diff --git a/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_Auth_Events_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_Auth_Events_CL.json index 1e6bdb03c53..dd508c968ee 100644 --- a/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_Auth_Events_CL.json +++ b/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_Auth_Events_CL.json @@ -248,6 +248,10 @@ { "name": "AdditionalFields", "type": "dynamic" + }, + { + "name": "Type", + "type": "string" } ] } \ No newline at end of file diff --git a/Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json b/Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json index 60b57727b90..c865e82db17 100644 --- a/Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json +++ b/Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json @@ -27,7 +27,7 @@ "displayName": "Authentication ASIM parser", "category": "ASIM", "FunctionAlias": "ASimAuthentication", - "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet ASimAuthenticationDisabled=toscalar('ExcludeASimAuthentication' in (DisabledParsers) or 'Any' in (DisabledParsers));\nunion isfuzzy=true\n vimAuthenticationEmpty,\n ASimAuthenticationAADManagedIdentitySignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADNonInteractiveUserSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADServicePrincipalSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAWSCloudTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAWSCloudTrail' in (DisabledParsers) )),\n ASimAuthenticationBarracudaWAF (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationBarracudaWAF' in (DisabledParsers) )),\n ASimAuthenticationCiscoASA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoASA' in (DisabledParsers) )),\n ASimAuthenticationCiscoDNAC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoDNAC' in (DisabledParsers) )),\n ASimAuthenticationCiscoFTD (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoFTD' in (DisabledParsers) )),\n ASimAuthenticationCiscoIOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoIOS' in (DisabledParsers) )),\n ASimAuthenticationCiscoISE (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISE' in (DisabledParsers) )),\n ASimAuthenticationCiscoISEAdministrator (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISEAdministrator' in (DisabledParsers) ),pack=pack),\n ASimAuthenticationCiscoMeraki (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMeraki' in (DisabledParsers) )),\n ASimAuthenticationCiscoMerakiSyslog (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )),\n ASimAuthenticationFortinetFortigate (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationFortigate' in (DisabledParsers) )),\n ASimAuthenticationM365Defender (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationM365Defender' in (DisabledParsers) )),\n ASimAuthenticationMD4IoT (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMD4IoT' in (DisabledParsers) )),\n ASimAuthenticationMicrosoftWindowsEvent (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )),\n ASimAuthenticationOktaSSO (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSSO' in (DisabledParsers) )),\n ASimAuthenticationOktaV2(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaV2' in (DisabledParsers) )),\n ASimAuthenticationOktaSystemLogs(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSystemLogs' in (DisabledParsers) )),\n ASimAuthenticationPostgreSQL (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPostgreSQL' in (DisabledParsers) )),\n ASimAuthenticationSigninLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSigninLogs' in (DisabledParsers) )),\n ASimAuthenticationSshd (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSshd' in (DisabledParsers) )),\n ASimAuthenticationSu (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSu' in (DisabledParsers) )),\n ASimAuthenticationSudo (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSudo' in (DisabledParsers) )),\n ASimAuthenticationSalesforceSC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceSC' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationSalesforceLoginHistory (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceLoginHistory' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationVectraXDRAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVectraXDRAudit' in (DisabledParsers) )),\n ASimAuthenticationSentinelOne (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSentinelOne' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspace (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspace' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspaceLogins (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspaceLogins' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoCortexDataLake (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )),\n ASimAuthenticationVMwareCarbonBlackCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )),\n ASimAuthenticationVMwareVCenter (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareVCenter' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalcon' in (DisabledParsers) )),\n ASimAuthenticationIllumioSaaSCore (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationIllumioSaaS' in (DisabledParsers) )),\n ASimAuthenticationNative (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationNative' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoPanOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPanOS' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationPaloAltoGlobalProtect (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationVMwareESXi (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareESXi' in (DisabledParsers)), pack=pack),\n ASimAuthenticationPaloAltoPrismaCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPrismaCloud' in (DisabledParsers)), pack=pack),\n ASimAuthenticationAlibabaCloudActionTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAlibabaCloudActionTrail' in (DisabledParsers)), pack=pack),\n ASimAuthenticationWizCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationWizCloud' in (DisabledParsers)), pack=pack),\n ASimAuthenticationOracleOCI (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOracleOCI' in (DisabledParsers)), pack=pack),\n ASimAuthenticationArubaNetworksClearPass (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationArubaNetworksClearPass' in (DisabledParsers)), pack=pack),\n ASimAuthenticationCyberArkAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCyberArkAudit' in (DisabledParsers)), pack=pack),\n ASimAuthenticationZscalerZPA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationZscalerZPA' in (DisabledParsers)), pack=pack)\n , ASimAuthenticationOktaAuth0 (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaAuth0' in (DisabledParsers)), pack=pack)\n", + "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet ASimAuthenticationDisabled=toscalar('ExcludeASimAuthentication' in (DisabledParsers) or 'Any' in (DisabledParsers));\nunion isfuzzy=true\n vimAuthenticationEmpty,\n ASimAuthenticationAADManagedIdentitySignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADNonInteractiveUserSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADServicePrincipalSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAWSCloudTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAWSCloudTrail' in (DisabledParsers) )),\n ASimAuthenticationBarracudaWAF (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationBarracudaWAF' in (DisabledParsers) )),\n ASimAuthenticationCiscoASA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoASA' in (DisabledParsers) )),\n ASimAuthenticationCiscoDNAC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoDNAC' in (DisabledParsers) )),\n ASimAuthenticationCiscoFTD (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoFTD' in (DisabledParsers) )),\n ASimAuthenticationCiscoIOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoIOS' in (DisabledParsers) )),\n ASimAuthenticationCiscoISE (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISE' in (DisabledParsers) )),\n ASimAuthenticationCiscoISEAdministrator (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISEAdministrator' in (DisabledParsers) ),pack=pack),\n ASimAuthenticationCiscoMeraki (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMeraki' in (DisabledParsers) )),\n ASimAuthenticationCiscoMerakiSyslog (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )),\n ASimAuthenticationFortinetFortigate (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationFortinetFortigate' in (DisabledParsers) )),\n ASimAuthenticationM365Defender (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationM365Defender' in (DisabledParsers) )),\n ASimAuthenticationMD4IoT (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMD4IoT' in (DisabledParsers) )),\n ASimAuthenticationMicrosoftWindowsEvent (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )),\n ASimAuthenticationOktaSSO (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSSO' in (DisabledParsers) )),\n ASimAuthenticationOktaV2(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaV2' in (DisabledParsers) )),\n ASimAuthenticationOktaSystemLogs(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSystemLogs' in (DisabledParsers) )),\n ASimAuthenticationPostgreSQL (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPostgreSQL' in (DisabledParsers) )),\n ASimAuthenticationSigninLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSigninLogs' in (DisabledParsers) )),\n ASimAuthenticationSshd (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSshd' in (DisabledParsers) )),\n ASimAuthenticationSu (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSu' in (DisabledParsers) )),\n ASimAuthenticationSudo (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSudo' in (DisabledParsers) )),\n ASimAuthenticationSalesforceSC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceSC' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationSalesforceLoginHistory (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceLoginHistory' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationVectraXDRAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVectraXDRAudit' in (DisabledParsers) )),\n ASimAuthenticationSentinelOne (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSentinelOne' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspace (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspace' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspaceLogins (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspaceLogins' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoCortexDataLake (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )),\n ASimAuthenticationVMwareCarbonBlackCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )),\n ASimAuthenticationVMwareVCenter (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareVCenter' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )),\n ASimAuthenticationCrowdStrikeFalconDataReplicator (disabled=(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack),\n ASimAuthenticationIllumioSaaSCore (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationIllumioSaaSCore' in (DisabledParsers) )),\n ASimAuthenticationNative (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationNative' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoPanOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPanOS' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationPaloAltoGlobalProtect (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationVMwareESXi (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareESXi' in (DisabledParsers)), pack=pack),\n ASimAuthenticationPaloAltoPrismaCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPrismaCloud' in (DisabledParsers)), pack=pack),\n ASimAuthenticationAlibabaCloudActionTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAlibabaCloudActionTrail' in (DisabledParsers)), pack=pack),\n ASimAuthenticationWizCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationWizCloud' in (DisabledParsers)), pack=pack),\n ASimAuthenticationOracleOCI (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOracleOCI' in (DisabledParsers)), pack=pack),\n ASimAuthenticationArubaNetworksClearPass (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationArubaNetworksClearPass' in (DisabledParsers)), pack=pack),\n ASimAuthenticationCyberArkAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCyberArkAudit' in (DisabledParsers)), pack=pack),\n ASimAuthenticationZscalerZPA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationZscalerZPA' in (DisabledParsers)), pack=pack),\n ASimAuthenticationOktaAuth0 (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaAuth0' in (DisabledParsers)), pack=pack)\n", "version": 1, "functionParameters": "pack:bool=False" } diff --git a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/ASimAuthenticationCrowdStrikeFalconDataReplicator.json b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/ASimAuthenticationCrowdStrikeFalconDataReplicator.json new file mode 100644 index 00000000000..a28b27c5f57 --- /dev/null +++ b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/ASimAuthenticationCrowdStrikeFalconDataReplicator.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/ASimAuthenticationCrowdStrikeFalconDataReplicator')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "Authentication ASIM parser for CrowdStrike Falcon Data Replicator", + "category": "ASIM", + "FunctionAlias": "ASimAuthenticationCrowdStrikeFalconDataReplicator", + "query": "let parser = (disabled:bool = false, pack:bool = false) {\n CrowdStrike_Auth_Events_CL\n | where not(disabled)\n | extend SourceFields = iff(pack, pack_all(), dynamic({}))\n | extend\n EventType = iff(event_simpleName startswith \"UserLogoff\", \"Logoff\", \"Logon\"),\n EventResult = iff(event_simpleName startswith \"UserLogonFailed\", \"Failure\", \"Success\"),\n EventOriginalSubType = LogonType,\n EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat(\"/\", SubStatus), \"\")),\n EventStartTime = coalesce(\n unixtime_seconds_todatetime(ContextTimeStamp),\n unixtime_milliseconds_todatetime(timestamp),\n unixtime_seconds_todatetime(iff(event_simpleName startswith \"UserLogoff\", LogoffTime, LogonTime)),\n TimeGenerated),\n DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip),\n ComputerName = tostring(AdditionalFields.ComputerName),\n SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6),\n TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains \"\\\\\" and UserName !contains \"@\", strcat(LogonDomain, \"\\\\\", UserName), UserName)),\n TargetUserId = coalesce(UserSid, UID),\n TargetUserIdType = case(isnotempty(UserSid), \"SID\", isnotempty(UID), \"UID\", \"\"),\n TargetUserType = case(UserIsAdmin == \"1\", \"Admin\", UserIsAdmin == \"0\", \"Regular\", \"\"),\n TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId),\n DvcOs = case(event_platform =~ \"Win\", \"Windows\", event_platform =~ \"Mac\", \"macOS\", event_platform =~ \"Lin\", \"Linux\", event_platform)\n | extend\n EventEndTime = EventStartTime,\n EventSubType = case(LogonType == \"0\", \"System\", LogonType in (\"2\", \"7\", \"11\"), \"Interactive\", LogonType == \"3\", \"Remote\", LogonType == \"5\", \"Service\", LogonType == \"8\", \"NetworkCleartext\", LogonType == \"10\", \"RemoteInteractive\", \"\"),\n EventResultDetails = iff(EventResult == \"Failure\", \"Other\", \"\"),\n TargetUsernameType = case(TargetUsername contains \"@\", \"UPN\", TargetUsername contains \"\\\\\", \"Windows\", isnotempty(TargetUsername), \"Simple\", \"\"),\n DvcHostname = iff(tostring(split(ComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ComputerName, \".\")[0]), \"\"),\n DvcDomain = iff(ComputerName contains \".\", substring(ComputerName, indexof(ComputerName, \".\") + 1), \"\"),\n DvcFQDN = iff(ComputerName contains \".\", ComputerName, \"\"),\n SrcHostname = iff(tostring(split(ClientComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ClientComputerName, \".\")[0]), \"\"),\n SrcDomain = iff(ClientComputerName contains \".\", substring(ClientComputerName, indexof(ClientComputerName, \".\") + 1), \"\"),\n SrcFQDN = iff(ClientComputerName contains \".\", ClientComputerName, \"\")\n | project-rename\n EventOriginalType = event_simpleName,\n DvcId = aid,\n DvcScopeId = cid,\n TargetUserSid = UserSid,\n TargetUserUid = UID,\n TargetUserUpn = UserPrincipal,\n TargetUserScope = LogonDomain,\n TargetOriginalUserType = UserIsAdmin,\n LogonProtocol = AuthenticationPackage\n | extend\n Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName),\n DvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcDomainType = iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname),\n TargetHostname = DvcHostname,\n TargetDomain = DvcDomain,\n TargetDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n TargetFQDN = DvcFQDN,\n TargetDvcId = DvcId,\n TargetDvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n TargetIpAddr = DvcIpAddr,\n TargetDvcOs = DvcOs,\n TargetDvcScopeId = DvcScopeId,\n EventCount = int(1),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon Data Replicator\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = \"Informational\",\n DvcEntityKey = \"\",\n ActorUserEntityKey = \"\",\n ActorUserAdditionalIds = dynamic([]),\n TargetUserEntityKey = \"\",\n TargetUserAdditionalIds = dynamic([]),\n SrcSystemEntityKey = \"\",\n TargetSystemEntityKey = \"\",\n ActingApplicationEntityKey = \"\",\n TargetApplicationEntityKey = \"\",\n AdditionalEntities = dynamic([]),\n AdditionalFields = SourceFields\n | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n EventType, EventSubType, EventResult, EventResultDetails,\n EventOriginalType, EventOriginalSubType, EventOriginalResultDetails,\n Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType,\n DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey,\n Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN,\n TargetHostname, TargetDomain, TargetDomainType, TargetFQDN,\n TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId,\n TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType,\n TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope,\n TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol,\n Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds,\n TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey,\n TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey,\n AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n", + "version": 1, + "functionParameters": "disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/README.md b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/README.md new file mode 100644 index 00000000000..3b6c9bc09ef --- /dev/null +++ b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/README.md @@ -0,0 +1,22 @@ +# CrowdStrike Falcon Data Replicator ASIM Authentication Normalization Parser + +ARM template for ASIM Authentication schema parser for CrowdStrike Falcon Data Replicator. + +Normalizes CrowdStrike Falcon Data Replicator authentication events from CrowdStrike_Auth_Events_CL to the ASIM Authentication schema. +This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. + + +The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. + +For more information, see: + +- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) +- [Deploy all of ASIM](https://aka.ms/DeployASIM) +- [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc) + +For the changelog, see: +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalconDataReplicator.md) + +
