiveDirectoryOuDn-2","sample-ActiveDirectoryDepartment-2","0000000000000000000000000000000000000000000000000000000000000003","sample-CommandLine-2","sample-VolumeName-2","sample-VolumeDriveLetter-2","sample-TokenType-2","sample-InterfaceGuid-2","sample-RpcClientProcessId-2","sample-InterfaceVersion-2","sample-RpcClientThreadId-2","1002","C:\Program Files\Example\process-2.exe","sample-RpcOpNum-2","sample-RpcNestingLevel-2","client-2.example.test","example.test","2001:db8::3","192.0.2.30","client-2.example.test","sample-AgentLoadFlags-2","sample-ProvisioningDuration-2","","","sample-CloudErrorCode-2","\\server-2.example.test\share-2","3","sample-ShareRemark-2","{""access"":""synthetic-permission""}","1","1","sample-LfoUploadFlags-2","3","sample-Size-2","sample-Tags-2","sample-CloudRequestId-2","0","sample-IOServiceClass-2","sample-IOServicePath-2","sample-IOServiceProperties-2","sample-IOServiceName-2","sample-Protocol-2","sample-ChannelDiffStatusList-2","EXAMPLE","00000000-0000-4000-8000-000000000102","S-1-5-21-100-200-300-1002","3","","sample-EventOrigin-2","sample-AddressFamily-2","sample-BluetoothDeviceType-2","1792778520","sample-DeviceInstanceId-2","sample-BluetoothDeviceAddressType-2","sample-DeviceVersion-2","sample-DeviceDescriptorSetHash-2","sample-DeviceManufacturer-2","sample-DeviceProduct-2","S-1-5-21-100-200-300-2002","sample-DeviceUserAuthenticationId-2","sample-FirewallProfile-2","sample-ShareAccess-2","sample-DesiredAccess-2","sample-GID-2","sample-UID-2","sample-UnixMode-2","{""LocalAddressIP4"":""192.0.2.50"",""ComputerName"":""host.example.test"",""EventOrigin"":""1""}","00000000-0000-4000-8000-000000000001","CrowdStrike_Audit_Events_CL","" +"2026-10-23T18:03:00.0000000Z","ConfigStateUpdate","1792778580000","192.0.2.13","00000000000000000000000000000004","alice@example.test","Win","1792778580","ConfigStateUpdateV1","sample-ConfigBuild-3","00000000-0000-4000-8000-000000000004","sample-ConfigStateHash-3","103","sample-ContextThreadId-3","4","sample-BoundingLimitDuration-3","sample-Entitlements-3","sample-EffectiveTransmissionClass-3","00000000000000000000000000000001","sample-OciContainerId-3","sample-TreeId-3","sample-VolumeSnapshotName-3","sample-SmbShareName-3","sample-ShareName-3","sample-UploadId-3","sample-SessionId-3","host-3.example.test","Rule-3","4","EnableFirewall","C:\Audit\source-3.txt","C:\Audit\target-3.txt","sample-DeviceVendorId-3","sample-DeviceProductId-3","sample-DeviceSerialNumber-3","sample-BluetoothDeviceAddress-3","sample-EnvironmentVariableName-3","account-3","1","true","False","sample-EnvironmentVariableValue-3","{""setting"":""synthetic-value""}","sample-ActiveDirectoryOuDn-3","sample-ActiveDirectoryDepartment-3","0000000000000000000000000000000000000000000000000000000000000004","sample-CommandLine-3","sample-VolumeName-3","sample-VolumeDriveLetter-3","sample-TokenType-3","sample-InterfaceGuid-3","sample-RpcClientProcessId-3","sample-InterfaceVersion-3","sample-RpcClientThreadId-3","1003","C:\Program