+ +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationCrowdStrikeFalconDataReplicator%2FASimAuthenticationCrowdStrikeFalconDataReplicator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationCrowdStrikeFalconDataReplicator%2FASimAuthenticationCrowdStrikeFalconDataReplicator.json) diff --git a/Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json b/Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json index cbbc4dc500b..e29849357f0 100644 --- a/Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json +++ b/Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json @@ -358,6 +358,26 @@ } } }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "linkedASimAuthenticationCrowdStrikeFalconDataReplicator", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/ASimAuthenticationCrowdStrikeFalconDataReplicator.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "Workspace": { + "value": "[parameters('Workspace')]" + }, + "WorkspaceRegion": { + "value": "[parameters('WorkspaceRegion')]" + } + } + } + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", @@ -1338,6 +1358,26 @@ } } }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "linkedvimAuthenticationCrowdStrikeFalconDataReplicator", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/vimAuthenticationCrowdStrikeFalconDataReplicator.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "Workspace": { + "value": "[parameters('Workspace')]" + }, + "WorkspaceRegion": { + "value": "[parameters('WorkspaceRegion')]" + } + } + } + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", diff --git a/Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json b/Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json index ba846d0f9b1..a20d64cd7a6 100644 --- a/Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json +++ b/Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json @@ -27,7 +27,7 @@ "displayName": "Authentication ASIM filtering parser", "category": "ASIM", "FunctionAlias": "imAuthentication", - "query": "let Generic=(starttime: datetime=datetime(null), endtime: datetime=datetime(null), username_has_any: dynamic = dynamic([]), targetappname_has_any: dynamic = dynamic([]), srcipaddr_has_any_prefix: dynamic = dynamic([]), srchostname_has_any: dynamic = dynamic([]), eventtype_in: dynamic = dynamic([]), eventresultdetails_in: dynamic = dynamic([]), eventresult: string = '*', pack: bool=false) {\n let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\n let imAuthenticationBuiltInDisabled=toscalar('ExcludeimAuthenticationBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers));\n union isfuzzy=true\n vimAuthenticationEmpty\n , vimAuthenticationAADManagedIdentitySignInLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )))\n , vimAuthenticationAADNonInteractiveUserSignInLogs(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )))\n , vimAuthenticationAADServicePrincipalSignInLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )))\n , vimAuthenticationSigninLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSigninLogs' in (DisabledParsers) )))\n , vimAuthenticationAWSCloudTrail (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled = (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAWSCloudTrail' in (DisabledParsers) )))\n , vimAuthenticationOktaSSO (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaSSO' in (DisabledParsers) )))\n , vimAuthenticationOktaSystemLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaSystemLogs' in (DisabledParsers) )))\n , vimAuthenticationOktaV2 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaV2' in (DisabledParsers) )))\n , vimAuthenticationM365Defender (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationM365Defender' in (DisabledParsers) )))\n , vimAuthenticationMicrosoftWindowsEvent (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )))\n , vimAuthenticationMD4IoT (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationMD4IoT' in (DisabledParsers) )))\n , vimAuthenticationPostgreSQL (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPostgreSQL' in (DisabledParsers) )))\n , vimAuthenticationSshd (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSshd' in (DisabledParsers) )))\n , vimAuthenticationSu (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSu' in (DisabledParsers) )))\n , vimAuthenticationSudo (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSudo' in (DisabledParsers) )))\n , vimAuthenticationCiscoASA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoASA' in (DisabledParsers) )))\n , vimAuthenticationCiscoDNAC (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoDNAC' in (DisabledParsers) )))\n , vimAuthenticationCiscoFTD (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoFTD' in (DisabledParsers) )))\n , vimAuthenticationCiscoMeraki (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoMeraki' in (DisabledParsers) )))\n , vimAuthenticationCiscoMerakiSyslog (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )))\n , vimAuthenticationCiscoIOS (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoIOS' in (DisabledParsers) )))\n , vimAuthenticationCiscoISE (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoISE' in (DisabledParsers) )))\n , vimAuthenticationCiscoISEAdministrator (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoISEAdministrator' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationBarracudaWAF (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationBarracudaWAF' in (DisabledParsers) )))\n , vimAuthenticationVectraXDRAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVectraXDRAudit' in (DisabledParsers) )))\n , vimAuthenticationGoogleWorkspace (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationGoogleWorkspace' in (DisabledParsers) )))\n , vimAuthenticationGoogleWorkspaceLogins (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationGoogleWorkspaceLogins' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationSalesforceSC (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSalesforceSC' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationSalesforceLoginHistory (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSalesforceLoginHistory' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoCortexDataLake (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )))\n , vimAuthenticationSentinelOne (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSentinelOne' in (DisabledParsers) )))\n , vimAuthenticationCrowdStrikeFalconHost (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )))\n , vimAuthenticationVMwareCarbonBlackCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )))\n , vimAuthenticationVMwareVCenter (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationIllumioSaaSCore (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationIllumioSaaS' in (DisabledParsers) )))\n , vimAuthenticationNative (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationNative' in (DisabledParsers) )))\n , vimAuthenticationFortinetFortigate (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationFortigate' in (DisabledParsers) )))\n , vimAuthenticationVMwareESXi (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareESXi' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoPanOS (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoPanOS' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoGlobalProtect (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoPrismaCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoPrismaCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationAlibabaCloudActionTrail (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAlibabaCloudActionTrail' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationWizCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationWizCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationOracleOCI (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOracleOCI' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationArubaNetworksClearPass (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationArubaNetworksClearPass' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationCyberArkAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCyberArkAudit' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationZscalerZPA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationZscalerZPA' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationOktaAuth0 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaAuth0' in (DisabledParsers) )), pack=pack)\n};\nGeneric(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, pack=pack)\n", + "query": "let Generic=(starttime: datetime=datetime(null), endtime: datetime=datetime(null), username_has_any: dynamic = dynamic([]), targetappname_has_any: dynamic = dynamic([]), srcipaddr_has_any_prefix: dynamic = dynamic([]), srchostname_has_any: dynamic = dynamic([]), eventtype_in: dynamic = dynamic([]), eventresultdetails_in: dynamic = dynamic([]), eventresult: string = '*', pack: bool=false) {\n let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\n let imAuthenticationBuiltInDisabled=toscalar('ExcludeimAuthenticationBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers));\n union isfuzzy=true\n vimAuthenticationEmpty\n , vimAuthenticationAADManagedIdentitySignInLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )))\n , vimAuthenticationAADNonInteractiveUserSignInLogs(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )))\n , vimAuthenticationAADServicePrincipalSignInLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )))\n , vimAuthenticationSigninLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSigninLogs' in (DisabledParsers) )))\n , vimAuthenticationAWSCloudTrail (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled = (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAWSCloudTrail' in (DisabledParsers) )))\n , vimAuthenticationOktaSSO (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaSSO' in (DisabledParsers) )))\n , vimAuthenticationOktaSystemLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaSystemLogs' in (DisabledParsers) )))\n , vimAuthenticationOktaV2 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaV2' in (DisabledParsers) )))\n , vimAuthenticationM365Defender (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationM365Defender' in (DisabledParsers) )))\n , vimAuthenticationMicrosoftWindowsEvent (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )))\n , vimAuthenticationMD4IoT (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationMD4IoT' in (DisabledParsers) )))\n , vimAuthenticationPostgreSQL (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPostgreSQL' in (DisabledParsers) )))\n , vimAuthenticationSshd (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSshd' in (DisabledParsers) )))\n , vimAuthenticationSu (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSu' in (DisabledParsers) )))\n , vimAuthenticationSudo (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSudo' in (DisabledParsers) )))\n , vimAuthenticationCiscoASA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoASA' in (DisabledParsers) )))\n , vimAuthenticationCiscoDNAC (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoDNAC' in (DisabledParsers) )))\n , vimAuthenticationCiscoFTD (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoFTD' in (DisabledParsers) )))\n , vimAuthenticationCiscoMeraki (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoMeraki' in (DisabledParsers) )))\n , vimAuthenticationCiscoMerakiSyslog (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )))\n , vimAuthenticationCiscoIOS (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoIOS' in (DisabledParsers) )))\n , vimAuthenticationCiscoISE (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoISE' in (DisabledParsers) )))\n , vimAuthenticationCiscoISEAdministrator (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoISEAdministrator' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationBarracudaWAF (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationBarracudaWAF' in (DisabledParsers) )))\n , vimAuthenticationVectraXDRAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVectraXDRAudit' in (DisabledParsers) )))\n , vimAuthenticationGoogleWorkspace (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationGoogleWorkspace' in (DisabledParsers) )))\n , vimAuthenticationGoogleWorkspaceLogins (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationGoogleWorkspaceLogins' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationSalesforceSC (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSalesforceSC' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationSalesforceLoginHistory (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSalesforceLoginHistory' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoCortexDataLake (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )))\n , vimAuthenticationSentinelOne (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSentinelOne' in (DisabledParsers) )))\n , vimAuthenticationCrowdStrikeFalconHost (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )))\n , vimAuthenticationVMwareCarbonBlackCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )))\n , vimAuthenticationVMwareVCenter (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationIllumioSaaSCore (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationIllumioSaaS' in (DisabledParsers) )))\n , vimAuthenticationNative (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationNative' in (DisabledParsers) )))\n , vimAuthenticationFortinetFortigate (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationFortigate' in (DisabledParsers) )))\n , vimAuthenticationVMwareESXi (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareESXi' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoPanOS (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoPanOS' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoGlobalProtect (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoPrismaCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoPrismaCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationAlibabaCloudActionTrail (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAlibabaCloudActionTrail' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationWizCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationWizCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationOracleOCI (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOracleOCI' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationArubaNetworksClearPass (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationArubaNetworksClearPass' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationCyberArkAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCyberArkAudit' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationZscalerZPA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationZscalerZPA' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationOktaAuth0 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaAuth0' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationCrowdStrikeFalconDataReplicator (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled=(imAuthenticationBuiltInDisabled or ('ExcludevimAuthenticationCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack)\n};\nGeneric(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, pack=pack)\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),username_has_any:dynamic=dynamic([]),targetappname_has_any:dynamic=dynamic([]),srcipaddr_has_any_prefix:dynamic=dynamic([]),srchostname_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresultdetails_in:dynamic=dynamic([]),eventresult:string='*',pack:bool=False" } diff --git a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/README.md b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/README.md new file mode 100644 index 00000000000..0e0c8ae4629 --- /dev/null +++ b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/README.md @@ -0,0 +1,22 @@ +# CrowdStrike Falcon Data Replicator ASIM Authentication Normalization Parser + +ARM template for ASIM Authentication schema parser for CrowdStrike Falcon Data Replicator. + +Filters and normalizes CrowdStrike Falcon Data Replicator authentication events from CrowdStrike_Auth_Events_CL to the ASIM Authentication schema. +This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. + + +The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. + +For more information, see: + +- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) +- [Deploy all of ASIM](https://aka.ms/DeployASIM) +- [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc) + +For the changelog, see: +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalconDataReplicator.md) + +
+ +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationCrowdStrikeFalconDataReplicator%2FvimAuthenticationCrowdStrikeFalconDataReplicator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationCrowdStrikeFalconDataReplicator%2FvimAuthenticationCrowdStrikeFalconDataReplicator.json) diff --git a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/vimAuthenticationCrowdStrikeFalconDataReplicator.json b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/vimAuthenticationCrowdStrikeFalconDataReplicator.json new file mode 100644 index 00000000000..de09d1387e9 --- /dev/null +++ b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/vimAuthenticationCrowdStrikeFalconDataReplicator.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/vimAuthenticationCrowdStrikeFalconDataReplicator')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "Authentication ASIM filtering parser for CrowdStrike Falcon Data Replicator", + "category": "ASIM", + "FunctionAlias": "vimAuthenticationCrowdStrikeFalconDataReplicator", + "query": "let parser = (\n starttime:datetime = datetime(null),\n endtime:datetime = datetime(null),\n srcipaddr_has_any_prefix:dynamic = dynamic([]),\n srchostname_has_any:dynamic = dynamic([]),\n username_has_any:dynamic = dynamic([]),\n targetappname_has_any:dynamic = dynamic([]),\n eventtype_in:dynamic = dynamic([]),\n eventresult:string = \"*\",\n eventresultdetails_in:dynamic = dynamic([]),\n disabled:bool = false,\n pack:bool = false\n) {\n CrowdStrike_Auth_Events_CL\n | where not(disabled)\n // This source has no target application name; an active application filter cannot match.\n | where array_length(targetappname_has_any) == 0\n | where array_length(eventtype_in) == 0\n or (event_simpleName startswith \"UserLogoff\" and \"Logoff\" in~ (eventtype_in))\n or (event_simpleName !startswith \"UserLogoff\" and \"Logon\" in~ (eventtype_in))\n | where eventresult == \"*\"\n or (event_simpleName startswith \"UserLogonFailed\" and eventresult =~ \"Failure\")\n or (event_simpleName !startswith \"UserLogonFailed\" and eventresult =~ \"Success\")\n | extend SourceFields = iff(pack, pack_all(), dynamic({}))\n | extend EventStartTime = coalesce(\n unixtime_seconds_todatetime(ContextTimeStamp),\n unixtime_milliseconds_todatetime(timestamp),\n unixtime_seconds_todatetime(iff(event_simpleName startswith \"UserLogoff\", LogoffTime, LogonTime)),\n TimeGenerated)\n | where (isnull(starttime) or EventStartTime >= starttime)\n and (isnull(endtime) or EventStartTime <= endtime)\n | extend SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6)\n | where array_length(srcipaddr_has_any_prefix) == 0\n or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix)\n or SrcIpAddr in~ (srcipaddr_has_any_prefix)\n | extend TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains \"\\\\\" and UserName !contains \"@\", strcat(LogonDomain, \"\\\\\", UserName), UserName))\n | where array_length(username_has_any) == 0 or TargetUsername has_any (username_has_any)\n | extend SrcHostname = iff(tostring(split(ClientComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ClientComputerName, \".