Files\Example\process-3.exe","sample-RpcOpNum-3","sample-RpcNestingLevel-3","client-3.example.test","example.test","2001:db8::4","198.51.100.10","client-3.example.test","sample-AgentLoadFlags-3","sample-ProvisioningDuration-3","Success","","sample-CloudErrorCode-3","\\server-3.example.test\share-3","4","sample-ShareRemark-3","{""access"":""synthetic-permission""}","2","1","sample-LfoUploadFlags-3","4","sample-Size-3","sample-Tags-3","sample-CloudRequestId-3","1","sample-IOServiceClass-3","sample-IOServicePath-3","sample-IOServiceProperties-3","sample-IOServiceName-3","sample-Protocol-3","sample-ChannelDiffStatusList-3","EXAMPLE","00000000-0000-4000-8000-000000000103","S-1-5-21-100-200-300-1003","4","0","sample-EventOrigin-3","sample-AddressFamily-3","sample-BluetoothDeviceType-3","1792778580","sample-DeviceInstanceId-3","sample-BluetoothDeviceAddressType-3","sample-DeviceVersion-3","sample-DeviceDescriptorSetHash-3","sample-DeviceManufacturer-3","sample-DeviceProduct-3","S-1-5-21-100-200-300-2003","sample-DeviceUserAuthenticationId-3","sample-FirewallProfile-3","sample-ShareAccess-3","sample-DesiredAccess-3","sample-GID-3","sample-UID-3","sample-UnixMode-3","{""LocalAddressIP4"":""192.0.2.50"",""ComputerName"":""host.example.test"",""EventOrigin"":""1""}","00000000-0000-4000-8000-000000000001","CrowdStrike_Audit_Events_CL","" +"2026-10-23T18:04:00.0000000Z","CriticalEnvironmentVariableChanged","1792778640000","192.0.2.14","00000000000000000000000000000005","EXAMPLE\bob","Mac","1792778640","CriticalEnvironmentVariableChangedV1","sample-ConfigBuild-4","00000000-0000-4000-8000-000000000005","sample-ConfigStateHash-4","104","sample-ContextThreadId-4","5","sample-BoundingLimitDuration-4","sample-Entitlements-4","sample-EffectiveTransmissionClass-4","00000000000000000000000000000001","sample-OciContainerId-4","sample-TreeId-4","sample-VolumeSnapshotName-4","sample-SmbShareName-4","sample-ShareName-4","sample-UploadId-4","sample-SessionId-4","host-4.example.test","Rule-4","5","LogDroppedPackets","C:\Audit\source-4.txt","C:\Audit\target-4.txt","sample-DeviceVendorId-4","sample-DeviceProductId-4","sample-DeviceSerialNumber-4","sample-BluetoothDeviceAddress-4","sample-EnvironmentVariableName-4","account-4","0","false","True","sample-EnvironmentVariableValue-4","{""setting"":""synthetic-value""}","sample-ActiveDirectoryOuDn-4","sample-ActiveDirectoryDepartment-4","0000000000000000000000000000000000000000000000000000000000000005","sample-CommandLine-4","sample-VolumeName-4","sample-VolumeDriveLetter-4","sample-TokenType-4","sample-InterfaceGuid-4","sample-RpcClientProcessId-4","sample-InterfaceVersion-4","sample-RpcClientThreadId-4","1004","C:\Program Files\Example\process-4.exe","sample-RpcOpNum-4","sample-RpcNestingLevel-4","client-4.example.test","example.test","2001:db8::5","203.0.113.20","client-4.example.test","sample-AgentLoadFlags-4","sample-ProvisioningDuration-4","Failure","Synthetic access-denied example","sample-CloudErrorCode-4","\\server-4.example.test\share-4","5","sample-ShareRemark-4","{""access"":""synthetic-permission""}","1","1","sample-LfoUploadFlags-4","5","sample-Size-4","sample-Tags-4","sample-CloudRequestId-4","0","sample-IOServiceClass-4","sample-IOServicePath-4","sample-IOServiceProperties-4","sample-IOServiceName-4","sample-Protocol-4","sample-ChannelDiffStatusList-4","EXAMPLE","00000000-0000-4000-8000-000000000104","S-1-5-21-100-200-300-1004","5","5","sample-EventOrigin-4","sample-AddressFamily-4","sample-BluetoothDeviceType-4","1792778640","sample-DeviceInstanceId-4","sample-BluetoothDeviceAddressType-4","sample-DeviceVersion-4","sample-DeviceDescriptorSetHash-4","sample-DeviceManufacturer-4","sample-DeviceProduct-4","S-1-5-21-100-200-300-2004","sample-DeviceUserAuthenticationId-4","sample-FirewallProfile-4","sample-ShareAccess-4","sample-DesiredAccess-4","sample-GID-4","sample-UID-4","sample-UnixMode-4","{""LocalAddressIP4"":""192.0.2.50"",""ComputerName"":""host.example.test"",""EventOrigin"":""1""}","00000000-0000-4000-8000-000000000001","CrowdStrike_Audit_Events_CL","" +"2026-10-23T18:05:00.0000000Z","FileRenameInfo","1792778700000","192.0.2.15","00000000000000000000000000000006","carol","Lin","1792778700","FileRenameInfoV1","sample-ConfigBuild-5","00000000-0000-4000-8000-000000000006","sample-ConfigStateHash-5","105","sample-ContextThreadId-5","6","sample-BoundingLimitDuration-5","sample-Entitlements-5","sample-EffectiveTransmissionClass-5","00000000000000000000000000000001","sample-OciContainerId-5","sample-TreeId-5","sample-VolumeSnapshotName-5","sample-SmbShareName-5","sample-ShareName-5","sample-UploadId-5","sample-SessionId-5","host-5.example.test","Rule-5","6","LogFilePath","C:\Audit\source-5.txt","C:\Audit\target-5.txt","sample-DeviceVendorId-5","sample-DeviceProductId-5","sample-DeviceSerialNumber-5","sample-BluetoothDeviceAddress-5","sample-EnvironmentVariableName-5","account-5","1","audit.log","False","sample-EnvironmentVariableValue-5","{""setting"":""synthetic-value""}","sample-ActiveDirectoryOuDn-5","sample-ActiveDirectoryDepartment-5","0000000000000000000000000000000000000000000000000000000000000006","sample-CommandLine-5","sample-VolumeName-5","sample-VolumeDriveLetter-5","sample-TokenType-5","sample-InterfaceGuid-5","sample-RpcClientProcessId-5","sample-InterfaceVersion-5","sample-RpcClientThreadId-5","1005","C:\Program Files\Example\process-5.exe","sample-RpcOpNum-5","sample-RpcNestingLevel-5","client-5.example.test","example.test","2001:db8::6","192.0.2.30","client-5.example.test","sample-AgentLoadFlags-5","sample-ProvisioningDuration-5","","","sample-CloudErrorCode-5","\\server-5.example.test\share-5","6","sample-ShareRemark-5","{""access"":""synthetic-permission""}","2","1","sample-LfoUploadFlags-5","6","sample-Size-5","sample-Tags-5","sample-CloudRequestId-5","1","sample-IOServiceClass-5","sample-IOServicePath-5","sample-IOServiceProperties-5","sample-IOServiceName-5","sample-Protocol-5","sample-ChannelDiffStatusList-5","EXAMPLE","00000000-0000-4000-8000-000000000105","S-1-5-21-100-200-300-1005","6","","sample-EventOrigin-5","sample-AddressFamily-5","sample-BluetoothDeviceType-5","1792778700","sample-DeviceInstanceId-5","sample-BluetoothDeviceAddressType-5","sample-DeviceVersion-5","sample-DeviceDescriptorSetHash-5","sample-DeviceManufacturer-5","sample-DeviceProduct-5","S-1-5-21-100-200-300-2005","sample-DeviceUserAuthenticationId-5","sample-FirewallProfile-5","sample-ShareAccess-5","sample-DesiredAccess-5","sample-GID-5","sample-UID-5","sample-UnixMode-5","{""LocalAddressIP4"":""192.0.2.50"",""ComputerName"":""host.example.test"",""EventOrigin"":""1""}","00000000-0000-4000-8000-000000000001","CrowdStrike_Audit_Events_CL","" +"2026-10-23T18:06:00.0000000Z","ActiveDirectoryAccountDepartmentUpdate","1792778760000","192.0.2.16","00000000000000000000000000000007","alice@example.test","Win","1792778760","ActiveDirectoryAccountDepartmentUpdateV1","sample-ConfigBuild-6","00000000-0000-4000-8000-000000000007","sample-ConfigStateHash-6","106","sample-ContextThreadId-6","7","sample-BoundingLimitDuration-6","sample-Entitlements-6","sample-EffectiveTransmissionClass-6","00000000000000000000000000000001","sample-OciContainerId-6","sample-TreeId-6","sample-VolumeSnapshotName-6","sample-SmbShareName-6","sample-ShareName-6","sample-UploadId-6","sample-SessionId-6","host-6.example.test","Rule-6","7","EnableFirewall","C:\Audit\source-6.txt","C:\Audit\target-6.txt","sample-DeviceVendorId-6","sample-DeviceProductId-6","sample-DeviceSerialNumber-6","sample-BluetoothDeviceAddress-6","sample-EnvironmentVariableName-6","account-6","0","true","True","sample-EnvironmentVariableValue-6","{""setting"":""synthetic-value""}","sample-ActiveDirectoryOuDn-6","sample-ActiveDirectoryDepartment-6","0000000000000000000000000000000000000000000000000000000000000007","sample-CommandLine-6","sample-VolumeName-6","sample-VolumeDriveLetter-6","sample-TokenType-6","sample-InterfaceGuid-6","sample-RpcClientProcessId-6","sample-InterfaceVersion-6","sample-RpcClientThreadId-6","1006","C:\Program Files\Example\process-6.exe","sample-RpcOpNum-6","sample-RpcNestingLevel-6","client-6.example.test","example.test","2001:db8::7","198.51.100.10","client-6.example.test","sample-AgentLoadFlags-6","sample-ProvisioningDuration-6","Success","","sample-CloudErrorCode-6","\\server-6.example.test\share-6","7","sample-ShareRemark-6","{""access"":""synthetic-permission""}","1","1","sample-LfoUploadFlags-6","7","sample-Size-6","sample-Tags-6","sample-CloudRequestId-6","0","sample-IOServiceClass-6","sample-IOServicePath-6","sample-IOServiceProperties-6","sample-IOServiceName-6","sample-Protocol-6","sample-ChannelDiffStatusList-6","EXAMPLE","00000000-0000-4000-8000-000000000106","S-1-5-21-100-200-300-1006","7","0","sample-EventOrigin-6","sample-AddressFamily-6","sample-BluetoothDeviceType-6","1792778760","sample-DeviceInstanceId-6","sample-BluetoothDeviceAddressType-6","sample-DeviceVersion-6","sample-DeviceDescriptorSetHash-6","sample-DeviceManufacturer-6","sample-DeviceProduct-6","S-1-5-21-100-200-300-2006","sample-DeviceUserAuthenticationId-6","sample-FirewallProfile-6","sample-ShareAccess-6","sample-DesiredAccess-6","sample-GID-6","sample-UID-6","sample-UnixMode-6","{""LocalAddressIP4"":""192.0.2.50"",""ComputerName"":""host.example.test"",""EventOrigin"":""1""}","00000000-0000-4000-8000-000000000001","CrowdStrike_Audit_Events_CL","" +"2026-10-23T18:07:00.0000000Z","NetShareSecurityModify","1792778820000","192.0.2.17","00000000000000000000000000000008","EXAMPLE\bob","Mac","1792778820","NetShareSecurityModifyV1","sample-ConfigBuild-7","00000000-0000-4000-8000-000000000008","sample-ConfigStateHash-7","107","sample-ContextThreadId-7","8","sample-BoundingLimitDuration-7","sample-Entitlements-7","sample-EffectiveTransmissionClass-7","00000000000000000000000000000001","sample-OciContainerId-7","sample-TreeId-7","sample-VolumeSnapshotName-7","sample-SmbShareName-7","sample-ShareName-7","sample-UploadId-7","sample-SessionId-7","host-7.example.test","Rule-7","8","LogDroppedPackets","C:\Audit\source-7.txt","C:\Audit\target-7.txt","sample-DeviceVendorId-7","sample-DeviceProductId-7","sample-DeviceSerialNumber-7","sample-BluetoothDeviceAddress-7","sample-EnvironmentVariableName-7","account-7","1","false","False","sample-EnvironmentVariableValue-7","{""setting"":""synthetic-value""}","sample-ActiveDirectoryOuDn-7","sample-ActiveDirectoryDepartment-7","0000000000000000000000000000000000000000000000000000000000000008","sample-CommandLine-7","sample-VolumeName-7","sample-VolumeDriveLetter-7","sample-TokenType-7","sample-InterfaceGuid-7","sample-RpcClientProcessId-7","sample-InterfaceVersion-7","sample-RpcClientThreadId-7","1007","C:\Program Files\Example\process-7.exe","sample-RpcOpNum-7","sample-RpcNestingLevel-7","client-7.example.test","example.test","2001:db8::8","203.0.113.20","client-7.example.test","sample-AgentLoadFlags-7","sample-ProvisioningDuration-7","Failure","Synthetic access-denied example","sample-CloudErrorCode-7","\\server-7.example.test\share-7","8","sample-ShareRemark-7","{""access"":""synthetic-permission""}","2","1","sample-LfoUploadFlags-7","8","sample-Size-7","sample-Tags-7","sample-CloudRequestId-7","1","sample-IOServiceClass-7","sample-IOServicePath-7","sample-IOServiceProperties-7","sample-IOServiceName-7","sample-Protocol-7","sample-ChannelDiffStatusList-7","EXAMPLE","00000000-0000-4000-8000-000000000107","S-1-5-21-100-200-300-1007","8","5","sample-EventOrigin-7","sample-AddressFamily-7","sample-BluetoothDeviceType-7","1792778820","sample-DeviceInstanceId-7","sample-BluetoothDeviceAddressType-7","sample-DeviceVersion-7","sample-DeviceDescriptorSetHash-7","sample-DeviceManufacturer-7","sample-DeviceProduct-7","S-1-5-21-100-200-300-2007","sample-DeviceUserAuthenticationId-7","sample-FirewallProfile-7","sample-ShareAccess-7","sample-DesiredAccess-7","sample-GID-7","sample-UID-7","sample-UnixMode-7","{""LocalAddressIP4"":""192.0.2.50"",""ComputerName"":""host.example.test"",""EventOrigin"":""1""}","00000000-0000-4000-8000-000000000001","CrowdStrike_Audit_Events_CL","" +"2026-10-23T18:08:00.0000000Z","FileVaultStatus","1792778880000","192.0.2.18","00000000000000000000000000000009","carol","Lin","1792778880","FileVaultStatusV1","sample-ConfigBuild-8","00000000-0000-4000-8000-000000000009","sample-ConfigStateHash-8","108","sample-ContextThreadId-8","9","sample-BoundingLimitDuration-8","sample-Entitlements-8","sample-EffectiveTransmissionClass-8","00000000000000000000000000000001","sample-OciContainerId-8","sample-TreeId-8","sample-VolumeSnapshotName-8","sample-SmbShareName-8","sample-ShareName-8","sample-UploadId-8","sample-SessionId-8","host-8.example.test","Rule-8","9","LogFilePath","C:\Audit\source-8.txt","C:\Audit\target-8.txt","sample-DeviceVendorId-8","sample-DeviceProductId-8","sample-DeviceSerialNumber-8","sample-BluetoothDeviceAddress-8","sample-EnvironmentVariableName-8","account-8","0","audit.log","True","sample-EnvironmentVariableValue-8","{""setting"":""synthetic-value""}","sample-ActiveDirectoryOuDn-8","sample-ActiveDirectoryDepartment-8","0000000000000000000000000000000000000000000000000000000000000009","sample-CommandLine-8","sample-VolumeName-8","sample-VolumeDriveLetter-8","sample-TokenType-8","sample-InterfaceGuid-8","sample-RpcClientProcessId-8","sample-InterfaceVersion-8","sample-RpcClientThreadId-8","1008","C:\Program Files\Example\process-8.exe","sample-RpcOpNum-8","sample-RpcNestingLevel-8","client-8.example.test","example.test","2001:db8::9","192.0.2.30","client-8.example.test","sample-AgentLoadFlags-8","sample-ProvisioningDuration-8","","","sample-CloudErrorCode-8","\\server-8.example.test\share-8","9","sample-ShareRemark-8","{""access"":""synthetic-permission""}","1","1","sample-LfoUploadFlags-8","9","sample-Size-8","sample-Tags-8","sample-CloudRequestId-8","0","sample-IOServiceClass-8","sample-IOServicePath-8","sample-IOServiceProperties-8","sample-IOServiceName-8","sample-Protocol-8","sample-ChannelDiffStatusList-8","EXAMPLE","00000000-0000-4000-8000-000000000108","S-1-5-21-100-200-300-1008","9","","sample-EventOrigin-8","sample-AddressFamily-8","sample-BluetoothDeviceType-8","1792778880","sample-DeviceInstanceId-8","sample-BluetoothDeviceAddressType-8","sample-DeviceVersion-8","sample-DeviceDescriptorSetHash-8","sample-DeviceManufacturer-8","sample-DeviceProduct-8","S-1-5-21-100-200-300-2008","sample-DeviceUserAuthenticationId-8","sample-FirewallProfile-8","sample-ShareAccess-8","sample-DesiredAccess-8","sample-GID-8","sample-UID-8","sample-UnixMode-8","{""LocalAddressIP4"":""192.0.2.50"",""ComputerName"":""host.example.test"",""EventOrigin"":""1""}","00000000-0000-4000-8000-000000000001","CrowdStrike_Audit_Events_CL","" +"2026-10-23T18:09:00.0000000Z","FirewallEnabled","1792778940000","192.0.2.19","0000000000000000000000000000000a","alice@example.test","Win","1792778940","FirewallEnabledV1","sample-ConfigBuild-9","00000000-0000-4000-8000-000000000010","sample-ConfigStateHash-9","109","sample-ContextThreadId-9","10","sample-BoundingLimitDuration-9","sample-Entitlements-9","sample-EffectiveTransmissionClass-9","00000000000000000000000000000001","sample-OciContainerId-9","sample-TreeId-9","sample-VolumeSnapshotName-9","sample-SmbShareName-9","sample-ShareName-9","sample-UploadId-9","sample-SessionId-9","host-9.example.test","Rule-9","10","EnableFirewall","C:\Audit\source-9.txt","C:\Audit\target-9.txt","sample-DeviceVendorId-9","sample-DeviceProductId-9","sample-DeviceSerialNumber-9","sample-BluetoothDeviceAddress-9","sample-EnvironmentVariableName-9","account-9","1","true","False","sample-EnvironmentVariableValue-9","{""setting"":""synthetic-value""}","sample-ActiveDirectoryOuDn-9","sample-ActiveDirectoryDepartment-9","000000000000000000000000000000000000000000000000000000000000000a","sample-CommandLine-9","sample-VolumeName-9","sample-VolumeDriveLetter-9","sample-TokenType-9","sample-InterfaceGuid-9","sample-RpcClientProcessId-9","sample-InterfaceVersion-9","sample-RpcClientThreadId-9","1009","C:\Program Files\Example\process-9.exe","sample-RpcOpNum-9","sample-RpcNestingLevel-9","client-9.example.test","example.test","2001:db8::10","198.51.100.10","client-9.example.test","sample-AgentLoadFlags-9","sample-ProvisioningDuration-9","Success","","sample-CloudErrorCode-9","\\server-9.example.test\share-9","10","sample-ShareRemark-9","{""access"":""synthetic-permission""}","2","1","sample-LfoUploadFlags-9","10","sample-Size-9","sample-Tags-9","sample-CloudRequestId-9","1","sample-IOServiceClass-9","sample-IOServicePath-9","sample-IOServiceProperties-9","sample-IOServiceName-9","sample-Protocol-9","sample-ChannelDiffStatusList-9","EXAMPLE","00000000-0000-4000-8000-000000000109","S-1-5-21-100-200-300-1009","10","0","sample-EventOrigin-9","sample-AddressFamily-9","sample-BluetoothDeviceType-9","1792778940","sample-DeviceInstanceId-9","sample-BluetoothDeviceAddressType-9","sample-DeviceVersion-9","sample-DeviceDescriptorSetHash-9","sample-DeviceManufacturer-9","sample-DeviceProduct-9","S-1-5-21-100-200-300-2009","sample-DeviceUserAuthenticationId-9","sample-FirewallProfile-9","sample-ShareAccess-9","sample-DesiredAccess-9","sample-GID-9","sample-UID-9","sample-UnixMode-9","{""LocalAddressIP4"":""192.0.2.50"",""ComputerName"":""host.example.test"",""EventOrigin"":""1""}","00000000-0000-4000-8000-000000000001","CrowdStrike_Audit_Events_CL",""