\")[0]), \"\")\n | where array_length(srchostname_has_any) == 0 or SrcHostname has_any (srchostname_has_any)\n | extend EventResultDetails = iff(event_simpleName startswith \"UserLogonFailed\", \"Other\", \"\")\n | where array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in)\n | extend\n EventType = iff(event_simpleName startswith \"UserLogoff\", \"Logoff\", \"Logon\"),\n EventResult = iff(event_simpleName startswith \"UserLogonFailed\", \"Failure\", \"Success\"),\n EventOriginalSubType = LogonType,\n EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat(\"/\", SubStatus), \"\")),\n DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip),\n ComputerName = tostring(AdditionalFields.ComputerName),\n TargetUserId = coalesce(UserSid, UID),\n TargetUserIdType = case(isnotempty(UserSid), \"SID\", isnotempty(UID), \"UID\", \"\"),\n TargetUserType = case(UserIsAdmin == \"1\", \"Admin\", UserIsAdmin == \"0\", \"Regular\", \"\"),\n TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId),\n DvcOs = case(event_platform =~ \"Win\", \"Windows\", event_platform =~ \"Mac\", \"macOS\", event_platform =~ \"Lin\", \"Linux\", event_platform)\n | extend\n EventEndTime = EventStartTime,\n EventSubType = case(LogonType == \"0\", \"System\", LogonType in (\"2\", \"7\", \"11\"), \"Interactive\", LogonType == \"3\", \"Remote\", LogonType == \"5\", \"Service\", LogonType == \"8\", \"NetworkCleartext\", LogonType == \"10\", \"RemoteInteractive\", \"\"),\n TargetUsernameType = case(TargetUsername contains \"@\", \"UPN\", TargetUsername contains \"\\\\\", \"Windows\", isnotempty(TargetUsername), \"Simple\", \"\"),\n DvcHostname = iff(tostring(split(ComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ComputerName, \".\")[0]), \"\"),\n DvcDomain = iff(ComputerName contains \".\", substring(ComputerName, indexof(ComputerName, \".\") + 1), \"\"),\n DvcFQDN = iff(ComputerName contains \".\", ComputerName, \"\"),\n SrcDomain = iff(ClientComputerName contains \".\", substring(ClientComputerName, indexof(ClientComputerName, \".\") + 1), \"\"),\n SrcFQDN = iff(ClientComputerName contains \".\", ClientComputerName, \"\")\n | project-rename\n EventOriginalType = event_simpleName,\n DvcId = aid,\n DvcScopeId = cid,\n TargetUserSid = UserSid,\n TargetUserUid = UID,\n TargetUserUpn = UserPrincipal,\n TargetUserScope = LogonDomain,\n TargetOriginalUserType = UserIsAdmin,\n LogonProtocol = AuthenticationPackage\n | extend\n Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName),\n DvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcDomainType = iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname),\n TargetHostname = DvcHostname,\n TargetDomain = DvcDomain,\n TargetDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n TargetFQDN = DvcFQDN,\n TargetDvcId = DvcId,\n TargetDvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n TargetIpAddr = DvcIpAddr,\n TargetDvcOs = DvcOs,\n TargetDvcScopeId = DvcScopeId,\n EventCount = int(1),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon Data Replicator\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = \"Informational\",\n DvcEntityKey = \"\",\n ActorUserEntityKey = \"\",\n ActorUserAdditionalIds = dynamic([]),\n TargetUserEntityKey = \"\",\n TargetUserAdditionalIds = dynamic([]),\n SrcSystemEntityKey = \"\",\n TargetSystemEntityKey = \"\",\n ActingApplicationEntityKey = \"\",\n TargetApplicationEntityKey = \"\",\n AdditionalEntities = dynamic([]),\n AdditionalFields = SourceFields\n | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n EventType, EventSubType, EventResult, EventResultDetails,\n EventOriginalType, EventOriginalSubType, EventOriginalResultDetails,\n Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType,\n DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey,\n Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN,\n TargetHostname, TargetDomain, TargetDomainType, TargetFQDN,\n TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId,\n TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType,\n TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope,\n TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol,\n Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds,\n TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey,\n TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey,\n AdditionalEntities, AdditionalFields\n};\nparser(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, eventtype_in=eventtype_in, eventresult=eventresult, eventresultdetails_in=eventresultdetails_in, disabled=disabled, pack=pack)\n", + "version": 1, + "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr_has_any_prefix:dynamic=dynamic([]),srchostname_has_any:dynamic=dynamic([]),username_has_any:dynamic=dynamic([]),targetappname_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresult:string='*',eventresultdetails_in:dynamic=dynamic([]),disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md index f3e2b8464d0..1bc6b360a83 100644 --- a/Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md +++ b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md @@ -1,5 +1,9 @@ # Changelog for ASimAuthentication.yaml +## Version 0.2.29 + +- (2026-10-23) Add the CrowdStrike Falcon Data Replicator Authentication parser, including disable-watchlist and pack parameter support. - [PR #15415](https://github.com/Azure/Azure-Sentinel/pull/15415) + ## Version 0.2.28 - (2026-10-13) Add the Okta Auth0 Authentication parser. [PR #15254](https://github.com/Azure/Azure-Sentinel/pull/15254) diff --git a/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalconDataReplicator.md b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalconDataReplicator.md new file mode 100644 index 00000000000..7c60abcf125 --- /dev/null +++ b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalconDataReplicator.md @@ -0,0 +1,9 @@ +# Changelog for ASimAuthenticationCrowdStrikeFalconDataReplicator.yaml + +## Version 0.1.0 + +- (2026-10-23) Initial CrowdStrike Falcon Data Replicator Authentication parser for CrowdStrike_Auth_Events_CL. - [PR #15415](https://github.com/Azure/Azure-Sentinel/pull/15415) +- Normalize supported logon, failed logon, and logoff events, including versioned event-name fallbacks. +- Map available identity, device, address, protocol, and session fields, including columns empty in the initial source sample. +- Preserve all original columns with pack=true without decoding undocumented flags or status codes. +- Use Falcon Data Replicator consistently in product metadata, parser names, and built-in aliases. diff --git a/Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md b/Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md index 1cd3bc69919..444d3a3d033 100644 --- a/Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md +++ b/Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md @@ -1,5 +1,9 @@ # Changelog for imAuthentication.yaml +## Version 0.3.25 + +- (2026-10-23) Add the CrowdStrike Falcon Data Replicator Authentication filtering parser and forward all supported filtering and pack parameters. - [PR #15415](https://github.com/Azure/Azure-Sentinel/pull/15415) + ## Version 0.3.24 - (2026-10-13) Add the Okta Auth0 Authentication parser. [PR #15254](https://github.com/Azure/Azure-Sentinel/pull/15254) diff --git a/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalconDataReplicator.md b/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalconDataReplicator.md new file mode 100644 index 00000000000..faa5399a15f --- /dev/null +++ b/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalconDataReplicator.md @@ -0,0 +1,9 @@ +# Changelog for vimAuthenticationCrowdStrikeFalconDataReplicator.yaml + +## Version 0.1.0 + +- (2026-10-23) Initial CrowdStrike Falcon Data Replicator Authentication filtering parser for CrowdStrike_Auth_Events_CL. - [PR #15415](https://github.com/Azure/Azure-Sentinel/pull/15415) +- Support time, source IPv4 prefix or exact IP, source hostname, username, event type, result, and result-detail filtering. +- Return no events for a nonempty target application filter because the source has no target application name. +- Preserve the parameterless parser mappings and optional original-source packing. +- Use Falcon Data Replicator consistently in product metadata, parser names, and built-in aliases. diff --git a/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml b/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml index 2f24513ee3d..cdffb74a101 100644 --- a/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml +++ b/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml @@ -1,7 +1,7 @@ Parser: Title: Authentication ASIM parser - Version: '0.2.28' - LastUpdated: Oct 13, 2026 + Version: '0.2.29' + LastUpdated: Oct 23, 2026 Product: Name: Source agnostic Normalization: @@ -60,6 +60,7 @@ ParserQuery: | ASimAuthenticationVMwareCarbonBlackCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )), ASimAuthenticationVMwareVCenter (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareVCenter' in (DisabledParsers) ), pack=pack), ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )), + ASimAuthenticationCrowdStrikeFalconDataReplicator (disabled=(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack), ASimAuthenticationIllumioSaaSCore (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationIllumioSaaSCore' in (DisabledParsers) )), ASimAuthenticationNative (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationNative' in (DisabledParsers) )), ASimAuthenticationPaloAltoPanOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPanOS' in (DisabledParsers) ), pack=pack), @@ -108,6 +109,7 @@ Parsers: - _ASim_Authentication_VMwareCarbonBlackCloud - _ASim_Authentication_VMwareVCenter - _ASim_Authentication_CrowdStrikeFalconHost + - _ASim_Authentication_CrowdStrikeFalconDataReplicator - _ASim_Authentication_GoogleWorkspace - _ASim_Authentication_GoogleWorkspaceLogins - _ASim_Authentication_SalesforceSC diff --git a/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalconDataReplicator.yaml b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalconDataReplicator.yaml new file mode 100644 index 00000000000..051ea9aaf00 --- /dev/null +++ b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalconDataReplicator.yaml @@ -0,0 +1,125 @@ +Parser: + Title: Authentication ASIM parser for CrowdStrike Falcon Data Replicator + Version: '0.1.0' + LastUpdated: Oct 23, 2026 +Product: + Name: CrowdStrike Falcon Data Replicator +Normalization: + Schema: Authentication + Version: '1.0.0' +References: +- Title: ASIM Authentication Schema + Link: https://aka.ms/ASimAuthenticationDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: CrowdStrike Falcon Data Replicator connector + Link: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/CrowdStrikeS3FDR_ccp/DataConnectorDefinition.json +Description: | + Normalizes CrowdStrike Falcon Data Replicator authentication events from CrowdStrike_Auth_Events_CL to the ASIM Authentication schema. + This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. +ParserName: ASimAuthenticationCrowdStrikeFalconDataReplicator +EquivalentBuiltInParser: _ASim_Authentication_CrowdStrikeFalconDataReplicator +ParserParams: + - Name: disabled + Type: bool + Default: false + - Name: pack + Type: bool + Default: false +ParserQuery: | + let parser = (disabled:bool = false, pack:bool = false) { + CrowdStrike_Auth_Events_CL + | where not(disabled) + | extend SourceFields = iff(pack, pack_all(), dynamic({})) + | extend + EventType = iff(event_simpleName startswith "UserLogoff", "Logoff", "Logon"), + EventResult = iff(event_simpleName startswith "UserLogonFailed", "Failure", "Success"), + EventOriginalSubType = LogonType, + EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat("/", SubStatus), "")), + EventStartTime = coalesce( + unixtime_seconds_todatetime(ContextTimeStamp), + unixtime_milliseconds_todatetime(timestamp), + unixtime_seconds_todatetime(iff(event_simpleName startswith "UserLogoff", LogoffTime, LogonTime)), + TimeGenerated), + DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip), + ComputerName = tostring(AdditionalFields.ComputerName), + SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6), + TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains "\\" and UserName !contains "@", strcat(LogonDomain, "\\", UserName), UserName)), + TargetUserId = coalesce(UserSid, UID), + TargetUserIdType = case(isnotempty(UserSid), "SID", isnotempty(UID), "UID", ""), + TargetUserType = case(UserIsAdmin == "1", "Admin", UserIsAdmin == "0", "Regular", ""), + TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId), + DvcOs = case(event_platform =~ "Win", "Windows", event_platform =~ "Mac", "macOS", event_platform =~ "Lin", "Linux", event_platform) + | extend + EventEndTime = EventStartTime, + EventSubType = case(LogonType == "0", "System", LogonType in ("2", "7", "11"), "Interactive", LogonType == "3", "Remote", LogonType == "5", "Service", LogonType == "8", "NetworkCleartext", LogonType == "10", "RemoteInteractive", ""), + EventResultDetails = iff(EventResult == "Failure", "Other", ""), + TargetUsernameType = case(TargetUsername contains "@", "UPN", TargetUsername contains "\\", "Windows", isnotempty(TargetUsername), "Simple", ""), + DvcHostname = iff(tostring(split(ComputerName, ".")[0]) matches regex @"^[a-zA-Z0-9-]{1,61}$", tostring(split(ComputerName, ".")[0]), ""), + DvcDomain = iff(ComputerName contains ".", substring(ComputerName, indexof(ComputerName, ".") + 1), ""), + DvcFQDN = iff(ComputerName contains ".", ComputerName, ""), + SrcHostname = iff(tostring(split(ClientComputerName, ".")[0]) matches regex @"^[a-zA-Z0-9-]{1,61}$", tostring(split(ClientComputerName, ".")[0]), ""), + SrcDomain = iff(ClientComputerName contains ".", substring(ClientComputerName, indexof(ClientComputerName, ".") + 1), ""), + SrcFQDN = iff(ClientComputerName contains ".", ClientComputerName, "") + | project-rename + EventOriginalType = event_simpleName, + DvcId = aid, + DvcScopeId = cid, + TargetUserSid = UserSid, + TargetUserUid = UID, + TargetUserUpn = UserPrincipal, + TargetUserScope = LogonDomain, + TargetOriginalUserType = UserIsAdmin, + LogonProtocol = AuthenticationPackage + | extend + Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName), + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + DvcDomainType = iff(isnotempty(DvcDomain), "FQDN", ""), + SrcDomainType = iff(isnotempty(SrcDomain), "FQDN", ""), + Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname), + TargetHostname = DvcHostname, + TargetDomain = DvcDomain, + TargetDomainType = iff(isnotempty(DvcDomain), "FQDN", ""), + TargetFQDN = DvcFQDN, + TargetDvcId = DvcId, + TargetDvcIdType = iff(isnotempty(DvcId), "Other", ""), + TargetIpAddr = DvcIpAddr, + TargetDvcOs = DvcOs, + TargetDvcScopeId = DvcScopeId, + EventCount = int(1), + EventVendor = "CrowdStrike", + EventProduct = "Falcon Data Replicator", + EventSchema = "Authentication", + EventSchemaVersion = "1.0.0", + EventSeverity = "Informational", + DvcEntityKey = "", + ActorUserEntityKey = "", + ActorUserAdditionalIds = dynamic([]), + TargetUserEntityKey = "", + TargetUserAdditionalIds = dynamic([]), + SrcSystemEntityKey = "", + TargetSystemEntityKey = "", + ActingApplicationEntityKey = "", + TargetApplicationEntityKey = "", + AdditionalEntities = dynamic([]), + AdditionalFields = SourceFields + | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr + | project + TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, + EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity, + EventType, EventSubType, EventResult, EventResultDetails, + EventOriginalType, EventOriginalSubType, EventOriginalResultDetails, + Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType, + DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey, + Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN, + TargetHostname, TargetDomain, TargetDomainType, TargetFQDN, + TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId, + TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType, + TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope, + TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol, + Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds, + TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey, + TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey, + AdditionalEntities, AdditionalFields + }; + parser(disabled=disabled, pack=pack) diff --git a/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml b/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml index 266f77904eb..873958bda30 100644 --- a/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml +++ b/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml @@ -1,7 +1,7 @@ Parser: Title: Authentication ASIM filtering parser - Version: '0.3.24' - LastUpdated: Oct 13, 2026 + Version: '0.3.25' + LastUpdated: Oct 23, 2026 Product: Name: Source agnostic Normalization: @@ -101,10 +101,12 @@ ParserQuery: | , vimAuthenticationCyberArkAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCyberArkAudit' in (DisabledParsers) )), pack=pack) , vimAuthenticationZscalerZPA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationZscalerZPA' in (DisabledParsers) )), pack=pack) , vimAuthenticationOktaAuth0 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaAuth0' in (DisabledParsers) )), pack=pack) + , vimAuthenticationCrowdStrikeFalconDataReplicator (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled=(imAuthenticationBuiltInDisabled or ('ExcludevimAuthenticationCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack) }; Generic(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, pack=pack) Parsers: - _Im_Authentication_Empty + - _Im_Authentication_CrowdStrikeFalconDataReplicator - _Im_Authentication_AADManagedIdentitySignInLogs - _Im_Authentication_AADNonInteractiveUserSignInLogs - _Im_Authentication_AADServicePrincipalSignInLogs diff --git a/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalconDataReplicator.yaml b/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalconDataReplicator.yaml new file mode 100644 index 00000000000..34eb1472e45 --- /dev/null +++ b/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalconDataReplicator.yaml @@ -0,0 +1,180 @@ +Parser: + Title: Authentication ASIM filtering parser for CrowdStrike Falcon Data Replicator + Version: '0.1.0' + LastUpdated: Oct 23, 2026 +Product: + Name: CrowdStrike Falcon Data Replicator +Normalization: + Schema: Authentication + Version: '1.0.0' +References: +- Title: ASIM Authentication Schema + Link: https://aka.ms/ASimAuthenticationDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: CrowdStrike Falcon Data Replicator connector + Link: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/CrowdStrikeS3FDR_ccp/DataConnectorDefinition.json +Description: | + Filters and normalizes CrowdStrike Falcon Data Replicator authentication events from CrowdStrike_Auth_Events_CL to the ASIM Authentication schema. + This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. +ParserName: vimAuthenticationCrowdStrikeFalconDataReplicator +EquivalentBuiltInParser: _Im_Authentication_CrowdStrikeFalconDataReplicator +ParserParams: + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: srcipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: srchostname_has_any + Type: dynamic + Default: dynamic([]) + - Name: username_has_any + Type: dynamic + Default: dynamic([]) + - Name: targetappname_has_any + Type: dynamic + Default: dynamic([]) + - Name: eventtype_in + Type: dynamic + Default: dynamic([]) + - Name: eventresult + Type: string + Default: '*' + - Name: eventresultdetails_in + Type: dynamic + Default: dynamic([]) + - Name: disabled + Type: bool + Default: false + - Name: pack + Type: bool + Default: false +ParserQuery: | + let parser = ( + starttime:datetime = datetime(null), + endtime:datetime = datetime(null), + srcipaddr_has_any_prefix:dynamic = dynamic([]), + srchostname_has_any:dynamic = dynamic([]), + username_has_any:dynamic = dynamic([]), + targetappname_has_any:dynamic = dynamic([]), + eventtype_in:dynamic = dynamic([]), + eventresult:string = "*", + eventresultdetails_in:dynamic = dynamic([]), + disabled:bool = false, + pack:bool = false + ) { + CrowdStrike_Auth_Events_CL + | where not(disabled) + // This source has no target application name; an active application filter cannot match. + | where array_length(targetappname_has_any) == 0 + | where array_length(eventtype_in) == 0 + or (event_simpleName startswith "UserLogoff" and "Logoff" in~ (eventtype_in)) + or (event_simpleName !startswith "UserLogoff" and "Logon" in~ (eventtype_in)) + | where eventresult == "*" + or (event_simpleName startswith "UserLogonFailed" and eventresult =~ "Failure") + or (event_simpleName !startswith "UserLogonFailed" and eventresult =~ "Success") + | extend SourceFields = iff(pack, pack_all(), dynamic({})) + | extend EventStartTime = coalesce( + unixtime_seconds_todatetime(ContextTimeStamp), + unixtime_milliseconds_todatetime(timestamp), + unixtime_seconds_todatetime(iff(event_simpleName startswith "UserLogoff", LogoffTime, LogonTime)), + TimeGenerated) + | where (isnull(starttime) or EventStartTime >= starttime) + and (isnull(endtime) or EventStartTime <= endtime) + | extend SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6) + | where array_length(srcipaddr_has_any_prefix) == 0 + or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix) + or SrcIpAddr in~ (srcipaddr_has_any_prefix) + | extend TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains "\\" and UserName !contains "@", strcat(LogonDomain, "\\", UserName), UserName)) + | where array_length(username_has_any) == 0 or TargetUsername has_any (username_has_any) + | extend SrcHostname = iff(tostring(split(ClientComputerName, ".")[0]) matches regex @"^[a-zA-Z0-9-]{1,61}$", tostring(split(ClientComputerName, ".")[0]), "") + | where array_length(srchostname_has_any) == 0 or SrcHostname has_any (srchostname_has_any) + | extend EventResultDetails = iff(event_simpleName startswith "UserLogonFailed", "Other", "") + | where array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in) + | extend + EventType = iff(event_simpleName startswith "UserLogoff", "Logoff", "Logon"), + EventResult = iff(event_simpleName startswith "UserLogonFailed", "Failure", "Success"), + EventOriginalSubType = LogonType, + EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat("/", SubStatus), "")), + DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip), + ComputerName = tostring(AdditionalFields.ComputerName), + TargetUserId = coalesce(UserSid, UID), + TargetUserIdType = case(isnotempty(UserSid), "SID", isnotempty(UID), "UID", ""), + TargetUserType = case(UserIsAdmin == "1", "Admin", UserIsAdmin == "0", "Regular", ""), + TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId), + DvcOs = case(event_platform =~ "Win", "Windows", event_platform =~ "Mac", "macOS", event_platform =~ "Lin", "Linux", event_platform) + | extend + EventEndTime = EventStartTime, + EventSubType = case(LogonType == "0", "System", LogonType in ("2", "7", "11"), "Interactive", LogonType == "3", "Remote", LogonType == "5", "Service", LogonType == "8", "NetworkCleartext", LogonType == "10", "RemoteInteractive", ""), + TargetUsernameType = case(TargetUsername contains "@", "UPN", TargetUsername contains "\\", "Windows", isnotempty(TargetUsername), "Simple", ""), + DvcHostname = iff(tostring(split(ComputerName, ".")[0]) matches regex @"^[a-zA-Z0-9-]{1,61}$", tostring(split(ComputerName, ".")[0]), ""), + DvcDomain = iff(ComputerName contains ".", substring(ComputerName, indexof(ComputerName, ".") + 1), ""), + DvcFQDN = iff(ComputerName contains ".", ComputerName, ""), + SrcDomain = iff(ClientComputerName contains ".", substring(ClientComputerName, indexof(ClientComputerName, ".") + 1), ""), + SrcFQDN = iff(ClientComputerName contains ".", ClientComputerName, "") + | project-rename + EventOriginalType = event_simpleName, + DvcId = aid, + DvcScopeId = cid, + TargetUserSid = UserSid, + TargetUserUid = UID, + TargetUserUpn = UserPrincipal, + TargetUserScope = LogonDomain, + TargetOriginalUserType = UserIsAdmin, + LogonProtocol = AuthenticationPackage + | extend + Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName), + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + DvcDomainType = iff(isnotempty(DvcDomain), "FQDN", ""), + SrcDomainType = iff(isnotempty(SrcDomain), "FQDN", ""), + Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname), + TargetHostname = DvcHostname, + TargetDomain = DvcDomain, + TargetDomainType = iff(isnotempty(DvcDomain), "FQDN", ""), + TargetFQDN = DvcFQDN, + TargetDvcId = DvcId, + TargetDvcIdType = iff(isnotempty(DvcId), "Other", ""), + TargetIpAddr = DvcIpAddr, + TargetDvcOs = DvcOs, + TargetDvcScopeId = DvcScopeId, + EventCount = int(1), + EventVendor = "CrowdStrike", + EventProduct = "Falcon Data Replicator", + EventSchema = "Authentication", + EventSchemaVersion = "1.0.0", + EventSeverity = "Informational", + DvcEntityKey = "", + ActorUserEntityKey = "", + ActorUserAdditionalIds = dynamic([]), + TargetUserEntityKey = "", + TargetUserAdditionalIds = dynamic([]), + SrcSystemEntityKey = "", + TargetSystemEntityKey = "", + ActingApplicationEntityKey = "", + TargetApplicationEntityKey = "", + AdditionalEntities = dynamic([]), + AdditionalFields = SourceFields + | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr + | project + TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, + EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity, + EventType, EventSubType, EventResult, EventResultDetails, + EventOriginalType, EventOriginalSubType, EventOriginalResultDetails, + Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType, + DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey, + Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN, + TargetHostname, TargetDomain, TargetDomainType, TargetFQDN, + TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId, + TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType, + TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope, + TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol, + Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds, + TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey, + TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey, + AdditionalEntities, AdditionalFields + }; + parser(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, eventtype_in=eventtype_in, eventresult=eventresult, eventresultdetails_in=eventresultdetails_in, disabled=disabled, pack=pack) diff --git a/Sample Data/ASIM/CrowdStrike_Auth_Events_CL_Schema.csv b/Sample Data/ASIM/CrowdStrike_Auth_Events_CL_Schema.csv new file mode 100644 index 00000000000..7c8b37dcba6 --- /dev/null +++ b/Sample Data/ASIM/CrowdStrike_Auth_Events_CL_Schema.csv @@ -0,0 +1,63 @@ +ColumnName,ColumnType +TimeGenerated,datetime +event_simpleName,string +timestamp,long +aip,string +aid,string +UserName,string +event_platform,string +ContextTimeStamp,real +name,string +ConfigBuild,string +CrowdStrikeId,string +ConfigStateHash,string +ContextProcessId,string +ContextThreadId,string +BoundingLimitCount,long +BoundingLimitDuration,string +Entitlements,string +EffectiveTransmissionClass,string +cid,string +OciContainerId,string +TreeId,string +LogonType,string +LogonTime,real +UserIsAdmin,string +LogonDomain,string +RemoteAccount,string +ClientComputerName,string +UserPrincipal,string +RawProcessId,string +UserSid,string +LogonServer,string +AuthenticationPackage,string +AuthenticationId,string +UserLogonFlags,string +RemoteAddressIP4,string +RemoteAddressIP6,string +UserLogoffType,string +LogoffTime,real +SessionId,string +UserFlags,string +PrivilegesBitmask,string +PasswordLastSet,string +EventOrigin,string +TargetProcessId,string +Status,string +EtwRawProcessId,string +EtwRawThreadId,long +SubStatus,string +LocalSession,string +EnabledPrivilegesBitmask,string +UserGroupsBitmask,string +LinkedAuthenticationId,string +UserCanonical,string +LoginSessionId,string +AuthenticationUuidAsString,string +UID,string +AuthenticationUuid,string +AuthenticationIdMac,string +ResendToCloud,string +LogonId,string +ConfigStateHashA1,string +AdditionalFields,dynamic diff --git a/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_Authentication_IngestedLogs.csv b/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_Authentication_IngestedLogs.csv new file mode 100644 index 00000000000..c336880ddbb --- /dev/null +++ b/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_Authentication_IngestedLogs.csv @@ -0,0 +1,11 @@ +"TimeGenerated","event_simpleName","timestamp","aip","aid","UserName","event_platform","ContextTimeStamp","name","ConfigBuild","CrowdStrikeId","ConfigStateHash","ContextProcessId","ContextThreadId","BoundingLimitCount","BoundingLimitDuration","Entitlements","EffectiveTransmissionClass","cid","OciContainerId","TreeId","LogonType","LogonTime","UserIsAdmin","LogonDomain","RemoteAccount","ClientComputerName","UserPrincipal","RawProcessId","UserSid","LogonServer","AuthenticationPackage","AuthenticationId","UserLogonFlags","RemoteAddressIP4","RemoteAddressIP6","UserLogoffType","LogoffTime","SessionId","UserFlags","PrivilegesBitmask","PasswordLastSet","EventOrigin","TargetProcessId","Status","EtwRawProcessId","EtwRawThreadId","SubStatus","LocalSession","EnabledPrivilegesBitmask","UserGroupsBitmask","LinkedAuthenticationId","UserCanonical","LoginSessionId","AuthenticationUuidAsString","UID","AuthenticationUuid","AuthenticationIdMac","ResendToCloud","LogonId","ConfigStateHashA1","AdditionalFields","TenantId","Type","_ResourceId" +"2026-10-22T12:00:00.0000000+00:00","UserLogon","1792670400000","203.0.113.1","00000000000000000000000000000001","testuser1","Win","1792670400","UserLogonV1","synthetic-build","00000000-0000-0000-0000-000000000001","synthetic-state","1001","2001","1","0","0","0","00000000000000000000000000000000","synthetic-container-1","3001","0","1792670400","1","EXAMPLE","1","client1.example.test","testuser1@example.test","4001","S-1-5-21-100-200-300-1","dc1.example.test","Kerberos","5001","0","192.0.2.1","2001:db8::1","3","","1","0","0","1790078400","1","6001","0","7001","8001","0","0","0","0","9001","EXAMPLE\testuser1","10001","00000000-0000-0000-0000-000000000001","","00000000-0000-0000-0000-000000000001","","0","12001","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.1"",""ComputerName"":""server1.example.test"",""LocalAddressIP6"":""2001:db8:1::1"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:01:00.0000000+00:00","UserLogoff","1792670460000","203.0.113.2","00000000000000000000000000000002","testuser2","Win","1792670460","UserLogoffV1","synthetic-build","00000000-0000-0000-0000-000000000002","synthetic-state","1002","2002","1","0","0","0","00000000000000000000000000000000","synthetic-container-2","3002","2","1792670460","0","EXAMPLE","1","client2.example.test","testuser2@example.test","4002","S-1-5-21-100-200-300-2","dc1.example.test","Kerberos","5002","1","192.0.2.2","2001:db8::2","3","1792670460","2","0","0","1790078460","1","6002","0","7002","8002","0","0","0","0","9002","EXAMPLE\testuser2","10002","00000000-0000-0000-0000-000000000002","","00000000-0000-0000-0000-000000000002","","0","12002","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.2"",""ComputerName"":""server2.example.test"",""LocalAddressIP6"":""2001:db8:1::2"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:02:00.0000000+00:00","UserLogonFailed","1792670520000","203.0.113.3","00000000000000000000000000000003","testuser3","Win","1792670520","UserLogonFailedV1","synthetic-build","00000000-0000-0000-0000-000000000003","synthetic-state","1003","2003","1","0","0","0","00000000000000000000000000000000","synthetic-container-3","3003","3","1792670520","0","EXAMPLE","1","client3.example.test","testuser3@example.test","4003","S-1-5-21-100-200-300-3","dc1.example.test","Kerberos","5003","2","192.0.2.3","2001:db8::3","3","","3","0","0","1790078520","1","6003","0xC000006D","7003","8003","0xC000006A","0","0","0","9003","EXAMPLE\testuser3","10003","00000000-0000-0000-0000-000000000003","","00000000-0000-0000-0000-000000000003","","0","12003","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.3"",""ComputerName"":""server3.example.test"",""LocalAddressIP6"":""2001:db8:1::3"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:03:00.0000000+00:00","UserLogonFailed2","1792670580000","203.0.113.4","00000000000000000000000000000004","testuser4","Win","1792670580","UserLogonFailed2V1","synthetic-build","00000000-0000-0000-0000-000000000004","synthetic-state","1004","2004","1","0","0","0","00000000000000000000000000000000","synthetic-container-4","3004","5","1792670580","0","EXAMPLE","1","client4.example.test","testuser4@example.test","4004","S-1-5-21-100-200-300-4","dc1.example.test","Kerberos","5004","3","192.0.2.4","2001:db8::4","3","","4","0","0","1790078580","1","6004","0xC000006D","7004","8004","0xC000006A","0","0","0","9004","EXAMPLE\testuser4","10004","00000000-0000-0000-0000-000000000004","","00000000-0000-0000-0000-000000000004","","0","12004","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.4"",""ComputerName"":""server4.example.test"",""LocalAddressIP6"":""2001:db8:1::4"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:04:00.0000000+00:00","IoSessionLoggedOn","1792670640000","203.0.113.5","00000000000000000000000000000005","testuser5","Win","1792670640","IoSessionLoggedOnV1","synthetic-build","00000000-0000-0000-0000-000000000005","synthetic-state","1005","2005","1","0","0","0","00000000000000000000000000000000","synthetic-container-5","3005","7","1792670640","0","EXAMPLE","1","client5.example.test","testuser5@example.test","4005","S-1-5-21-100-200-300-5","dc1.example.test","Kerberos","5005","4","192.0.2.5","2001:db8::5","3","","5","0","0","1790078640","1","6005","0","7005","8005","0","0","0","0","9005","EXAMPLE\testuser5","10005","00000000-0000-0000-0000-000000000005","","00000000-0000-0000-0000-000000000005","","0","12005","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.5"",""ComputerName"":""server5.example.test"",""LocalAddressIP6"":""2001:db8:1::5"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:05:00.0000000+00:00","UserLogonFailed2Lin","1792670700000","203.0.113.6","00000000000000000000000000000006","testuser6","Lin","1792670700","UserLogonFailed2LinV1","synthetic-build","00000000-0000-0000-0000-000000000006","synthetic-state","1006","2006","1","0","0","0","00000000000000000000000000000000","synthetic-container-6","3006","8","1792670700","0","EXAMPLE","1","client6.example.test","testuser6@example.test","4006","","dc1.example.test","PAM","5006","5","192.0.2.6","2001:db8::6","3","","6","0","0","1790078700","1","6006","0xC000006D","7006","8006","0xC000006A","0","0","0","9006","EXAMPLE\testuser6","10006","00000000-0000-0000-0000-000000000006","1006","00000000-0000-0000-0000-000000000006","","0","12006","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.6"",""ComputerName"":""server6.example.test"",""LocalAddressIP6"":""2001:db8:1::6"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:06:00.0000000+00:00","UserLogonMac","1792670760000","203.0.113.7","00000000000000000000000000000007","testuser7","Mac","1792670760","UserLogonMacV1","synthetic-build","00000000-0000-0000-0000-000000000007","synthetic-state","1007","2007","1","0","0","0","00000000000000000000000000000000","synthetic-container-7","3007","9","1792670760","0","EXAMPLE","1","client7.example.test","testuser7@example.test","4007","","dc1.example.test","PAM","5007","6","192.0.2.7","2001:db8::7","3","","7","0","0","1790078760","1","6007","0","7007","8007","0","0","0","0","9007","EXAMPLE\testuser7","10007","00000000-0000-0000-0000-000000000007","1007","00000000-0000-0000-0000-000000000007","11007","0","12007","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.7"",""ComputerName"":""server7.example.test"",""LocalAddressIP6"":""2001:db8:1::7"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:07:00.0000000+00:00","UserLogonFailed2Mac","1792670820000","203.0.113.8","00000000000000000000000000000008","testuser8","Mac","1792670820","UserLogonFailed2MacV1","synthetic-build","00000000-0000-0000-0000-000000000008","synthetic-state","1008","2008","1","0","0","0","00000000000000000000000000000000","synthetic-container-8","3008","10","1792670820","0","EXAMPLE","1","client8.example.test","testuser8@example.test","4008","","dc1.example.test","PAM","5008","7","","2001:db8::8","3","","8","0","0","1790078820","1","6008","0xC000006D","7008","8008","0xC000006A","0","0","0","9008","EXAMPLE\testuser8","10008","00000000-0000-0000-0000-000000000008","1008","00000000-0000-0000-0000-000000000008","11008","0","12008","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.8"",""ComputerName"":""server8.example.test"",""LocalAddressIP6"":""2001:db8:1::8"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:08:00.0000000+00:00","UserLogoffLin","1792670880000","203.0.113.9","00000000000000000000000000000009","testuser9","Lin","1792670880","UserLogoffLinV1","synthetic-build","00000000-0000-0000-0000-000000000009","synthetic-state","1009","2009","1","0","0","0","00000000000000000000000000000000","synthetic-container-9","3009","11","1792670880","0","EXAMPLE","1","client9.example.test","testuser9@example.test","4009","","dc1.example.test","PAM","5009","8","192.0.2.9","2001:db8::9","3","1792670880","9","0","0","1790078880","1","6009","0","7009","8009","0","0","0","0","9009","EXAMPLE\testuser9","10009","00000000-0000-0000-0000-000000000009","1009","00000000-0000-0000-0000-000000000009","","0","12009","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.9"",""ComputerName"":""server9.example.test"",""LocalAddressIP6"":""2001:db8:1::9"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:09:00.0000000+00:00","UserLogonLin","1792670940000","203.0.113.10","0000000000000000000000000000000a","testuser10","Lin","1792670940","UserLogonLinV1","synthetic-build","00000000-0000-0000-0000-000000000010","synthetic-state","1010","2010","1","0","0","0","00000000000000000000000000000000","synthetic-container-10","3010","4","1792670940","0","EXAMPLE","1","client10.example.test","testuser10@example.test","4010","","dc1.example.test","PAM","5010","9","192.0.2.10","2001:db8::10","3","","10","0","0","1790078940","1","6010","0","7010","8010","0","0","0","0","9010","EXAMPLE\testuser10","10010","00000000-0000-0000-0000-000000000010","1010","00000000-0000-0000-0000-000000000010","","0","12010","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.10"",""ComputerName"":""server10.example.test"",""LocalAddressIP6"":""2001:db8:1::10"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic"