From c727309d3d71595229c72cf638d4b1f60ea183f3 Mon Sep 17 00:00:00 2001 From: Derrick Lee Date: Fri, 23 Oct 2026 15:18:41 -0700 Subject: [PATCH 1/6] Initial commit --- .../CrowdStrike_Auth_Events_CL.json | 4 + .../ASimAuthentication.json | 2 +- .../ASimAuthenticationCrowdStrikeFalcon.json | 36 ++++ .../README.md | 18 ++ .../ARM/FullDeploymentAuthentication.json | 40 ++++ .../imAuthentication/imAuthentication.json | 2 +- .../README.md | 21 +++ .../vimAuthenticationCrowdStrikeFalcon.json | 36 ++++ .../CHANGELOG/ASimAuthentication.md | 4 + .../ASimAuthenticationCrowdStrikeFalcon.md | 8 + .../CHANGELOG/imAuthentication.md | 4 + .../vimAuthenticationCrowdStrikeFalcon.md | 8 + .../Parsers/ASimAuthentication.yaml | 6 +- .../ASimAuthenticationCrowdStrikeFalcon.yaml | 127 +++++++++++++ .../Parsers/imAuthentication.yaml | 6 +- .../vimAuthenticationCrowdStrikeFalcon.yaml | 176 ++++++++++++++++++ ...ike_Falcon_Authentication_IngestedLogs.csv | 11 ++ 17 files changed, 503 insertions(+), 6 deletions(-) create mode 100644 Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json create mode 100644 Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/README.md create mode 100644 Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/README.md create mode 100644 Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json create mode 100644 Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md create mode 100644 Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md create mode 100644 Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalcon.yaml create mode 100644 Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalcon.yaml create mode 100644 Sample Data/ASIM/CrowdStrike_Falcon_Authentication_IngestedLogs.csv diff --git a/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_Auth_Events_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_Auth_Events_CL.json index 1e6bdb03c53..dd508c968ee 100644 --- a/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_Auth_Events_CL.json +++ b/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_Auth_Events_CL.json @@ -248,6 +248,10 @@ { "name": "AdditionalFields", "type": "dynamic" + }, + { + "name": "Type", + "type": "string" } ] } \ No newline at end of file diff --git a/Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json b/Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json index 60b57727b90..66c3eb1459e 100644 --- a/Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json +++ b/Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json @@ -27,7 +27,7 @@ "displayName": "Authentication ASIM parser", "category": "ASIM", "FunctionAlias": "ASimAuthentication", - "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet ASimAuthenticationDisabled=toscalar('ExcludeASimAuthentication' in (DisabledParsers) or 'Any' in (DisabledParsers));\nunion isfuzzy=true\n vimAuthenticationEmpty,\n ASimAuthenticationAADManagedIdentitySignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADNonInteractiveUserSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADServicePrincipalSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAWSCloudTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAWSCloudTrail' in (DisabledParsers) )),\n ASimAuthenticationBarracudaWAF (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationBarracudaWAF' in (DisabledParsers) )),\n ASimAuthenticationCiscoASA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoASA' in (DisabledParsers) )),\n ASimAuthenticationCiscoDNAC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoDNAC' in (DisabledParsers) )),\n ASimAuthenticationCiscoFTD (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoFTD' in (DisabledParsers) )),\n ASimAuthenticationCiscoIOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoIOS' in (DisabledParsers) )),\n ASimAuthenticationCiscoISE (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISE' in (DisabledParsers) )),\n ASimAuthenticationCiscoISEAdministrator (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISEAdministrator' in (DisabledParsers) ),pack=pack),\n ASimAuthenticationCiscoMeraki (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMeraki' in (DisabledParsers) )),\n ASimAuthenticationCiscoMerakiSyslog (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )),\n ASimAuthenticationFortinetFortigate (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationFortigate' in (DisabledParsers) )),\n ASimAuthenticationM365Defender (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationM365Defender' in (DisabledParsers) )),\n ASimAuthenticationMD4IoT (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMD4IoT' in (DisabledParsers) )),\n ASimAuthenticationMicrosoftWindowsEvent (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )),\n ASimAuthenticationOktaSSO (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSSO' in (DisabledParsers) )),\n ASimAuthenticationOktaV2(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaV2' in (DisabledParsers) )),\n ASimAuthenticationOktaSystemLogs(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSystemLogs' in (DisabledParsers) )),\n ASimAuthenticationPostgreSQL (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPostgreSQL' in (DisabledParsers) )),\n ASimAuthenticationSigninLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSigninLogs' in (DisabledParsers) )),\n ASimAuthenticationSshd (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSshd' in (DisabledParsers) )),\n ASimAuthenticationSu (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSu' in (DisabledParsers) )),\n ASimAuthenticationSudo (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSudo' in (DisabledParsers) )),\n ASimAuthenticationSalesforceSC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceSC' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationSalesforceLoginHistory (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceLoginHistory' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationVectraXDRAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVectraXDRAudit' in (DisabledParsers) )),\n ASimAuthenticationSentinelOne (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSentinelOne' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspace (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspace' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspaceLogins (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspaceLogins' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoCortexDataLake (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )),\n ASimAuthenticationVMwareCarbonBlackCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )),\n ASimAuthenticationVMwareVCenter (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareVCenter' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalcon' in (DisabledParsers) )),\n ASimAuthenticationIllumioSaaSCore (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationIllumioSaaS' in (DisabledParsers) )),\n ASimAuthenticationNative (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationNative' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoPanOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPanOS' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationPaloAltoGlobalProtect (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationVMwareESXi (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareESXi' in (DisabledParsers)), pack=pack),\n ASimAuthenticationPaloAltoPrismaCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPrismaCloud' in (DisabledParsers)), pack=pack),\n ASimAuthenticationAlibabaCloudActionTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAlibabaCloudActionTrail' in (DisabledParsers)), pack=pack),\n ASimAuthenticationWizCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationWizCloud' in (DisabledParsers)), pack=pack),\n ASimAuthenticationOracleOCI (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOracleOCI' in (DisabledParsers)), pack=pack),\n ASimAuthenticationArubaNetworksClearPass (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationArubaNetworksClearPass' in (DisabledParsers)), pack=pack),\n ASimAuthenticationCyberArkAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCyberArkAudit' in (DisabledParsers)), pack=pack),\n ASimAuthenticationZscalerZPA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationZscalerZPA' in (DisabledParsers)), pack=pack)\n , ASimAuthenticationOktaAuth0 (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaAuth0' in (DisabledParsers)), pack=pack)\n", + "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet ASimAuthenticationDisabled=toscalar('ExcludeASimAuthentication' in (DisabledParsers) or 'Any' in (DisabledParsers));\nunion isfuzzy=true\n vimAuthenticationEmpty,\n ASimAuthenticationAADManagedIdentitySignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADNonInteractiveUserSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADServicePrincipalSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAWSCloudTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAWSCloudTrail' in (DisabledParsers) )),\n ASimAuthenticationBarracudaWAF (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationBarracudaWAF' in (DisabledParsers) )),\n ASimAuthenticationCiscoASA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoASA' in (DisabledParsers) )),\n ASimAuthenticationCiscoDNAC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoDNAC' in (DisabledParsers) )),\n ASimAuthenticationCiscoFTD (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoFTD' in (DisabledParsers) )),\n ASimAuthenticationCiscoIOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoIOS' in (DisabledParsers) )),\n ASimAuthenticationCiscoISE (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISE' in (DisabledParsers) )),\n ASimAuthenticationCiscoISEAdministrator (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISEAdministrator' in (DisabledParsers) ),pack=pack),\n ASimAuthenticationCiscoMeraki (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMeraki' in (DisabledParsers) )),\n ASimAuthenticationCiscoMerakiSyslog (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )),\n ASimAuthenticationFortinetFortigate (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationFortinetFortigate' in (DisabledParsers) )),\n ASimAuthenticationM365Defender (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationM365Defender' in (DisabledParsers) )),\n ASimAuthenticationMD4IoT (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMD4IoT' in (DisabledParsers) )),\n ASimAuthenticationMicrosoftWindowsEvent (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )),\n ASimAuthenticationOktaSSO (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSSO' in (DisabledParsers) )),\n ASimAuthenticationOktaV2(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaV2' in (DisabledParsers) )),\n ASimAuthenticationOktaSystemLogs(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSystemLogs' in (DisabledParsers) )),\n ASimAuthenticationPostgreSQL (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPostgreSQL' in (DisabledParsers) )),\n ASimAuthenticationSigninLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSigninLogs' in (DisabledParsers) )),\n ASimAuthenticationSshd (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSshd' in (DisabledParsers) )),\n ASimAuthenticationSu (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSu' in (DisabledParsers) )),\n ASimAuthenticationSudo (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSudo' in (DisabledParsers) )),\n ASimAuthenticationSalesforceSC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceSC' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationSalesforceLoginHistory (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceLoginHistory' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationVectraXDRAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVectraXDRAudit' in (DisabledParsers) )),\n ASimAuthenticationSentinelOne (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSentinelOne' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspace (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspace' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspaceLogins (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspaceLogins' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoCortexDataLake (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )),\n ASimAuthenticationVMwareCarbonBlackCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )),\n ASimAuthenticationVMwareVCenter (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareVCenter' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )),\n ASimAuthenticationCrowdStrikeFalcon (disabled=(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalcon' in (DisabledParsers))), pack=pack),\n ASimAuthenticationIllumioSaaSCore (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationIllumioSaaSCore' in (DisabledParsers) )),\n ASimAuthenticationNative (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationNative' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoPanOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPanOS' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationPaloAltoGlobalProtect (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationVMwareESXi (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareESXi' in (DisabledParsers)), pack=pack),\n ASimAuthenticationPaloAltoPrismaCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPrismaCloud' in (DisabledParsers)), pack=pack),\n ASimAuthenticationAlibabaCloudActionTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAlibabaCloudActionTrail' in (DisabledParsers)), pack=pack),\n ASimAuthenticationWizCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationWizCloud' in (DisabledParsers)), pack=pack),\n ASimAuthenticationOracleOCI (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOracleOCI' in (DisabledParsers)), pack=pack),\n ASimAuthenticationArubaNetworksClearPass (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationArubaNetworksClearPass' in (DisabledParsers)), pack=pack),\n ASimAuthenticationCyberArkAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCyberArkAudit' in (DisabledParsers)), pack=pack),\n ASimAuthenticationZscalerZPA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationZscalerZPA' in (DisabledParsers)), pack=pack),\n ASimAuthenticationOktaAuth0 (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaAuth0' in (DisabledParsers)), pack=pack)\n", "version": 1, "functionParameters": "pack:bool=False" } diff --git a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json new file mode 100644 index 00000000000..782da8d21c3 --- /dev/null +++ b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/ASimAuthenticationCrowdStrikeFalcon')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "Authentication ASIM parser for CrowdStrike Falcon", + "category": "ASIM", + "FunctionAlias": "ASimAuthenticationCrowdStrikeFalcon", + "query": "let parser = (disabled:bool = false, pack:bool = false) {\n CrowdStrike_Auth_Events_CL\n | where not(disabled)\n | extend EventName = coalesce(event_simpleName, tostring(split(name, \"V\")[0]))\n | where EventName in~ (\"UserLogon\", \"UserLogonMac\", \"UserLogonLin\", \"UserLogoff\", \"UserLogoffMac\", \"UserLogoffLin\", \"UserLogonFailed\", \"UserLogonFailed2\", \"UserLogonFailed2Mac\", \"UserLogonFailed2Lin\", \"IoSessionLoggedOn\")\n | extend SourceFields = iff(pack, pack_all(), dynamic({}))\n | extend\n EventType = iff(EventName startswith \"UserLogoff\", \"Logoff\", \"Logon\"),\n EventResult = iff(EventName startswith \"UserLogonFailed\", \"Failure\", \"Success\"),\n EventOriginalType = EventName,\n EventOriginalSubType = LogonType,\n EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat(\"/\", SubStatus), \"\")),\n EventStartTime = coalesce(\n unixtime_seconds_todatetime(ContextTimeStamp),\n unixtime_milliseconds_todatetime(timestamp),\n unixtime_seconds_todatetime(iff(EventName startswith \"UserLogoff\", LogoffTime, LogonTime)),\n TimeGenerated),\n DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip),\n ComputerName = tostring(AdditionalFields.ComputerName),\n SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6),\n TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains \"\\\\\" and UserName !contains \"@\", strcat(LogonDomain, \"\\\\\", UserName), UserName)),\n TargetUserId = coalesce(UserSid, UID),\n TargetUserIdType = case(isnotempty(UserSid), \"SID\", isnotempty(UID), \"UID\", \"\"),\n TargetUserType = case(UserIsAdmin == \"1\", \"Admin\", UserIsAdmin == \"0\", \"Regular\", \"\"),\n TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId),\n DvcOs = case(event_platform =~ \"Win\", \"Windows\", event_platform =~ \"Mac\", \"macOS\", event_platform =~ \"Lin\", \"Linux\", event_platform)\n | extend\n EventEndTime = EventStartTime,\n EventSubType = case(LogonType == \"0\", \"System\", LogonType in (\"2\", \"7\", \"11\"), \"Interactive\", LogonType == \"3\", \"Remote\", LogonType == \"5\", \"Service\", LogonType == \"8\", \"NetworkCleartext\", LogonType == \"10\", \"RemoteInteractive\", \"\"),\n EventResultDetails = iff(EventResult == \"Failure\", \"Other\", \"\"),\n TargetUsernameType = case(TargetUsername contains \"@\", \"UPN\", TargetUsername contains \"\\\\\", \"Windows\", isnotempty(TargetUsername), \"Simple\", \"\"),\n DvcHostname = iff(tostring(split(ComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ComputerName, \".\")[0]), \"\"),\n DvcDomain = iff(ComputerName contains \".\", substring(ComputerName, indexof(ComputerName, \".\") + 1), \"\"),\n DvcFQDN = iff(ComputerName contains \".\", ComputerName, \"\"),\n SrcHostname = iff(tostring(split(ClientComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ClientComputerName, \".\")[0]), \"\"),\n SrcDomain = iff(ClientComputerName contains \".\", substring(ClientComputerName, indexof(ClientComputerName, \".\") + 1), \"\"),\n SrcFQDN = iff(ClientComputerName contains \".\", ClientComputerName, \"\")\n | project-rename\n DvcId = aid,\n DvcScopeId = cid,\n TargetUserSid = UserSid,\n TargetUserUid = UID,\n TargetUserUpn = UserPrincipal,\n TargetUserScope = LogonDomain,\n TargetOriginalUserType = UserIsAdmin,\n LogonProtocol = AuthenticationPackage\n | extend\n Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName),\n DvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcDomainType = iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname),\n TargetHostname = DvcHostname,\n TargetDomain = DvcDomain,\n TargetDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n TargetFQDN = DvcFQDN,\n TargetDvcId = DvcId,\n TargetDvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n TargetIpAddr = DvcIpAddr,\n TargetDvcOs = DvcOs,\n TargetDvcScopeId = DvcScopeId,\n EventCount = int(1),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = \"Informational\",\n DvcEntityKey = \"\",\n ActorUserEntityKey = \"\",\n ActorUserAdditionalIds = dynamic([]),\n TargetUserEntityKey = \"\",\n TargetUserAdditionalIds = dynamic([]),\n SrcSystemEntityKey = \"\",\n TargetSystemEntityKey = \"\",\n ActingApplicationEntityKey = \"\",\n TargetApplicationEntityKey = \"\",\n AdditionalEntities = dynamic([]),\n AdditionalFields = SourceFields\n | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n EventType, EventSubType, EventResult, EventResultDetails,\n EventOriginalType, EventOriginalSubType, EventOriginalResultDetails,\n Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType,\n DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey,\n Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN,\n TargetHostname, TargetDomain, TargetDomainType, TargetFQDN,\n TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId,\n TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType,\n TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope,\n TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol,\n Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds,\n TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey,\n TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey,\n AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n", + "version": 1, + "functionParameters": "disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/README.md b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/README.md new file mode 100644 index 00000000000..057c669da94 --- /dev/null +++ b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/README.md @@ -0,0 +1,18 @@ +# CrowdStrike Falcon ASIM Authentication Normalization Parser + +ARM template for ASIM Authentication schema parser for CrowdStrike Falcon. + +The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. + +For more information, see: + +- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) +- [Deploy all of ASIM](https://aka.ms/DeployASIM) +- [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc) + +For the changelog, see: +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md) + +
+ +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationCrowdStrikeFalcon%2FASimAuthenticationCrowdStrikeFalcon.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationCrowdStrikeFalcon%2FASimAuthenticationCrowdStrikeFalcon.json) diff --git a/Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json b/Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json index cbbc4dc500b..e0aa24fc370 100644 --- a/Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json +++ b/Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json @@ -358,6 +358,26 @@ } } }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "linkedASimAuthenticationCrowdStrikeFalcon", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "Workspace": { + "value": "[parameters('Workspace')]" + }, + "WorkspaceRegion": { + "value": "[parameters('WorkspaceRegion')]" + } + } + } + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", @@ -1338,6 +1358,26 @@ } } }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "linkedvimAuthenticationCrowdStrikeFalcon", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "Workspace": { + "value": "[parameters('Workspace')]" + }, + "WorkspaceRegion": { + "value": "[parameters('WorkspaceRegion')]" + } + } + } + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", diff --git a/Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json b/Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json index ba846d0f9b1..6e2f4f55048 100644 --- a/Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json +++ b/Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json @@ -27,7 +27,7 @@ "displayName": "Authentication ASIM filtering parser", "category": "ASIM", "FunctionAlias": "imAuthentication", - "query": "let Generic=(starttime: datetime=datetime(null), endtime: datetime=datetime(null), username_has_any: dynamic = dynamic([]), targetappname_has_any: dynamic = dynamic([]), srcipaddr_has_any_prefix: dynamic = dynamic([]), srchostname_has_any: dynamic = dynamic([]), eventtype_in: dynamic = dynamic([]), eventresultdetails_in: dynamic = dynamic([]), eventresult: string = '*', pack: bool=false) {\n let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\n let imAuthenticationBuiltInDisabled=toscalar('ExcludeimAuthenticationBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers));\n union isfuzzy=true\n vimAuthenticationEmpty\n , vimAuthenticationAADManagedIdentitySignInLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )))\n , vimAuthenticationAADNonInteractiveUserSignInLogs(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )))\n , vimAuthenticationAADServicePrincipalSignInLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )))\n , vimAuthenticationSigninLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSigninLogs' in (DisabledParsers) )))\n , vimAuthenticationAWSCloudTrail (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled = (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAWSCloudTrail' in (DisabledParsers) )))\n , vimAuthenticationOktaSSO (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaSSO' in (DisabledParsers) )))\n , vimAuthenticationOktaSystemLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaSystemLogs' in (DisabledParsers) )))\n , vimAuthenticationOktaV2 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaV2' in (DisabledParsers) )))\n , vimAuthenticationM365Defender (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationM365Defender' in (DisabledParsers) )))\n , vimAuthenticationMicrosoftWindowsEvent (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )))\n , vimAuthenticationMD4IoT (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationMD4IoT' in (DisabledParsers) )))\n , vimAuthenticationPostgreSQL (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPostgreSQL' in (DisabledParsers) )))\n , vimAuthenticationSshd (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSshd' in (DisabledParsers) )))\n , vimAuthenticationSu (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSu' in (DisabledParsers) )))\n , vimAuthenticationSudo (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSudo' in (DisabledParsers) )))\n , vimAuthenticationCiscoASA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoASA' in (DisabledParsers) )))\n , vimAuthenticationCiscoDNAC (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoDNAC' in (DisabledParsers) )))\n , vimAuthenticationCiscoFTD (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoFTD' in (DisabledParsers) )))\n , vimAuthenticationCiscoMeraki (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoMeraki' in (DisabledParsers) )))\n , vimAuthenticationCiscoMerakiSyslog (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )))\n , vimAuthenticationCiscoIOS (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoIOS' in (DisabledParsers) )))\n , vimAuthenticationCiscoISE (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoISE' in (DisabledParsers) )))\n , vimAuthenticationCiscoISEAdministrator (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoISEAdministrator' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationBarracudaWAF (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationBarracudaWAF' in (DisabledParsers) )))\n , vimAuthenticationVectraXDRAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVectraXDRAudit' in (DisabledParsers) )))\n , vimAuthenticationGoogleWorkspace (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationGoogleWorkspace' in (DisabledParsers) )))\n , vimAuthenticationGoogleWorkspaceLogins (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationGoogleWorkspaceLogins' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationSalesforceSC (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSalesforceSC' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationSalesforceLoginHistory (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSalesforceLoginHistory' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoCortexDataLake (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )))\n , vimAuthenticationSentinelOne (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSentinelOne' in (DisabledParsers) )))\n , vimAuthenticationCrowdStrikeFalconHost (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )))\n , vimAuthenticationVMwareCarbonBlackCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )))\n , vimAuthenticationVMwareVCenter (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationIllumioSaaSCore (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationIllumioSaaS' in (DisabledParsers) )))\n , vimAuthenticationNative (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationNative' in (DisabledParsers) )))\n , vimAuthenticationFortinetFortigate (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationFortigate' in (DisabledParsers) )))\n , vimAuthenticationVMwareESXi (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareESXi' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoPanOS (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoPanOS' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoGlobalProtect (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoPrismaCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoPrismaCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationAlibabaCloudActionTrail (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAlibabaCloudActionTrail' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationWizCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationWizCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationOracleOCI (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOracleOCI' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationArubaNetworksClearPass (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationArubaNetworksClearPass' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationCyberArkAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCyberArkAudit' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationZscalerZPA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationZscalerZPA' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationOktaAuth0 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaAuth0' in (DisabledParsers) )), pack=pack)\n};\nGeneric(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, pack=pack)\n", + "query": "let Generic=(starttime: datetime=datetime(null), endtime: datetime=datetime(null), username_has_any: dynamic = dynamic([]), targetappname_has_any: dynamic = dynamic([]), srcipaddr_has_any_prefix: dynamic = dynamic([]), srchostname_has_any: dynamic = dynamic([]), eventtype_in: dynamic = dynamic([]), eventresultdetails_in: dynamic = dynamic([]), eventresult: string = '*', pack: bool=false) {\n let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\n let imAuthenticationBuiltInDisabled=toscalar('ExcludeimAuthenticationBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers));\n union isfuzzy=true\n vimAuthenticationEmpty\n , vimAuthenticationAADManagedIdentitySignInLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )))\n , vimAuthenticationAADNonInteractiveUserSignInLogs(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )))\n , vimAuthenticationAADServicePrincipalSignInLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )))\n , vimAuthenticationSigninLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSigninLogs' in (DisabledParsers) )))\n , vimAuthenticationAWSCloudTrail (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled = (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAWSCloudTrail' in (DisabledParsers) )))\n , vimAuthenticationOktaSSO (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaSSO' in (DisabledParsers) )))\n , vimAuthenticationOktaSystemLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaSystemLogs' in (DisabledParsers) )))\n , vimAuthenticationOktaV2 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaV2' in (DisabledParsers) )))\n , vimAuthenticationM365Defender (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationM365Defender' in (DisabledParsers) )))\n , vimAuthenticationMicrosoftWindowsEvent (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )))\n , vimAuthenticationMD4IoT (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationMD4IoT' in (DisabledParsers) )))\n , vimAuthenticationPostgreSQL (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPostgreSQL' in (DisabledParsers) )))\n , vimAuthenticationSshd (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSshd' in (DisabledParsers) )))\n , vimAuthenticationSu (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSu' in (DisabledParsers) )))\n , vimAuthenticationSudo (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSudo' in (DisabledParsers) )))\n , vimAuthenticationCiscoASA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoASA' in (DisabledParsers) )))\n , vimAuthenticationCiscoDNAC (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoDNAC' in (DisabledParsers) )))\n , vimAuthenticationCiscoFTD (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoFTD' in (DisabledParsers) )))\n , vimAuthenticationCiscoMeraki (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoMeraki' in (DisabledParsers) )))\n , vimAuthenticationCiscoMerakiSyslog (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )))\n , vimAuthenticationCiscoIOS (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoIOS' in (DisabledParsers) )))\n , vimAuthenticationCiscoISE (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoISE' in (DisabledParsers) )))\n , vimAuthenticationCiscoISEAdministrator (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoISEAdministrator' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationBarracudaWAF (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationBarracudaWAF' in (DisabledParsers) )))\n , vimAuthenticationVectraXDRAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVectraXDRAudit' in (DisabledParsers) )))\n , vimAuthenticationGoogleWorkspace (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationGoogleWorkspace' in (DisabledParsers) )))\n , vimAuthenticationGoogleWorkspaceLogins (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationGoogleWorkspaceLogins' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationSalesforceSC (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSalesforceSC' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationSalesforceLoginHistory (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSalesforceLoginHistory' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoCortexDataLake (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )))\n , vimAuthenticationSentinelOne (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSentinelOne' in (DisabledParsers) )))\n , vimAuthenticationCrowdStrikeFalconHost (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )))\n , vimAuthenticationVMwareCarbonBlackCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )))\n , vimAuthenticationVMwareVCenter (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationIllumioSaaSCore (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationIllumioSaaS' in (DisabledParsers) )))\n , vimAuthenticationNative (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationNative' in (DisabledParsers) )))\n , vimAuthenticationFortinetFortigate (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationFortigate' in (DisabledParsers) )))\n , vimAuthenticationVMwareESXi (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareESXi' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoPanOS (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoPanOS' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoGlobalProtect (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoPrismaCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoPrismaCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationAlibabaCloudActionTrail (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAlibabaCloudActionTrail' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationWizCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationWizCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationOracleOCI (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOracleOCI' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationArubaNetworksClearPass (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationArubaNetworksClearPass' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationCyberArkAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCyberArkAudit' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationZscalerZPA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationZscalerZPA' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationOktaAuth0 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaAuth0' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationCrowdStrikeFalcon (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled=(imAuthenticationBuiltInDisabled or ('ExcludevimAuthenticationCrowdStrikeFalcon' in (DisabledParsers))), pack=pack)\n};\nGeneric(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, pack=pack)\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),username_has_any:dynamic=dynamic([]),targetappname_has_any:dynamic=dynamic([]),srcipaddr_has_any_prefix:dynamic=dynamic([]),srchostname_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresultdetails_in:dynamic=dynamic([]),eventresult:string='*',pack:bool=False" } diff --git a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/README.md b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/README.md new file mode 100644 index 00000000000..eb0a1153097 --- /dev/null +++ b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/README.md @@ -0,0 +1,21 @@ +# CrowdStrike Falcon ASIM Authentication Normalization Parser + +ARM template for ASIM Authentication schema parser for CrowdStrike Falcon. + +This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. + + +The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. + +For more information, see: + +- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) +- [Deploy all of ASIM](https://aka.ms/DeployASIM) +- [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc) + +For the changelog, see: +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md) + +
+ +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationCrowdStrikeFalcon%2FvimAuthenticationCrowdStrikeFalcon.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationCrowdStrikeFalcon%2FvimAuthenticationCrowdStrikeFalcon.json) diff --git a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json new file mode 100644 index 00000000000..532c931f9c6 --- /dev/null +++ b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/vimAuthenticationCrowdStrikeFalcon')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "Authentication ASIM filtering parser for CrowdStrike Falcon", + "category": "ASIM", + "FunctionAlias": "vimAuthenticationCrowdStrikeFalcon", + "query": "let parser = (\n starttime:datetime = datetime(null),\n endtime:datetime = datetime(null),\n srcipaddr_has_any_prefix:dynamic = dynamic([]),\n srchostname_has_any:dynamic = dynamic([]),\n username_has_any:dynamic = dynamic([]),\n targetappname_has_any:dynamic = dynamic([]),\n eventtype_in:dynamic = dynamic([]),\n eventresult:string = \"*\",\n eventresultdetails_in:dynamic = dynamic([]),\n disabled:bool = false,\n pack:bool = false\n) {\n CrowdStrike_Auth_Events_CL\n | where not(disabled)\n // This source has no target application name; an active application filter cannot match.\n | where array_length(targetappname_has_any) == 0\n | extend EventName = coalesce(event_simpleName, tostring(split(name, \"V\")[0]))\n | where EventName in~ (\"UserLogon\", \"UserLogonMac\", \"UserLogonLin\", \"UserLogoff\", \"UserLogoffMac\", \"UserLogoffLin\", \"UserLogonFailed\", \"UserLogonFailed2\", \"UserLogonFailed2Mac\", \"UserLogonFailed2Lin\", \"IoSessionLoggedOn\")\n | extend SourceFields = iff(pack, pack_all(), dynamic({}))\n | extend\n EventType = iff(EventName startswith \"UserLogoff\", \"Logoff\", \"Logon\"),\n EventResult = iff(EventName startswith \"UserLogonFailed\", \"Failure\", \"Success\"),\n EventOriginalType = EventName,\n EventOriginalSubType = LogonType,\n EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat(\"/\", SubStatus), \"\")),\n EventStartTime = coalesce(\n unixtime_seconds_todatetime(ContextTimeStamp),\n unixtime_milliseconds_todatetime(timestamp),\n unixtime_seconds_todatetime(iff(EventName startswith \"UserLogoff\", LogoffTime, LogonTime)),\n TimeGenerated),\n DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip),\n ComputerName = tostring(AdditionalFields.ComputerName),\n SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6),\n TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains \"\\\\\" and UserName !contains \"@\", strcat(LogonDomain, \"\\\\\", UserName), UserName)),\n TargetUserId = coalesce(UserSid, UID),\n TargetUserIdType = case(isnotempty(UserSid), \"SID\", isnotempty(UID), \"UID\", \"\"),\n TargetUserType = case(UserIsAdmin == \"1\", \"Admin\", UserIsAdmin == \"0\", \"Regular\", \"\"),\n TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId),\n DvcOs = case(event_platform =~ \"Win\", \"Windows\", event_platform =~ \"Mac\", \"macOS\", event_platform =~ \"Lin\", \"Linux\", event_platform)\n | where (isnull(starttime) or EventStartTime >= starttime)\n and (isnull(endtime) or EventStartTime <= endtime)\n and (array_length(eventtype_in) == 0 or EventType in~ (eventtype_in))\n and (eventresult == \"*\" or EventResult =~ eventresult)\n and (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix) or SrcIpAddr in~ (srcipaddr_has_any_prefix))\n and (array_length(username_has_any) == 0 or TargetUsername has_any (username_has_any))\n | extend\n EventEndTime = EventStartTime,\n EventSubType = case(LogonType == \"0\", \"System\", LogonType in (\"2\", \"7\", \"11\"), \"Interactive\", LogonType == \"3\", \"Remote\", LogonType == \"5\", \"Service\", LogonType == \"8\", \"NetworkCleartext\", LogonType == \"10\", \"RemoteInteractive\", \"\"),\n EventResultDetails = iff(EventResult == \"Failure\", \"Other\", \"\"),\n TargetUsernameType = case(TargetUsername contains \"@\", \"UPN\", TargetUsername contains \"\\\\\", \"Windows\", isnotempty(TargetUsername), \"Simple\", \"\"),\n DvcHostname = iff(tostring(split(ComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ComputerName, \".\")[0]), \"\"),\n DvcDomain = iff(ComputerName contains \".\", substring(ComputerName, indexof(ComputerName, \".\") + 1), \"\"),\n DvcFQDN = iff(ComputerName contains \".\", ComputerName, \"\"),\n SrcHostname = iff(tostring(split(ClientComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ClientComputerName, \".\")[0]), \"\"),\n SrcDomain = iff(ClientComputerName contains \".\", substring(ClientComputerName, indexof(ClientComputerName, \".\") + 1), \"\"),\n SrcFQDN = iff(ClientComputerName contains \".\", ClientComputerName, \"\")\n | where (array_length(srchostname_has_any) == 0 or SrcHostname has_any (srchostname_has_any))\n and (array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in))\n | project-rename\n DvcId = aid,\n DvcScopeId = cid,\n TargetUserSid = UserSid,\n TargetUserUid = UID,\n TargetUserUpn = UserPrincipal,\n TargetUserScope = LogonDomain,\n TargetOriginalUserType = UserIsAdmin,\n LogonProtocol = AuthenticationPackage\n | extend\n Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName),\n DvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcDomainType = iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname),\n TargetHostname = DvcHostname,\n TargetDomain = DvcDomain,\n TargetDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n TargetFQDN = DvcFQDN,\n TargetDvcId = DvcId,\n TargetDvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n TargetIpAddr = DvcIpAddr,\n TargetDvcOs = DvcOs,\n TargetDvcScopeId = DvcScopeId,\n EventCount = int(1),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = \"Informational\",\n DvcEntityKey = \"\",\n ActorUserEntityKey = \"\",\n ActorUserAdditionalIds = dynamic([]),\n TargetUserEntityKey = \"\",\n TargetUserAdditionalIds = dynamic([]),\n SrcSystemEntityKey = \"\",\n TargetSystemEntityKey = \"\",\n ActingApplicationEntityKey = \"\",\n TargetApplicationEntityKey = \"\",\n AdditionalEntities = dynamic([]),\n AdditionalFields = SourceFields\n | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n EventType, EventSubType, EventResult, EventResultDetails,\n EventOriginalType, EventOriginalSubType, EventOriginalResultDetails,\n Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType,\n DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey,\n Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN,\n TargetHostname, TargetDomain, TargetDomainType, TargetFQDN,\n TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId,\n TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType,\n TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope,\n TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol,\n Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds,\n TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey,\n TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey,\n AdditionalEntities, AdditionalFields\n};\nparser(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, eventtype_in=eventtype_in, eventresult=eventresult, eventresultdetails_in=eventresultdetails_in, disabled=disabled, pack=pack)\n", + "version": 1, + "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr_has_any_prefix:dynamic=dynamic([]),srchostname_has_any:dynamic=dynamic([]),username_has_any:dynamic=dynamic([]),targetappname_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresult:string='*',eventresultdetails_in:dynamic=dynamic([]),disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md index f3e2b8464d0..c47151969be 100644 --- a/Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md +++ b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md @@ -1,5 +1,9 @@ # Changelog for ASimAuthentication.yaml +## Version 0.2.29 + +- (2026-10-23) Add the CrowdStrike Falcon Data Replicator Authentication parser, including disable-watchlist and pack parameter support. + ## Version 0.2.28 - (2026-10-13) Add the Okta Auth0 Authentication parser. [PR #15254](https://github.com/Azure/Azure-Sentinel/pull/15254) diff --git a/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md new file mode 100644 index 00000000000..f29d463689c --- /dev/null +++ b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md @@ -0,0 +1,8 @@ +# Changelog for ASimAuthenticationCrowdStrikeFalcon.yaml + +## Version 0.1.0 + +- (2026-10-23) Initial CrowdStrike Falcon Data Replicator Authentication parser for CrowdStrike_Auth_Events_CL. +- Normalize supported logon, failed logon, and logoff events, including versioned event-name fallbacks. +- Map available identity, device, address, protocol, and session fields, including columns empty in the initial source sample. +- Preserve all original columns with pack=true without decoding undocumented flags or status codes. diff --git a/Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md b/Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md index 1cd3bc69919..4453453c5df 100644 --- a/Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md +++ b/Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md @@ -1,5 +1,9 @@ # Changelog for imAuthentication.yaml +## Version 0.3.25 + +- (2026-10-23) Add the CrowdStrike Falcon Data Replicator Authentication filtering parser and forward all supported filtering and pack parameters. + ## Version 0.3.24 - (2026-10-13) Add the Okta Auth0 Authentication parser. [PR #15254](https://github.com/Azure/Azure-Sentinel/pull/15254) diff --git a/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md b/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md new file mode 100644 index 00000000000..d6554064360 --- /dev/null +++ b/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md @@ -0,0 +1,8 @@ +# Changelog for vimAuthenticationCrowdStrikeFalcon.yaml + +## Version 0.1.0 + +- (2026-10-23) Initial CrowdStrike Falcon Data Replicator Authentication filtering parser for CrowdStrike_Auth_Events_CL. +- Support time, source IPv4 prefix or exact IP, source hostname, username, event type, result, and result-detail filtering. +- Return no events for a nonempty target application filter because the source has no target application name. +- Preserve the parameterless parser mappings and optional original-source packing. diff --git a/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml b/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml index 2f24513ee3d..0c27510416c 100644 --- a/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml +++ b/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml @@ -1,7 +1,7 @@ Parser: Title: Authentication ASIM parser - Version: '0.2.28' - LastUpdated: Oct 13, 2026 + Version: '0.2.29' + LastUpdated: Oct 23, 2026 Product: Name: Source agnostic Normalization: @@ -60,6 +60,7 @@ ParserQuery: | ASimAuthenticationVMwareCarbonBlackCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )), ASimAuthenticationVMwareVCenter (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareVCenter' in (DisabledParsers) ), pack=pack), ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )), + ASimAuthenticationCrowdStrikeFalcon (disabled=(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalcon' in (DisabledParsers))), pack=pack), ASimAuthenticationIllumioSaaSCore (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationIllumioSaaSCore' in (DisabledParsers) )), ASimAuthenticationNative (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationNative' in (DisabledParsers) )), ASimAuthenticationPaloAltoPanOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPanOS' in (DisabledParsers) ), pack=pack), @@ -108,6 +109,7 @@ Parsers: - _ASim_Authentication_VMwareCarbonBlackCloud - _ASim_Authentication_VMwareVCenter - _ASim_Authentication_CrowdStrikeFalconHost + - _ASim_Authentication_CrowdStrikeFalcon - _ASim_Authentication_GoogleWorkspace - _ASim_Authentication_GoogleWorkspaceLogins - _ASim_Authentication_SalesforceSC diff --git a/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalcon.yaml b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalcon.yaml new file mode 100644 index 00000000000..a2499a391ba --- /dev/null +++ b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalcon.yaml @@ -0,0 +1,127 @@ +Parser: + Title: Authentication ASIM parser for CrowdStrike Falcon + Version: '0.1.0' + LastUpdated: Oct 23, 2026 +Product: + Name: CrowdStrike Falcon +Normalization: + Schema: Authentication + Version: '1.0.0' +References: +- Title: ASIM Authentication Schema + Link: https://aka.ms/ASimAuthenticationDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: CrowdStrike Falcon Data Replicator connector + Link: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/CrowdStrikeS3FDR_ccp/DataConnectorDefinition.json +Description: | + Normalizes CrowdStrike Falcon Data Replicator authentication events from CrowdStrike_Auth_Events_CL to the ASIM Authentication schema. + This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. +ParserName: ASimAuthenticationCrowdStrikeFalcon +EquivalentBuiltInParser: _ASim_Authentication_CrowdStrikeFalcon +ParserParams: + - Name: disabled + Type: bool + Default: false + - Name: pack + Type: bool + Default: false +ParserQuery: | + let parser = (disabled:bool = false, pack:bool = false) { + CrowdStrike_Auth_Events_CL + | where not(disabled) + | extend EventName = coalesce(event_simpleName, tostring(split(name, "V")[0])) + | where EventName in~ ("UserLogon", "UserLogonMac", "UserLogonLin", "UserLogoff", "UserLogoffMac", "UserLogoffLin", "UserLogonFailed", "UserLogonFailed2", "UserLogonFailed2Mac", "UserLogonFailed2Lin", "IoSessionLoggedOn") + | extend SourceFields = iff(pack, pack_all(), dynamic({})) + | extend + EventType = iff(EventName startswith "UserLogoff", "Logoff", "Logon"), + EventResult = iff(EventName startswith "UserLogonFailed", "Failure", "Success"), + EventOriginalType = EventName, + EventOriginalSubType = LogonType, + EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat("/", SubStatus), "")), + EventStartTime = coalesce( + unixtime_seconds_todatetime(ContextTimeStamp), + unixtime_milliseconds_todatetime(timestamp), + unixtime_seconds_todatetime(iff(EventName startswith "UserLogoff", LogoffTime, LogonTime)), + TimeGenerated), + DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip), + ComputerName = tostring(AdditionalFields.ComputerName), + SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6), + TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains "\\" and UserName !contains "@", strcat(LogonDomain, "\\", UserName), UserName)), + TargetUserId = coalesce(UserSid, UID), + TargetUserIdType = case(isnotempty(UserSid), "SID", isnotempty(UID), "UID", ""), + TargetUserType = case(UserIsAdmin == "1", "Admin", UserIsAdmin == "0", "Regular", ""), + TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId), + DvcOs = case(event_platform =~ "Win", "Windows", event_platform =~ "Mac", "macOS", event_platform =~ "Lin", "Linux", event_platform) + | extend + EventEndTime = EventStartTime, + EventSubType = case(LogonType == "0", "System", LogonType in ("2", "7", "11"), "Interactive", LogonType == "3", "Remote", LogonType == "5", "Service", LogonType == "8", "NetworkCleartext", LogonType == "10", "RemoteInteractive", ""), + EventResultDetails = iff(EventResult == "Failure", "Other", ""), + TargetUsernameType = case(TargetUsername contains "@", "UPN", TargetUsername contains "\\", "Windows", isnotempty(TargetUsername), "Simple", ""), + DvcHostname = iff(tostring(split(ComputerName, ".")[0]) matches regex @"^[a-zA-Z0-9-]{1,61}$", tostring(split(ComputerName, ".")[0]), ""), + DvcDomain = iff(ComputerName contains ".", substring(ComputerName, indexof(ComputerName, ".") + 1), ""), + DvcFQDN = iff(ComputerName contains ".", ComputerName, ""), + SrcHostname = iff(tostring(split(ClientComputerName, ".")[0]) matches regex @"^[a-zA-Z0-9-]{1,61}$", tostring(split(ClientComputerName, ".")[0]), ""), + SrcDomain = iff(ClientComputerName contains ".", substring(ClientComputerName, indexof(ClientComputerName, ".") + 1), ""), + SrcFQDN = iff(ClientComputerName contains ".", ClientComputerName, "") + | project-rename + DvcId = aid, + DvcScopeId = cid, + TargetUserSid = UserSid, + TargetUserUid = UID, + TargetUserUpn = UserPrincipal, + TargetUserScope = LogonDomain, + TargetOriginalUserType = UserIsAdmin, + LogonProtocol = AuthenticationPackage + | extend + Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName), + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + DvcDomainType = iff(isnotempty(DvcDomain), "FQDN", ""), + SrcDomainType = iff(isnotempty(SrcDomain), "FQDN", ""), + Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname), + TargetHostname = DvcHostname, + TargetDomain = DvcDomain, + TargetDomainType = iff(isnotempty(DvcDomain), "FQDN", ""), + TargetFQDN = DvcFQDN, + TargetDvcId = DvcId, + TargetDvcIdType = iff(isnotempty(DvcId), "Other", ""), + TargetIpAddr = DvcIpAddr, + TargetDvcOs = DvcOs, + TargetDvcScopeId = DvcScopeId, + EventCount = int(1), + EventVendor = "CrowdStrike", + EventProduct = "Falcon", + EventSchema = "Authentication", + EventSchemaVersion = "1.0.0", + EventSeverity = "Informational", + DvcEntityKey = "", + ActorUserEntityKey = "", + ActorUserAdditionalIds = dynamic([]), + TargetUserEntityKey = "", + TargetUserAdditionalIds = dynamic([]), + SrcSystemEntityKey = "", + TargetSystemEntityKey = "", + ActingApplicationEntityKey = "", + TargetApplicationEntityKey = "", + AdditionalEntities = dynamic([]), + AdditionalFields = SourceFields + | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr + | project + TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, + EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity, + EventType, EventSubType, EventResult, EventResultDetails, + EventOriginalType, EventOriginalSubType, EventOriginalResultDetails, + Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType, + DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey, + Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN, + TargetHostname, TargetDomain, TargetDomainType, TargetFQDN, + TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId, + TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType, + TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope, + TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol, + Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds, + TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey, + TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey, + AdditionalEntities, AdditionalFields + }; + parser(disabled=disabled, pack=pack) diff --git a/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml b/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml index 266f77904eb..305c4766931 100644 --- a/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml +++ b/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml @@ -1,7 +1,7 @@ Parser: Title: Authentication ASIM filtering parser - Version: '0.3.24' - LastUpdated: Oct 13, 2026 + Version: '0.3.25' + LastUpdated: Oct 23, 2026 Product: Name: Source agnostic Normalization: @@ -101,10 +101,12 @@ ParserQuery: | , vimAuthenticationCyberArkAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCyberArkAudit' in (DisabledParsers) )), pack=pack) , vimAuthenticationZscalerZPA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationZscalerZPA' in (DisabledParsers) )), pack=pack) , vimAuthenticationOktaAuth0 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaAuth0' in (DisabledParsers) )), pack=pack) + , vimAuthenticationCrowdStrikeFalcon (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled=(imAuthenticationBuiltInDisabled or ('ExcludevimAuthenticationCrowdStrikeFalcon' in (DisabledParsers))), pack=pack) }; Generic(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, pack=pack) Parsers: - _Im_Authentication_Empty + - _Im_Authentication_CrowdStrikeFalcon - _Im_Authentication_AADManagedIdentitySignInLogs - _Im_Authentication_AADNonInteractiveUserSignInLogs - _Im_Authentication_AADServicePrincipalSignInLogs diff --git a/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalcon.yaml b/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalcon.yaml new file mode 100644 index 00000000000..81c5086c015 --- /dev/null +++ b/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalcon.yaml @@ -0,0 +1,176 @@ +Parser: + Title: Authentication ASIM filtering parser for CrowdStrike Falcon + Version: '0.1.0' + LastUpdated: Oct 23, 2026 +Product: + Name: CrowdStrike Falcon +Normalization: + Schema: Authentication + Version: '1.0.0' +References: +- Title: ASIM Authentication Schema + Link: https://aka.ms/ASimAuthenticationDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: CrowdStrike Falcon Data Replicator connector + Link: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/CrowdStrikeS3FDR_ccp/DataConnectorDefinition.json +Description: | + Filters and normalizes CrowdStrike Falcon Data Replicator authentication events from CrowdStrike_Auth_Events_CL to the ASIM Authentication schema. + This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. +ParserName: vimAuthenticationCrowdStrikeFalcon +EquivalentBuiltInParser: _Im_Authentication_CrowdStrikeFalcon +ParserParams: + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: srcipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: srchostname_has_any + Type: dynamic + Default: dynamic([]) + - Name: username_has_any + Type: dynamic + Default: dynamic([]) + - Name: targetappname_has_any + Type: dynamic + Default: dynamic([]) + - Name: eventtype_in + Type: dynamic + Default: dynamic([]) + - Name: eventresult + Type: string + Default: '*' + - Name: eventresultdetails_in + Type: dynamic + Default: dynamic([]) + - Name: disabled + Type: bool + Default: false + - Name: pack + Type: bool + Default: false +ParserQuery: | + let parser = ( + starttime:datetime = datetime(null), + endtime:datetime = datetime(null), + srcipaddr_has_any_prefix:dynamic = dynamic([]), + srchostname_has_any:dynamic = dynamic([]), + username_has_any:dynamic = dynamic([]), + targetappname_has_any:dynamic = dynamic([]), + eventtype_in:dynamic = dynamic([]), + eventresult:string = "*", + eventresultdetails_in:dynamic = dynamic([]), + disabled:bool = false, + pack:bool = false + ) { + CrowdStrike_Auth_Events_CL + | where not(disabled) + // This source has no target application name; an active application filter cannot match. + | where array_length(targetappname_has_any) == 0 + | extend EventName = coalesce(event_simpleName, tostring(split(name, "V")[0])) + | where EventName in~ ("UserLogon", "UserLogonMac", "UserLogonLin", "UserLogoff", "UserLogoffMac", "UserLogoffLin", "UserLogonFailed", "UserLogonFailed2", "UserLogonFailed2Mac", "UserLogonFailed2Lin", "IoSessionLoggedOn") + | extend SourceFields = iff(pack, pack_all(), dynamic({})) + | extend + EventType = iff(EventName startswith "UserLogoff", "Logoff", "Logon"), + EventResult = iff(EventName startswith "UserLogonFailed", "Failure", "Success"), + EventOriginalType = EventName, + EventOriginalSubType = LogonType, + EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat("/", SubStatus), "")), + EventStartTime = coalesce( + unixtime_seconds_todatetime(ContextTimeStamp), + unixtime_milliseconds_todatetime(timestamp), + unixtime_seconds_todatetime(iff(EventName startswith "UserLogoff", LogoffTime, LogonTime)), + TimeGenerated), + DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip), + ComputerName = tostring(AdditionalFields.ComputerName), + SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6), + TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains "\\" and UserName !contains "@", strcat(LogonDomain, "\\", UserName), UserName)), + TargetUserId = coalesce(UserSid, UID), + TargetUserIdType = case(isnotempty(UserSid), "SID", isnotempty(UID), "UID", ""), + TargetUserType = case(UserIsAdmin == "1", "Admin", UserIsAdmin == "0", "Regular", ""), + TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId), + DvcOs = case(event_platform =~ "Win", "Windows", event_platform =~ "Mac", "macOS", event_platform =~ "Lin", "Linux", event_platform) + | where (isnull(starttime) or EventStartTime >= starttime) + and (isnull(endtime) or EventStartTime <= endtime) + and (array_length(eventtype_in) == 0 or EventType in~ (eventtype_in)) + and (eventresult == "*" or EventResult =~ eventresult) + and (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix) or SrcIpAddr in~ (srcipaddr_has_any_prefix)) + and (array_length(username_has_any) == 0 or TargetUsername has_any (username_has_any)) + | extend + EventEndTime = EventStartTime, + EventSubType = case(LogonType == "0", "System", LogonType in ("2", "7", "11"), "Interactive", LogonType == "3", "Remote", LogonType == "5", "Service", LogonType == "8", "NetworkCleartext", LogonType == "10", "RemoteInteractive", ""), + EventResultDetails = iff(EventResult == "Failure", "Other", ""), + TargetUsernameType = case(TargetUsername contains "@", "UPN", TargetUsername contains "\\", "Windows", isnotempty(TargetUsername), "Simple", ""), + DvcHostname = iff(tostring(split(ComputerName, ".")[0]) matches regex @"^[a-zA-Z0-9-]{1,61}$", tostring(split(ComputerName, ".")[0]), ""), + DvcDomain = iff(ComputerName contains ".", substring(ComputerName, indexof(ComputerName, ".") + 1), ""), + DvcFQDN = iff(ComputerName contains ".", ComputerName, ""), + SrcHostname = iff(tostring(split(ClientComputerName, ".")[0]) matches regex @"^[a-zA-Z0-9-]{1,61}$", tostring(split(ClientComputerName, ".")[0]), ""), + SrcDomain = iff(ClientComputerName contains ".", substring(ClientComputerName, indexof(ClientComputerName, ".") + 1), ""), + SrcFQDN = iff(ClientComputerName contains ".", ClientComputerName, "") + | where (array_length(srchostname_has_any) == 0 or SrcHostname has_any (srchostname_has_any)) + and (array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in)) + | project-rename + DvcId = aid, + DvcScopeId = cid, + TargetUserSid = UserSid, + TargetUserUid = UID, + TargetUserUpn = UserPrincipal, + TargetUserScope = LogonDomain, + TargetOriginalUserType = UserIsAdmin, + LogonProtocol = AuthenticationPackage + | extend + Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName), + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + DvcDomainType = iff(isnotempty(DvcDomain), "FQDN", ""), + SrcDomainType = iff(isnotempty(SrcDomain), "FQDN", ""), + Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname), + TargetHostname = DvcHostname, + TargetDomain = DvcDomain, + TargetDomainType = iff(isnotempty(DvcDomain), "FQDN", ""), + TargetFQDN = DvcFQDN, + TargetDvcId = DvcId, + TargetDvcIdType = iff(isnotempty(DvcId), "Other", ""), + TargetIpAddr = DvcIpAddr, + TargetDvcOs = DvcOs, + TargetDvcScopeId = DvcScopeId, + EventCount = int(1), + EventVendor = "CrowdStrike", + EventProduct = "Falcon", + EventSchema = "Authentication", + EventSchemaVersion = "1.0.0", + EventSeverity = "Informational", + DvcEntityKey = "", + ActorUserEntityKey = "", + ActorUserAdditionalIds = dynamic([]), + TargetUserEntityKey = "", + TargetUserAdditionalIds = dynamic([]), + SrcSystemEntityKey = "", + TargetSystemEntityKey = "", + ActingApplicationEntityKey = "", + TargetApplicationEntityKey = "", + AdditionalEntities = dynamic([]), + AdditionalFields = SourceFields + | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr + | project + TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, + EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity, + EventType, EventSubType, EventResult, EventResultDetails, + EventOriginalType, EventOriginalSubType, EventOriginalResultDetails, + Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType, + DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey, + Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN, + TargetHostname, TargetDomain, TargetDomainType, TargetFQDN, + TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId, + TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType, + TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope, + TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol, + Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds, + TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey, + TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey, + AdditionalEntities, AdditionalFields + }; + parser(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, eventtype_in=eventtype_in, eventresult=eventresult, eventresultdetails_in=eventresultdetails_in, disabled=disabled, pack=pack) diff --git a/Sample Data/ASIM/CrowdStrike_Falcon_Authentication_IngestedLogs.csv b/Sample Data/ASIM/CrowdStrike_Falcon_Authentication_IngestedLogs.csv new file mode 100644 index 00000000000..72fdc5135c7 --- /dev/null +++ b/Sample Data/ASIM/CrowdStrike_Falcon_Authentication_IngestedLogs.csv @@ -0,0 +1,11 @@ +"TimeGenerated","event_simpleName","timestamp","aip","aid","UserName","event_platform","ContextTimeStamp","name","ConfigBuild","CrowdStrikeId","ConfigStateHash","ContextProcessId","ContextThreadId","BoundingLimitCount","BoundingLimitDuration","Entitlements","EffectiveTransmissionClass","cid","OciContainerId","TreeId","LogonType","LogonTime","UserIsAdmin","LogonDomain","RemoteAccount","ClientComputerName","UserPrincipal","RawProcessId","UserSid","LogonServer","AuthenticationPackage","AuthenticationId","UserLogonFlags","RemoteAddressIP4","RemoteAddressIP6","UserLogoffType","LogoffTime","SessionId","UserFlags","PrivilegesBitmask","PasswordLastSet","EventOrigin","TargetProcessId","Status","EtwRawProcessId","EtwRawThreadId","SubStatus","LocalSession","EnabledPrivilegesBitmask","UserGroupsBitmask","LinkedAuthenticationId","UserCanonical","LoginSessionId","AuthenticationUuidAsString","UID","AuthenticationUuid","AuthenticationIdMac","ResendToCloud","LogonId","ConfigStateHashA1","AdditionalFields","TenantId","Type","_ResourceId" +"2026-10-22T12:00:00.0000000+00:00","UserLogon","1792670400000","203.0.113.1","00000000000000000000000000000001","testuser1","Win","1792670400","UserLogonV1","synthetic-build","00000000-0000-0000-0000-000000000001","synthetic-state","1001","2001","1","0","0","0","00000000000000000000000000000000","synthetic-container-1","3001","0","1792670400","1","EXAMPLE","1","client1.example.test","testuser1@example.test","4001","S-1-5-21-100-200-300-1","dc1.example.test","Kerberos","5001","0","192.0.2.1","2001:db8::1","3","","1","0","0","1790078400","1","6001","0","7001","8001","0","0","0","0","9001","EXAMPLE\testuser1","10001","00000000-0000-0000-0000-000000000001","","00000000-0000-0000-0000-000000000001","","0","12001","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.1"",""ComputerName"":""server1.example.test"",""LocalAddressIP6"":""2001:db8:1::1"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:01:00.0000000+00:00","UserLogoff","1792670460000","203.0.113.2","00000000000000000000000000000002","testuser2","Win","1792670460","UserLogoffV1","synthetic-build","00000000-0000-0000-0000-000000000002","synthetic-state","1002","2002","1","0","0","0","00000000000000000000000000000000","synthetic-container-2","3002","2","1792670460","0","EXAMPLE","1","client2.example.test","testuser2@example.test","4002","S-1-5-21-100-200-300-2","dc1.example.test","Kerberos","5002","1","192.0.2.2","2001:db8::2","3","1792670460","2","0","0","1790078460","1","6002","0","7002","8002","0","0","0","0","9002","EXAMPLE\testuser2","10002","00000000-0000-0000-0000-000000000002","","00000000-0000-0000-0000-000000000002","","0","12002","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.2"",""ComputerName"":""server2.example.test"",""LocalAddressIP6"":""2001:db8:1::2"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:02:00.0000000+00:00","UserLogonFailed","1792670520000","203.0.113.3","00000000000000000000000000000003","testuser3","Win","1792670520","UserLogonFailedV1","synthetic-build","00000000-0000-0000-0000-000000000003","synthetic-state","1003","2003","1","0","0","0","00000000000000000000000000000000","synthetic-container-3","3003","3","1792670520","0","EXAMPLE","1","client3.example.test","testuser3@example.test","4003","S-1-5-21-100-200-300-3","dc1.example.test","Kerberos","5003","2","192.0.2.3","2001:db8::3","3","","3","0","0","1790078520","1","6003","0xC000006D","7003","8003","0xC000006A","0","0","0","9003","EXAMPLE\testuser3","10003","00000000-0000-0000-0000-000000000003","","00000000-0000-0000-0000-000000000003","","0","12003","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.3"",""ComputerName"":""server3.example.test"",""LocalAddressIP6"":""2001:db8:1::3"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:03:00.0000000+00:00","UserLogonFailed2","1792670580000","203.0.113.4","00000000000000000000000000000004","testuser4","Win","1792670580","UserLogonFailed2V1","synthetic-build","00000000-0000-0000-0000-000000000004","synthetic-state","1004","2004","1","0","0","0","00000000000000000000000000000000","synthetic-container-4","3004","5","1792670580","0","EXAMPLE","1","client4.example.test","testuser4@example.test","4004","S-1-5-21-100-200-300-4","dc1.example.test","Kerberos","5004","3","192.0.2.4","2001:db8::4","3","","4","0","0","1790078580","1","6004","0xC000006D","7004","8004","0xC000006A","0","0","0","9004","EXAMPLE\testuser4","10004","00000000-0000-0000-0000-000000000004","","00000000-0000-0000-0000-000000000004","","0","12004","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.4"",""ComputerName"":""server4.example.test"",""LocalAddressIP6"":""2001:db8:1::4"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:04:00.0000000+00:00","IoSessionLoggedOn","1792670640000","203.0.113.5","00000000000000000000000000000005","testuser5","Win","1792670640","IoSessionLoggedOnV1","synthetic-build","00000000-0000-0000-0000-000000000005","synthetic-state","1005","2005","1","0","0","0","00000000000000000000000000000000","synthetic-container-5","3005","7","1792670640","0","EXAMPLE","1","client5.example.test","testuser5@example.test","4005","S-1-5-21-100-200-300-5","dc1.example.test","Kerberos","5005","4","192.0.2.5","2001:db8::5","3","","5","0","0","1790078640","1","6005","0","7005","8005","0","0","0","0","9005","EXAMPLE\testuser5","10005","00000000-0000-0000-0000-000000000005","","00000000-0000-0000-0000-000000000005","","0","12005","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.5"",""ComputerName"":""server5.example.test"",""LocalAddressIP6"":""2001:db8:1::5"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:05:00.0000000+00:00","","1792670700000","203.0.113.6","00000000000000000000000000000006","testuser6","Lin","1792670700","UserLogonFailed2LinV1","synthetic-build","00000000-0000-0000-0000-000000000006","synthetic-state","1006","2006","1","0","0","0","00000000000000000000000000000000","synthetic-container-6","3006","8","1792670700","0","EXAMPLE","1","client6.example.test","testuser6@example.test","4006","","dc1.example.test","PAM","5006","5","192.0.2.6","2001:db8::6","3","","6","0","0","1790078700","1","6006","0xC000006D","7006","8006","0xC000006A","0","0","0","9006","EXAMPLE\testuser6","10006","00000000-0000-0000-0000-000000000006","1006","00000000-0000-0000-0000-000000000006","","0","12006","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.6"",""ComputerName"":""server6.example.test"",""LocalAddressIP6"":""2001:db8:1::6"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:06:00.0000000+00:00","","1792670760000","203.0.113.7","00000000000000000000000000000007","testuser7","Mac","1792670760","UserLogonMacV1","synthetic-build","00000000-0000-0000-0000-000000000007","synthetic-state","1007","2007","1","0","0","0","00000000000000000000000000000000","synthetic-container-7","3007","9","1792670760","0","EXAMPLE","1","client7.example.test","testuser7@example.test","4007","","dc1.example.test","PAM","5007","6","192.0.2.7","2001:db8::7","3","","7","0","0","1790078760","1","6007","0","7007","8007","0","0","0","0","9007","EXAMPLE\testuser7","10007","00000000-0000-0000-0000-000000000007","1007","00000000-0000-0000-0000-000000000007","11007","0","12007","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.7"",""ComputerName"":""server7.example.test"",""LocalAddressIP6"":""2001:db8:1::7"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:07:00.0000000+00:00","","1792670820000","203.0.113.8","00000000000000000000000000000008","testuser8","Mac","1792670820","UserLogonFailed2MacV1","synthetic-build","00000000-0000-0000-0000-000000000008","synthetic-state","1008","2008","1","0","0","0","00000000000000000000000000000000","synthetic-container-8","3008","10","1792670820","0","EXAMPLE","1","client8.example.test","testuser8@example.test","4008","","dc1.example.test","PAM","5008","7","","2001:db8::8","3","","8","0","0","1790078820","1","6008","0xC000006D","7008","8008","0xC000006A","0","0","0","9008","EXAMPLE\testuser8","10008","00000000-0000-0000-0000-000000000008","1008","00000000-0000-0000-0000-000000000008","11008","0","12008","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.8"",""ComputerName"":""server8.example.test"",""LocalAddressIP6"":""2001:db8:1::8"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:08:00.0000000+00:00","","1792670880000","203.0.113.9","00000000000000000000000000000009","testuser9","Lin","1792670880","UserLogoffLinV1","synthetic-build","00000000-0000-0000-0000-000000000009","synthetic-state","1009","2009","1","0","0","0","00000000000000000000000000000000","synthetic-container-9","3009","11","1792670880","0","EXAMPLE","1","client9.example.test","testuser9@example.test","4009","","dc1.example.test","PAM","5009","8","192.0.2.9","2001:db8::9","3","1792670880","9","0","0","1790078880","1","6009","0","7009","8009","0","0","0","0","9009","EXAMPLE\testuser9","10009","00000000-0000-0000-0000-000000000009","1009","00000000-0000-0000-0000-000000000009","","0","12009","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.9"",""ComputerName"":""server9.example.test"",""LocalAddressIP6"":""2001:db8:1::9"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:09:00.0000000+00:00","","1792670940000","203.0.113.10","0000000000000000000000000000000a","testuser10","Lin","1792670940","UserLogonLinV1","synthetic-build","00000000-0000-0000-0000-000000000010","synthetic-state","1010","2010","1","0","0","0","00000000000000000000000000000000","synthetic-container-10","3010","4","1792670940","0","EXAMPLE","1","client10.example.test","testuser10@example.test","4010","","dc1.example.test","PAM","5010","9","192.0.2.10","2001:db8::10","3","","10","0","0","1790078940","1","6010","0","7010","8010","0","0","0","0","9010","EXAMPLE\testuser10","10010","00000000-0000-0000-0000-000000000010","1010","00000000-0000-0000-0000-000000000010","","0","12010","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.10"",""ComputerName"":""server10.example.test"",""LocalAddressIP6"":""2001:db8:1::10"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" From 401e2cd0a63a75ef9d50b6a35ba1dcb054c3c5df Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <> Date: Fri, 23 Oct 2026 22:24:35 +0000 Subject: [PATCH 2/6] [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. --- .../ARM/ASimAuthenticationCrowdStrikeFalcon/README.md | 4 ++++ .../ARM/vimAuthenticationCrowdStrikeFalcon/README.md | 1 + 2 files changed, 5 insertions(+) diff --git a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/README.md b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/README.md index 057c669da94..2c53890ae86 100644 --- a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/README.md +++ b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/README.md @@ -2,6 +2,10 @@ ARM template for ASIM Authentication schema parser for CrowdStrike Falcon. +Normalizes CrowdStrike Falcon Data Replicator authentication events from CrowdStrike_Auth_Events_CL to the ASIM Authentication schema. +This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. + + The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. For more information, see: diff --git a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/README.md b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/README.md index eb0a1153097..a3e7d5f2a0b 100644 --- a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/README.md +++ b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/README.md @@ -2,6 +2,7 @@ ARM template for ASIM Authentication schema parser for CrowdStrike Falcon. +Filters and normalizes CrowdStrike Falcon Data Replicator authentication events from CrowdStrike_Auth_Events_CL to the ASIM Authentication schema. This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. From e231952a79f351fe1b41542fed432104708e8924 Mon Sep 17 00:00:00 2001 From: Derrick Lee Date: Fri, 23 Oct 2026 15:28:15 -0700 Subject: [PATCH 3/6] Updates --- .../CHANGELOG/ASimAuthentication.md | 2 +- .../ASimAuthenticationCrowdStrikeFalcon.md | 2 +- .../CHANGELOG/imAuthentication.md | 2 +- .../vimAuthenticationCrowdStrikeFalcon.md | 2 +- .../ASimAuthenticationCrowdStrikeFalcon.yaml | 10 ++-- .../vimAuthenticationCrowdStrikeFalcon.yaml | 48 ++++++++++--------- ...ike_Falcon_Authentication_IngestedLogs.csv | 10 ++-- 7 files changed, 39 insertions(+), 37 deletions(-) diff --git a/Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md index c47151969be..1bc6b360a83 100644 --- a/Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md +++ b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md @@ -2,7 +2,7 @@ ## Version 0.2.29 -- (2026-10-23) Add the CrowdStrike Falcon Data Replicator Authentication parser, including disable-watchlist and pack parameter support. +- (2026-10-23) Add the CrowdStrike Falcon Data Replicator Authentication parser, including disable-watchlist and pack parameter support. - [PR #15415](https://github.com/Azure/Azure-Sentinel/pull/15415) ## Version 0.2.28 diff --git a/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md index f29d463689c..dc6aec59cd3 100644 --- a/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md +++ b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md @@ -2,7 +2,7 @@ ## Version 0.1.0 -- (2026-10-23) Initial CrowdStrike Falcon Data Replicator Authentication parser for CrowdStrike_Auth_Events_CL. +- (2026-10-23) Initial CrowdStrike Falcon Data Replicator Authentication parser for CrowdStrike_Auth_Events_CL. - [PR #15415](https://github.com/Azure/Azure-Sentinel/pull/15415) - Normalize supported logon, failed logon, and logoff events, including versioned event-name fallbacks. - Map available identity, device, address, protocol, and session fields, including columns empty in the initial source sample. - Preserve all original columns with pack=true without decoding undocumented flags or status codes. diff --git a/Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md b/Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md index 4453453c5df..444d3a3d033 100644 --- a/Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md +++ b/Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md @@ -2,7 +2,7 @@ ## Version 0.3.25 -- (2026-10-23) Add the CrowdStrike Falcon Data Replicator Authentication filtering parser and forward all supported filtering and pack parameters. +- (2026-10-23) Add the CrowdStrike Falcon Data Replicator Authentication filtering parser and forward all supported filtering and pack parameters. - [PR #15415](https://github.com/Azure/Azure-Sentinel/pull/15415) ## Version 0.3.24 diff --git a/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md b/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md index d6554064360..5b921bebe32 100644 --- a/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md +++ b/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md @@ -2,7 +2,7 @@ ## Version 0.1.0 -- (2026-10-23) Initial CrowdStrike Falcon Data Replicator Authentication filtering parser for CrowdStrike_Auth_Events_CL. +- (2026-10-23) Initial CrowdStrike Falcon Data Replicator Authentication filtering parser for CrowdStrike_Auth_Events_CL. - [PR #15415](https://github.com/Azure/Azure-Sentinel/pull/15415) - Support time, source IPv4 prefix or exact IP, source hostname, username, event type, result, and result-detail filtering. - Return no events for a nonempty target application filter because the source has no target application name. - Preserve the parameterless parser mappings and optional original-source packing. diff --git a/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalcon.yaml b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalcon.yaml index a2499a391ba..a7700704d09 100644 --- a/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalcon.yaml +++ b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalcon.yaml @@ -30,19 +30,16 @@ ParserQuery: | let parser = (disabled:bool = false, pack:bool = false) { CrowdStrike_Auth_Events_CL | where not(disabled) - | extend EventName = coalesce(event_simpleName, tostring(split(name, "V")[0])) - | where EventName in~ ("UserLogon", "UserLogonMac", "UserLogonLin", "UserLogoff", "UserLogoffMac", "UserLogoffLin", "UserLogonFailed", "UserLogonFailed2", "UserLogonFailed2Mac", "UserLogonFailed2Lin", "IoSessionLoggedOn") | extend SourceFields = iff(pack, pack_all(), dynamic({})) | extend - EventType = iff(EventName startswith "UserLogoff", "Logoff", "Logon"), - EventResult = iff(EventName startswith "UserLogonFailed", "Failure", "Success"), - EventOriginalType = EventName, + EventType = iff(event_simpleName startswith "UserLogoff", "Logoff", "Logon"), + EventResult = iff(event_simpleName startswith "UserLogonFailed", "Failure", "Success"), EventOriginalSubType = LogonType, EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat("/", SubStatus), "")), EventStartTime = coalesce( unixtime_seconds_todatetime(ContextTimeStamp), unixtime_milliseconds_todatetime(timestamp), - unixtime_seconds_todatetime(iff(EventName startswith "UserLogoff", LogoffTime, LogonTime)), + unixtime_seconds_todatetime(iff(event_simpleName startswith "UserLogoff", LogoffTime, LogonTime)), TimeGenerated), DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip), ComputerName = tostring(AdditionalFields.ComputerName), @@ -65,6 +62,7 @@ ParserQuery: | SrcDomain = iff(ClientComputerName contains ".", substring(ClientComputerName, indexof(ClientComputerName, ".") + 1), ""), SrcFQDN = iff(ClientComputerName contains ".", ClientComputerName, "") | project-rename + EventOriginalType = event_simpleName, DvcId = aid, DvcScopeId = cid, TargetUserSid = UserSid, diff --git a/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalcon.yaml b/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalcon.yaml index 81c5086c015..99f7d696fda 100644 --- a/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalcon.yaml +++ b/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalcon.yaml @@ -71,49 +71,53 @@ ParserQuery: | | where not(disabled) // This source has no target application name; an active application filter cannot match. | where array_length(targetappname_has_any) == 0 - | extend EventName = coalesce(event_simpleName, tostring(split(name, "V")[0])) - | where EventName in~ ("UserLogon", "UserLogonMac", "UserLogonLin", "UserLogoff", "UserLogoffMac", "UserLogoffLin", "UserLogonFailed", "UserLogonFailed2", "UserLogonFailed2Mac", "UserLogonFailed2Lin", "IoSessionLoggedOn") + | where array_length(eventtype_in) == 0 + or (event_simpleName startswith "UserLogoff" and "Logoff" in~ (eventtype_in)) + or (event_simpleName !startswith "UserLogoff" and "Logon" in~ (eventtype_in)) + | where eventresult == "*" + or (event_simpleName startswith "UserLogonFailed" and eventresult =~ "Failure") + or (event_simpleName !startswith "UserLogonFailed" and eventresult =~ "Success") | extend SourceFields = iff(pack, pack_all(), dynamic({})) + | extend EventStartTime = coalesce( + unixtime_seconds_todatetime(ContextTimeStamp), + unixtime_milliseconds_todatetime(timestamp), + unixtime_seconds_todatetime(iff(event_simpleName startswith "UserLogoff", LogoffTime, LogonTime)), + TimeGenerated) + | where (isnull(starttime) or EventStartTime >= starttime) + and (isnull(endtime) or EventStartTime <= endtime) + | extend SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6) + | where array_length(srcipaddr_has_any_prefix) == 0 + or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix) + or SrcIpAddr in~ (srcipaddr_has_any_prefix) + | extend TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains "\\" and UserName !contains "@", strcat(LogonDomain, "\\", UserName), UserName)) + | where array_length(username_has_any) == 0 or TargetUsername has_any (username_has_any) + | extend SrcHostname = iff(tostring(split(ClientComputerName, ".")[0]) matches regex @"^[a-zA-Z0-9-]{1,61}$", tostring(split(ClientComputerName, ".")[0]), "") + | where array_length(srchostname_has_any) == 0 or SrcHostname has_any (srchostname_has_any) + | extend EventResultDetails = iff(event_simpleName startswith "UserLogonFailed", "Other", "") + | where array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in) | extend - EventType = iff(EventName startswith "UserLogoff", "Logoff", "Logon"), - EventResult = iff(EventName startswith "UserLogonFailed", "Failure", "Success"), - EventOriginalType = EventName, + EventType = iff(event_simpleName startswith "UserLogoff", "Logoff", "Logon"), + EventResult = iff(event_simpleName startswith "UserLogonFailed", "Failure", "Success"), EventOriginalSubType = LogonType, EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat("/", SubStatus), "")), - EventStartTime = coalesce( - unixtime_seconds_todatetime(ContextTimeStamp), - unixtime_milliseconds_todatetime(timestamp), - unixtime_seconds_todatetime(iff(EventName startswith "UserLogoff", LogoffTime, LogonTime)), - TimeGenerated), DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip), ComputerName = tostring(AdditionalFields.ComputerName), - SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6), - TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains "\\" and UserName !contains "@", strcat(LogonDomain, "\\", UserName), UserName)), TargetUserId = coalesce(UserSid, UID), TargetUserIdType = case(isnotempty(UserSid), "SID", isnotempty(UID), "UID", ""), TargetUserType = case(UserIsAdmin == "1", "Admin", UserIsAdmin == "0", "Regular", ""), TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId), DvcOs = case(event_platform =~ "Win", "Windows", event_platform =~ "Mac", "macOS", event_platform =~ "Lin", "Linux", event_platform) - | where (isnull(starttime) or EventStartTime >= starttime) - and (isnull(endtime) or EventStartTime <= endtime) - and (array_length(eventtype_in) == 0 or EventType in~ (eventtype_in)) - and (eventresult == "*" or EventResult =~ eventresult) - and (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix) or SrcIpAddr in~ (srcipaddr_has_any_prefix)) - and (array_length(username_has_any) == 0 or TargetUsername has_any (username_has_any)) | extend EventEndTime = EventStartTime, EventSubType = case(LogonType == "0", "System", LogonType in ("2", "7", "11"), "Interactive", LogonType == "3", "Remote", LogonType == "5", "Service", LogonType == "8", "NetworkCleartext", LogonType == "10", "RemoteInteractive", ""), - EventResultDetails = iff(EventResult == "Failure", "Other", ""), TargetUsernameType = case(TargetUsername contains "@", "UPN", TargetUsername contains "\\", "Windows", isnotempty(TargetUsername), "Simple", ""), DvcHostname = iff(tostring(split(ComputerName, ".")[0]) matches regex @"^[a-zA-Z0-9-]{1,61}$", tostring(split(ComputerName, ".")[0]), ""), DvcDomain = iff(ComputerName contains ".", substring(ComputerName, indexof(ComputerName, ".") + 1), ""), DvcFQDN = iff(ComputerName contains ".", ComputerName, ""), - SrcHostname = iff(tostring(split(ClientComputerName, ".")[0]) matches regex @"^[a-zA-Z0-9-]{1,61}$", tostring(split(ClientComputerName, ".")[0]), ""), SrcDomain = iff(ClientComputerName contains ".", substring(ClientComputerName, indexof(ClientComputerName, ".") + 1), ""), SrcFQDN = iff(ClientComputerName contains ".", ClientComputerName, "") - | where (array_length(srchostname_has_any) == 0 or SrcHostname has_any (srchostname_has_any)) - and (array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in)) | project-rename + EventOriginalType = event_simpleName, DvcId = aid, DvcScopeId = cid, TargetUserSid = UserSid, diff --git a/Sample Data/ASIM/CrowdStrike_Falcon_Authentication_IngestedLogs.csv b/Sample Data/ASIM/CrowdStrike_Falcon_Authentication_IngestedLogs.csv index 72fdc5135c7..c336880ddbb 100644 --- a/Sample Data/ASIM/CrowdStrike_Falcon_Authentication_IngestedLogs.csv +++ b/Sample Data/ASIM/CrowdStrike_Falcon_Authentication_IngestedLogs.csv @@ -4,8 +4,8 @@ "2026-10-22T12:02:00.0000000+00:00","UserLogonFailed","1792670520000","203.0.113.3","00000000000000000000000000000003","testuser3","Win","1792670520","UserLogonFailedV1","synthetic-build","00000000-0000-0000-0000-000000000003","synthetic-state","1003","2003","1","0","0","0","00000000000000000000000000000000","synthetic-container-3","3003","3","1792670520","0","EXAMPLE","1","client3.example.test","testuser3@example.test","4003","S-1-5-21-100-200-300-3","dc1.example.test","Kerberos","5003","2","192.0.2.3","2001:db8::3","3","","3","0","0","1790078520","1","6003","0xC000006D","7003","8003","0xC000006A","0","0","0","9003","EXAMPLE\testuser3","10003","00000000-0000-0000-0000-000000000003","","00000000-0000-0000-0000-000000000003","","0","12003","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.3"",""ComputerName"":""server3.example.test"",""LocalAddressIP6"":""2001:db8:1::3"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" "2026-10-22T12:03:00.0000000+00:00","UserLogonFailed2","1792670580000","203.0.113.4","00000000000000000000000000000004","testuser4","Win","1792670580","UserLogonFailed2V1","synthetic-build","00000000-0000-0000-0000-000000000004","synthetic-state","1004","2004","1","0","0","0","00000000000000000000000000000000","synthetic-container-4","3004","5","1792670580","0","EXAMPLE","1","client4.example.test","testuser4@example.test","4004","S-1-5-21-100-200-300-4","dc1.example.test","Kerberos","5004","3","192.0.2.4","2001:db8::4","3","","4","0","0","1790078580","1","6004","0xC000006D","7004","8004","0xC000006A","0","0","0","9004","EXAMPLE\testuser4","10004","00000000-0000-0000-0000-000000000004","","00000000-0000-0000-0000-000000000004","","0","12004","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.4"",""ComputerName"":""server4.example.test"",""LocalAddressIP6"":""2001:db8:1::4"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" "2026-10-22T12:04:00.0000000+00:00","IoSessionLoggedOn","1792670640000","203.0.113.5","00000000000000000000000000000005","testuser5","Win","1792670640","IoSessionLoggedOnV1","synthetic-build","00000000-0000-0000-0000-000000000005","synthetic-state","1005","2005","1","0","0","0","00000000000000000000000000000000","synthetic-container-5","3005","7","1792670640","0","EXAMPLE","1","client5.example.test","testuser5@example.test","4005","S-1-5-21-100-200-300-5","dc1.example.test","Kerberos","5005","4","192.0.2.5","2001:db8::5","3","","5","0","0","1790078640","1","6005","0","7005","8005","0","0","0","0","9005","EXAMPLE\testuser5","10005","00000000-0000-0000-0000-000000000005","","00000000-0000-0000-0000-000000000005","","0","12005","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.5"",""ComputerName"":""server5.example.test"",""LocalAddressIP6"":""2001:db8:1::5"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" -"2026-10-22T12:05:00.0000000+00:00","","1792670700000","203.0.113.6","00000000000000000000000000000006","testuser6","Lin","1792670700","UserLogonFailed2LinV1","synthetic-build","00000000-0000-0000-0000-000000000006","synthetic-state","1006","2006","1","0","0","0","00000000000000000000000000000000","synthetic-container-6","3006","8","1792670700","0","EXAMPLE","1","client6.example.test","testuser6@example.test","4006","","dc1.example.test","PAM","5006","5","192.0.2.6","2001:db8::6","3","","6","0","0","1790078700","1","6006","0xC000006D","7006","8006","0xC000006A","0","0","0","9006","EXAMPLE\testuser6","10006","00000000-0000-0000-0000-000000000006","1006","00000000-0000-0000-0000-000000000006","","0","12006","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.6"",""ComputerName"":""server6.example.test"",""LocalAddressIP6"":""2001:db8:1::6"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" -"2026-10-22T12:06:00.0000000+00:00","","1792670760000","203.0.113.7","00000000000000000000000000000007","testuser7","Mac","1792670760","UserLogonMacV1","synthetic-build","00000000-0000-0000-0000-000000000007","synthetic-state","1007","2007","1","0","0","0","00000000000000000000000000000000","synthetic-container-7","3007","9","1792670760","0","EXAMPLE","1","client7.example.test","testuser7@example.test","4007","","dc1.example.test","PAM","5007","6","192.0.2.7","2001:db8::7","3","","7","0","0","1790078760","1","6007","0","7007","8007","0","0","0","0","9007","EXAMPLE\testuser7","10007","00000000-0000-0000-0000-000000000007","1007","00000000-0000-0000-0000-000000000007","11007","0","12007","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.7"",""ComputerName"":""server7.example.test"",""LocalAddressIP6"":""2001:db8:1::7"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" -"2026-10-22T12:07:00.0000000+00:00","","1792670820000","203.0.113.8","00000000000000000000000000000008","testuser8","Mac","1792670820","UserLogonFailed2MacV1","synthetic-build","00000000-0000-0000-0000-000000000008","synthetic-state","1008","2008","1","0","0","0","00000000000000000000000000000000","synthetic-container-8","3008","10","1792670820","0","EXAMPLE","1","client8.example.test","testuser8@example.test","4008","","dc1.example.test","PAM","5008","7","","2001:db8::8","3","","8","0","0","1790078820","1","6008","0xC000006D","7008","8008","0xC000006A","0","0","0","9008","EXAMPLE\testuser8","10008","00000000-0000-0000-0000-000000000008","1008","00000000-0000-0000-0000-000000000008","11008","0","12008","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.8"",""ComputerName"":""server8.example.test"",""LocalAddressIP6"":""2001:db8:1::8"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" -"2026-10-22T12:08:00.0000000+00:00","","1792670880000","203.0.113.9","00000000000000000000000000000009","testuser9","Lin","1792670880","UserLogoffLinV1","synthetic-build","00000000-0000-0000-0000-000000000009","synthetic-state","1009","2009","1","0","0","0","00000000000000000000000000000000","synthetic-container-9","3009","11","1792670880","0","EXAMPLE","1","client9.example.test","testuser9@example.test","4009","","dc1.example.test","PAM","5009","8","192.0.2.9","2001:db8::9","3","1792670880","9","0","0","1790078880","1","6009","0","7009","8009","0","0","0","0","9009","EXAMPLE\testuser9","10009","00000000-0000-0000-0000-000000000009","1009","00000000-0000-0000-0000-000000000009","","0","12009","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.9"",""ComputerName"":""server9.example.test"",""LocalAddressIP6"":""2001:db8:1::9"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" -"2026-10-22T12:09:00.0000000+00:00","","1792670940000","203.0.113.10","0000000000000000000000000000000a","testuser10","Lin","1792670940","UserLogonLinV1","synthetic-build","00000000-0000-0000-0000-000000000010","synthetic-state","1010","2010","1","0","0","0","00000000000000000000000000000000","synthetic-container-10","3010","4","1792670940","0","EXAMPLE","1","client10.example.test","testuser10@example.test","4010","","dc1.example.test","PAM","5010","9","192.0.2.10","2001:db8::10","3","","10","0","0","1790078940","1","6010","0","7010","8010","0","0","0","0","9010","EXAMPLE\testuser10","10010","00000000-0000-0000-0000-000000000010","1010","00000000-0000-0000-0000-000000000010","","0","12010","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.10"",""ComputerName"":""server10.example.test"",""LocalAddressIP6"":""2001:db8:1::10"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:05:00.0000000+00:00","UserLogonFailed2Lin","1792670700000","203.0.113.6","00000000000000000000000000000006","testuser6","Lin","1792670700","UserLogonFailed2LinV1","synthetic-build","00000000-0000-0000-0000-000000000006","synthetic-state","1006","2006","1","0","0","0","00000000000000000000000000000000","synthetic-container-6","3006","8","1792670700","0","EXAMPLE","1","client6.example.test","testuser6@example.test","4006","","dc1.example.test","PAM","5006","5","192.0.2.6","2001:db8::6","3","","6","0","0","1790078700","1","6006","0xC000006D","7006","8006","0xC000006A","0","0","0","9006","EXAMPLE\testuser6","10006","00000000-0000-0000-0000-000000000006","1006","00000000-0000-0000-0000-000000000006","","0","12006","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.6"",""ComputerName"":""server6.example.test"",""LocalAddressIP6"":""2001:db8:1::6"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:06:00.0000000+00:00","UserLogonMac","1792670760000","203.0.113.7","00000000000000000000000000000007","testuser7","Mac","1792670760","UserLogonMacV1","synthetic-build","00000000-0000-0000-0000-000000000007","synthetic-state","1007","2007","1","0","0","0","00000000000000000000000000000000","synthetic-container-7","3007","9","1792670760","0","EXAMPLE","1","client7.example.test","testuser7@example.test","4007","","dc1.example.test","PAM","5007","6","192.0.2.7","2001:db8::7","3","","7","0","0","1790078760","1","6007","0","7007","8007","0","0","0","0","9007","EXAMPLE\testuser7","10007","00000000-0000-0000-0000-000000000007","1007","00000000-0000-0000-0000-000000000007","11007","0","12007","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.7"",""ComputerName"":""server7.example.test"",""LocalAddressIP6"":""2001:db8:1::7"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:07:00.0000000+00:00","UserLogonFailed2Mac","1792670820000","203.0.113.8","00000000000000000000000000000008","testuser8","Mac","1792670820","UserLogonFailed2MacV1","synthetic-build","00000000-0000-0000-0000-000000000008","synthetic-state","1008","2008","1","0","0","0","00000000000000000000000000000000","synthetic-container-8","3008","10","1792670820","0","EXAMPLE","1","client8.example.test","testuser8@example.test","4008","","dc1.example.test","PAM","5008","7","","2001:db8::8","3","","8","0","0","1790078820","1","6008","0xC000006D","7008","8008","0xC000006A","0","0","0","9008","EXAMPLE\testuser8","10008","00000000-0000-0000-0000-000000000008","1008","00000000-0000-0000-0000-000000000008","11008","0","12008","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.8"",""ComputerName"":""server8.example.test"",""LocalAddressIP6"":""2001:db8:1::8"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:08:00.0000000+00:00","UserLogoffLin","1792670880000","203.0.113.9","00000000000000000000000000000009","testuser9","Lin","1792670880","UserLogoffLinV1","synthetic-build","00000000-0000-0000-0000-000000000009","synthetic-state","1009","2009","1","0","0","0","00000000000000000000000000000000","synthetic-container-9","3009","11","1792670880","0","EXAMPLE","1","client9.example.test","testuser9@example.test","4009","","dc1.example.test","PAM","5009","8","192.0.2.9","2001:db8::9","3","1792670880","9","0","0","1790078880","1","6009","0","7009","8009","0","0","0","0","9009","EXAMPLE\testuser9","10009","00000000-0000-0000-0000-000000000009","1009","00000000-0000-0000-0000-000000000009","","0","12009","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.9"",""ComputerName"":""server9.example.test"",""LocalAddressIP6"":""2001:db8:1::9"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" +"2026-10-22T12:09:00.0000000+00:00","UserLogonLin","1792670940000","203.0.113.10","0000000000000000000000000000000a","testuser10","Lin","1792670940","UserLogonLinV1","synthetic-build","00000000-0000-0000-0000-000000000010","synthetic-state","1010","2010","1","0","0","0","00000000000000000000000000000000","synthetic-container-10","3010","4","1792670940","0","EXAMPLE","1","client10.example.test","testuser10@example.test","4010","","dc1.example.test","PAM","5010","9","192.0.2.10","2001:db8::10","3","","10","0","0","1790078940","1","6010","0","7010","8010","0","0","0","0","9010","EXAMPLE\testuser10","10010","00000000-0000-0000-0000-000000000010","1010","00000000-0000-0000-0000-000000000010","","0","12010","synthetic-state-a1","{""LocalAddressIP4"":""198.51.100.10"",""ComputerName"":""server10.example.test"",""LocalAddressIP6"":""2001:db8:1::10"",""EventOrigin"":""1""}","00000000-0000-0000-0000-000000000000","CrowdStrike_Auth_Events_CL","/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/synthetic/providers/Microsoft.OperationalInsights/workspaces/synthetic" From da43f3f198a08e40c9f2d1ab48aa8f4ca93f12c9 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <> Date: Fri, 23 Oct 2026 22:31:45 +0000 Subject: [PATCH 4/6] [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. --- .../ASimAuthenticationCrowdStrikeFalcon.json | 2 +- .../vimAuthenticationCrowdStrikeFalcon.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json index 782da8d21c3..1f6c2378e21 100644 --- a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json +++ b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json @@ -27,7 +27,7 @@ "displayName": "Authentication ASIM parser for CrowdStrike Falcon", "category": "ASIM", "FunctionAlias": "ASimAuthenticationCrowdStrikeFalcon", - "query": "let parser = (disabled:bool = false, pack:bool = false) {\n CrowdStrike_Auth_Events_CL\n | where not(disabled)\n | extend EventName = coalesce(event_simpleName, tostring(split(name, \"V\")[0]))\n | where EventName in~ (\"UserLogon\", \"UserLogonMac\", \"UserLogonLin\", \"UserLogoff\", \"UserLogoffMac\", \"UserLogoffLin\", \"UserLogonFailed\", \"UserLogonFailed2\", \"UserLogonFailed2Mac\", \"UserLogonFailed2Lin\", \"IoSessionLoggedOn\")\n | extend SourceFields = iff(pack, pack_all(), dynamic({}))\n | extend\n EventType = iff(EventName startswith \"UserLogoff\", \"Logoff\", \"Logon\"),\n EventResult = iff(EventName startswith \"UserLogonFailed\", \"Failure\", \"Success\"),\n EventOriginalType = EventName,\n EventOriginalSubType = LogonType,\n EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat(\"/\", SubStatus), \"\")),\n EventStartTime = coalesce(\n unixtime_seconds_todatetime(ContextTimeStamp),\n unixtime_milliseconds_todatetime(timestamp),\n unixtime_seconds_todatetime(iff(EventName startswith \"UserLogoff\", LogoffTime, LogonTime)),\n TimeGenerated),\n DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip),\n ComputerName = tostring(AdditionalFields.ComputerName),\n SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6),\n TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains \"\\\\\" and UserName !contains \"@\", strcat(LogonDomain, \"\\\\\", UserName), UserName)),\n TargetUserId = coalesce(UserSid, UID),\n TargetUserIdType = case(isnotempty(UserSid), \"SID\", isnotempty(UID), \"UID\", \"\"),\n TargetUserType = case(UserIsAdmin == \"1\", \"Admin\", UserIsAdmin == \"0\", \"Regular\", \"\"),\n TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId),\n DvcOs = case(event_platform =~ \"Win\", \"Windows\", event_platform =~ \"Mac\", \"macOS\", event_platform =~ \"Lin\", \"Linux\", event_platform)\n | extend\n EventEndTime = EventStartTime,\n EventSubType = case(LogonType == \"0\", \"System\", LogonType in (\"2\", \"7\", \"11\"), \"Interactive\", LogonType == \"3\", \"Remote\", LogonType == \"5\", \"Service\", LogonType == \"8\", \"NetworkCleartext\", LogonType == \"10\", \"RemoteInteractive\", \"\"),\n EventResultDetails = iff(EventResult == \"Failure\", \"Other\", \"\"),\n TargetUsernameType = case(TargetUsername contains \"@\", \"UPN\", TargetUsername contains \"\\\\\", \"Windows\", isnotempty(TargetUsername), \"Simple\", \"\"),\n DvcHostname = iff(tostring(split(ComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ComputerName, \".\")[0]), \"\"),\n DvcDomain = iff(ComputerName contains \".\", substring(ComputerName, indexof(ComputerName, \".\") + 1), \"\"),\n DvcFQDN = iff(ComputerName contains \".\", ComputerName, \"\"),\n SrcHostname = iff(tostring(split(ClientComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ClientComputerName, \".\")[0]), \"\"),\n SrcDomain = iff(ClientComputerName contains \".\", substring(ClientComputerName, indexof(ClientComputerName, \".\") + 1), \"\"),\n SrcFQDN = iff(ClientComputerName contains \".\", ClientComputerName, \"\")\n | project-rename\n DvcId = aid,\n DvcScopeId = cid,\n TargetUserSid = UserSid,\n TargetUserUid = UID,\n TargetUserUpn = UserPrincipal,\n TargetUserScope = LogonDomain,\n TargetOriginalUserType = UserIsAdmin,\n LogonProtocol = AuthenticationPackage\n | extend\n Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName),\n DvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcDomainType = iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname),\n TargetHostname = DvcHostname,\n TargetDomain = DvcDomain,\n TargetDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n TargetFQDN = DvcFQDN,\n TargetDvcId = DvcId,\n TargetDvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n TargetIpAddr = DvcIpAddr,\n TargetDvcOs = DvcOs,\n TargetDvcScopeId = DvcScopeId,\n EventCount = int(1),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = \"Informational\",\n DvcEntityKey = \"\",\n ActorUserEntityKey = \"\",\n ActorUserAdditionalIds = dynamic([]),\n TargetUserEntityKey = \"\",\n TargetUserAdditionalIds = dynamic([]),\n SrcSystemEntityKey = \"\",\n TargetSystemEntityKey = \"\",\n ActingApplicationEntityKey = \"\",\n TargetApplicationEntityKey = \"\",\n AdditionalEntities = dynamic([]),\n AdditionalFields = SourceFields\n | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n EventType, EventSubType, EventResult, EventResultDetails,\n EventOriginalType, EventOriginalSubType, EventOriginalResultDetails,\n Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType,\n DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey,\n Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN,\n TargetHostname, TargetDomain, TargetDomainType, TargetFQDN,\n TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId,\n TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType,\n TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope,\n TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol,\n Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds,\n TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey,\n TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey,\n AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n", + "query": "let parser = (disabled:bool = false, pack:bool = false) {\n CrowdStrike_Auth_Events_CL\n | where not(disabled)\n | extend SourceFields = iff(pack, pack_all(), dynamic({}))\n | extend\n EventType = iff(event_simpleName startswith \"UserLogoff\", \"Logoff\", \"Logon\"),\n EventResult = iff(event_simpleName startswith \"UserLogonFailed\", \"Failure\", \"Success\"),\n EventOriginalSubType = LogonType,\n EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat(\"/\", SubStatus), \"\")),\n EventStartTime = coalesce(\n unixtime_seconds_todatetime(ContextTimeStamp),\n unixtime_milliseconds_todatetime(timestamp),\n unixtime_seconds_todatetime(iff(event_simpleName startswith \"UserLogoff\", LogoffTime, LogonTime)),\n TimeGenerated),\n DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip),\n ComputerName = tostring(AdditionalFields.ComputerName),\n SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6),\n TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains \"\\\\\" and UserName !contains \"@\", strcat(LogonDomain, \"\\\\\", UserName), UserName)),\n TargetUserId = coalesce(UserSid, UID),\n TargetUserIdType = case(isnotempty(UserSid), \"SID\", isnotempty(UID), \"UID\", \"\"),\n TargetUserType = case(UserIsAdmin == \"1\", \"Admin\", UserIsAdmin == \"0\", \"Regular\", \"\"),\n TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId),\n DvcOs = case(event_platform =~ \"Win\", \"Windows\", event_platform =~ \"Mac\", \"macOS\", event_platform =~ \"Lin\", \"Linux\", event_platform)\n | extend\n EventEndTime = EventStartTime,\n EventSubType = case(LogonType == \"0\", \"System\", LogonType in (\"2\", \"7\", \"11\"), \"Interactive\", LogonType == \"3\", \"Remote\", LogonType == \"5\", \"Service\", LogonType == \"8\", \"NetworkCleartext\", LogonType == \"10\", \"RemoteInteractive\", \"\"),\n EventResultDetails = iff(EventResult == \"Failure\", \"Other\", \"\"),\n TargetUsernameType = case(TargetUsername contains \"@\", \"UPN\", TargetUsername contains \"\\\\\", \"Windows\", isnotempty(TargetUsername), \"Simple\", \"\"),\n DvcHostname = iff(tostring(split(ComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ComputerName, \".\")[0]), \"\"),\n DvcDomain = iff(ComputerName contains \".\", substring(ComputerName, indexof(ComputerName, \".\") + 1), \"\"),\n DvcFQDN = iff(ComputerName contains \".\", ComputerName, \"\"),\n SrcHostname = iff(tostring(split(ClientComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ClientComputerName, \".\")[0]), \"\"),\n SrcDomain = iff(ClientComputerName contains \".\", substring(ClientComputerName, indexof(ClientComputerName, \".\") + 1), \"\"),\n SrcFQDN = iff(ClientComputerName contains \".\", ClientComputerName, \"\")\n | project-rename\n EventOriginalType = event_simpleName,\n DvcId = aid,\n DvcScopeId = cid,\n TargetUserSid = UserSid,\n TargetUserUid = UID,\n TargetUserUpn = UserPrincipal,\n TargetUserScope = LogonDomain,\n TargetOriginalUserType = UserIsAdmin,\n LogonProtocol = AuthenticationPackage\n | extend\n Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName),\n DvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcDomainType = iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname),\n TargetHostname = DvcHostname,\n TargetDomain = DvcDomain,\n TargetDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n TargetFQDN = DvcFQDN,\n TargetDvcId = DvcId,\n TargetDvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n TargetIpAddr = DvcIpAddr,\n TargetDvcOs = DvcOs,\n TargetDvcScopeId = DvcScopeId,\n EventCount = int(1),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = \"Informational\",\n DvcEntityKey = \"\",\n ActorUserEntityKey = \"\",\n ActorUserAdditionalIds = dynamic([]),\n TargetUserEntityKey = \"\",\n TargetUserAdditionalIds = dynamic([]),\n SrcSystemEntityKey = \"\",\n TargetSystemEntityKey = \"\",\n ActingApplicationEntityKey = \"\",\n TargetApplicationEntityKey = \"\",\n AdditionalEntities = dynamic([]),\n AdditionalFields = SourceFields\n | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n EventType, EventSubType, EventResult, EventResultDetails,\n EventOriginalType, EventOriginalSubType, EventOriginalResultDetails,\n Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType,\n DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey,\n Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN,\n TargetHostname, TargetDomain, TargetDomainType, TargetFQDN,\n TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId,\n TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType,\n TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope,\n TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol,\n Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds,\n TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey,\n TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey,\n AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n", "version": 1, "functionParameters": "disabled:bool=False,pack:bool=False" } diff --git a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json index 532c931f9c6..a8885695038 100644 --- a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json +++ b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json @@ -27,7 +27,7 @@ "displayName": "Authentication ASIM filtering parser for CrowdStrike Falcon", "category": "ASIM", "FunctionAlias": "vimAuthenticationCrowdStrikeFalcon", - "query": "let parser = (\n starttime:datetime = datetime(null),\n endtime:datetime = datetime(null),\n srcipaddr_has_any_prefix:dynamic = dynamic([]),\n srchostname_has_any:dynamic = dynamic([]),\n username_has_any:dynamic = dynamic([]),\n targetappname_has_any:dynamic = dynamic([]),\n eventtype_in:dynamic = dynamic([]),\n eventresult:string = \"*\",\n eventresultdetails_in:dynamic = dynamic([]),\n disabled:bool = false,\n pack:bool = false\n) {\n CrowdStrike_Auth_Events_CL\n | where not(disabled)\n // This source has no target application name; an active application filter cannot match.\n | where array_length(targetappname_has_any) == 0\n | extend EventName = coalesce(event_simpleName, tostring(split(name, \"V\")[0]))\n | where EventName in~ (\"UserLogon\", \"UserLogonMac\", \"UserLogonLin\", \"UserLogoff\", \"UserLogoffMac\", \"UserLogoffLin\", \"UserLogonFailed\", \"UserLogonFailed2\", \"UserLogonFailed2Mac\", \"UserLogonFailed2Lin\", \"IoSessionLoggedOn\")\n | extend SourceFields = iff(pack, pack_all(), dynamic({}))\n | extend\n EventType = iff(EventName startswith \"UserLogoff\", \"Logoff\", \"Logon\"),\n EventResult = iff(EventName startswith \"UserLogonFailed\", \"Failure\", \"Success\"),\n EventOriginalType = EventName,\n EventOriginalSubType = LogonType,\n EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat(\"/\", SubStatus), \"\")),\n EventStartTime = coalesce(\n unixtime_seconds_todatetime(ContextTimeStamp),\n unixtime_milliseconds_todatetime(timestamp),\n unixtime_seconds_todatetime(iff(EventName startswith \"UserLogoff\", LogoffTime, LogonTime)),\n TimeGenerated),\n DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip),\n ComputerName = tostring(AdditionalFields.ComputerName),\n SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6),\n TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains \"\\\\\" and UserName !contains \"@\", strcat(LogonDomain, \"\\\\\", UserName), UserName)),\n TargetUserId = coalesce(UserSid, UID),\n TargetUserIdType = case(isnotempty(UserSid), \"SID\", isnotempty(UID), \"UID\", \"\"),\n TargetUserType = case(UserIsAdmin == \"1\", \"Admin\", UserIsAdmin == \"0\", \"Regular\", \"\"),\n TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId),\n DvcOs = case(event_platform =~ \"Win\", \"Windows\", event_platform =~ \"Mac\", \"macOS\", event_platform =~ \"Lin\", \"Linux\", event_platform)\n | where (isnull(starttime) or EventStartTime >= starttime)\n and (isnull(endtime) or EventStartTime <= endtime)\n and (array_length(eventtype_in) == 0 or EventType in~ (eventtype_in))\n and (eventresult == \"*\" or EventResult =~ eventresult)\n and (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix) or SrcIpAddr in~ (srcipaddr_has_any_prefix))\n and (array_length(username_has_any) == 0 or TargetUsername has_any (username_has_any))\n | extend\n EventEndTime = EventStartTime,\n EventSubType = case(LogonType == \"0\", \"System\", LogonType in (\"2\", \"7\", \"11\"), \"Interactive\", LogonType == \"3\", \"Remote\", LogonType == \"5\", \"Service\", LogonType == \"8\", \"NetworkCleartext\", LogonType == \"10\", \"RemoteInteractive\", \"\"),\n EventResultDetails = iff(EventResult == \"Failure\", \"Other\", \"\"),\n TargetUsernameType = case(TargetUsername contains \"@\", \"UPN\", TargetUsername contains \"\\\\\", \"Windows\", isnotempty(TargetUsername), \"Simple\", \"\"),\n DvcHostname = iff(tostring(split(ComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ComputerName, \".\")[0]), \"\"),\n DvcDomain = iff(ComputerName contains \".\", substring(ComputerName, indexof(ComputerName, \".\") + 1), \"\"),\n DvcFQDN = iff(ComputerName contains \".\", ComputerName, \"\"),\n SrcHostname = iff(tostring(split(ClientComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ClientComputerName, \".\")[0]), \"\"),\n SrcDomain = iff(ClientComputerName contains \".\", substring(ClientComputerName, indexof(ClientComputerName, \".\") + 1), \"\"),\n SrcFQDN = iff(ClientComputerName contains \".\", ClientComputerName, \"\")\n | where (array_length(srchostname_has_any) == 0 or SrcHostname has_any (srchostname_has_any))\n and (array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in))\n | project-rename\n DvcId = aid,\n DvcScopeId = cid,\n TargetUserSid = UserSid,\n TargetUserUid = UID,\n TargetUserUpn = UserPrincipal,\n TargetUserScope = LogonDomain,\n TargetOriginalUserType = UserIsAdmin,\n LogonProtocol = AuthenticationPackage\n | extend\n Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName),\n DvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcDomainType = iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname),\n TargetHostname = DvcHostname,\n TargetDomain = DvcDomain,\n TargetDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n TargetFQDN = DvcFQDN,\n TargetDvcId = DvcId,\n TargetDvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n TargetIpAddr = DvcIpAddr,\n TargetDvcOs = DvcOs,\n TargetDvcScopeId = DvcScopeId,\n EventCount = int(1),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = \"Informational\",\n DvcEntityKey = \"\",\n ActorUserEntityKey = \"\",\n ActorUserAdditionalIds = dynamic([]),\n TargetUserEntityKey = \"\",\n TargetUserAdditionalIds = dynamic([]),\n SrcSystemEntityKey = \"\",\n TargetSystemEntityKey = \"\",\n ActingApplicationEntityKey = \"\",\n TargetApplicationEntityKey = \"\",\n AdditionalEntities = dynamic([]),\n AdditionalFields = SourceFields\n | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n EventType, EventSubType, EventResult, EventResultDetails,\n EventOriginalType, EventOriginalSubType, EventOriginalResultDetails,\n Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType,\n DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey,\n Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN,\n TargetHostname, TargetDomain, TargetDomainType, TargetFQDN,\n TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId,\n TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType,\n TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope,\n TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol,\n Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds,\n TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey,\n TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey,\n AdditionalEntities, AdditionalFields\n};\nparser(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, eventtype_in=eventtype_in, eventresult=eventresult, eventresultdetails_in=eventresultdetails_in, disabled=disabled, pack=pack)\n", + "query": "let parser = (\n starttime:datetime = datetime(null),\n endtime:datetime = datetime(null),\n srcipaddr_has_any_prefix:dynamic = dynamic([]),\n srchostname_has_any:dynamic = dynamic([]),\n username_has_any:dynamic = dynamic([]),\n targetappname_has_any:dynamic = dynamic([]),\n eventtype_in:dynamic = dynamic([]),\n eventresult:string = \"*\",\n eventresultdetails_in:dynamic = dynamic([]),\n disabled:bool = false,\n pack:bool = false\n) {\n CrowdStrike_Auth_Events_CL\n | where not(disabled)\n // This source has no target application name; an active application filter cannot match.\n | where array_length(targetappname_has_any) == 0\n | where array_length(eventtype_in) == 0\n or (event_simpleName startswith \"UserLogoff\" and \"Logoff\" in~ (eventtype_in))\n or (event_simpleName !startswith \"UserLogoff\" and \"Logon\" in~ (eventtype_in))\n | where eventresult == \"*\"\n or (event_simpleName startswith \"UserLogonFailed\" and eventresult =~ \"Failure\")\n or (event_simpleName !startswith \"UserLogonFailed\" and eventresult =~ \"Success\")\n | extend SourceFields = iff(pack, pack_all(), dynamic({}))\n | extend EventStartTime = coalesce(\n unixtime_seconds_todatetime(ContextTimeStamp),\n unixtime_milliseconds_todatetime(timestamp),\n unixtime_seconds_todatetime(iff(event_simpleName startswith \"UserLogoff\", LogoffTime, LogonTime)),\n TimeGenerated)\n | where (isnull(starttime) or EventStartTime >= starttime)\n and (isnull(endtime) or EventStartTime <= endtime)\n | extend SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6)\n | where array_length(srcipaddr_has_any_prefix) == 0\n or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix)\n or SrcIpAddr in~ (srcipaddr_has_any_prefix)\n | extend TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains \"\\\\\" and UserName !contains \"@\", strcat(LogonDomain, \"\\\\\", UserName), UserName))\n | where array_length(username_has_any) == 0 or TargetUsername has_any (username_has_any)\n | extend SrcHostname = iff(tostring(split(ClientComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ClientComputerName, \".\")[0]), \"\")\n | where array_length(srchostname_has_any) == 0 or SrcHostname has_any (srchostname_has_any)\n | extend EventResultDetails = iff(event_simpleName startswith \"UserLogonFailed\", \"Other\", \"\")\n | where array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in)\n | extend\n EventType = iff(event_simpleName startswith \"UserLogoff\", \"Logoff\", \"Logon\"),\n EventResult = iff(event_simpleName startswith \"UserLogonFailed\", \"Failure\", \"Success\"),\n EventOriginalSubType = LogonType,\n EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat(\"/\", SubStatus), \"\")),\n DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip),\n ComputerName = tostring(AdditionalFields.ComputerName),\n TargetUserId = coalesce(UserSid, UID),\n TargetUserIdType = case(isnotempty(UserSid), \"SID\", isnotempty(UID), \"UID\", \"\"),\n TargetUserType = case(UserIsAdmin == \"1\", \"Admin\", UserIsAdmin == \"0\", \"Regular\", \"\"),\n TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId),\n DvcOs = case(event_platform =~ \"Win\", \"Windows\", event_platform =~ \"Mac\", \"macOS\", event_platform =~ \"Lin\", \"Linux\", event_platform)\n | extend\n EventEndTime = EventStartTime,\n EventSubType = case(LogonType == \"0\", \"System\", LogonType in (\"2\", \"7\", \"11\"), \"Interactive\", LogonType == \"3\", \"Remote\", LogonType == \"5\", \"Service\", LogonType == \"8\", \"NetworkCleartext\", LogonType == \"10\", \"RemoteInteractive\", \"\"),\n TargetUsernameType = case(TargetUsername contains \"@\", \"UPN\", TargetUsername contains \"\\\\\", \"Windows\", isnotempty(TargetUsername), \"Simple\", \"\"),\n DvcHostname = iff(tostring(split(ComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ComputerName, \".\")[0]), \"\"),\n DvcDomain = iff(ComputerName contains \".\", substring(ComputerName, indexof(ComputerName, \".\") + 1), \"\"),\n DvcFQDN = iff(ComputerName contains \".\", ComputerName, \"\"),\n SrcDomain = iff(ClientComputerName contains \".\", substring(ClientComputerName, indexof(ClientComputerName, \".\") + 1), \"\"),\n SrcFQDN = iff(ClientComputerName contains \".\", ClientComputerName, \"\")\n | project-rename\n EventOriginalType = event_simpleName,\n DvcId = aid,\n DvcScopeId = cid,\n TargetUserSid = UserSid,\n TargetUserUid = UID,\n TargetUserUpn = UserPrincipal,\n TargetUserScope = LogonDomain,\n TargetOriginalUserType = UserIsAdmin,\n LogonProtocol = AuthenticationPackage\n | extend\n Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName),\n DvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcDomainType = iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname),\n TargetHostname = DvcHostname,\n TargetDomain = DvcDomain,\n TargetDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n TargetFQDN = DvcFQDN,\n TargetDvcId = DvcId,\n TargetDvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n TargetIpAddr = DvcIpAddr,\n TargetDvcOs = DvcOs,\n TargetDvcScopeId = DvcScopeId,\n EventCount = int(1),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = \"Informational\",\n DvcEntityKey = \"\",\n ActorUserEntityKey = \"\",\n ActorUserAdditionalIds = dynamic([]),\n TargetUserEntityKey = \"\",\n TargetUserAdditionalIds = dynamic([]),\n SrcSystemEntityKey = \"\",\n TargetSystemEntityKey = \"\",\n ActingApplicationEntityKey = \"\",\n TargetApplicationEntityKey = \"\",\n AdditionalEntities = dynamic([]),\n AdditionalFields = SourceFields\n | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n EventType, EventSubType, EventResult, EventResultDetails,\n EventOriginalType, EventOriginalSubType, EventOriginalResultDetails,\n Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType,\n DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey,\n Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN,\n TargetHostname, TargetDomain, TargetDomainType, TargetFQDN,\n TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId,\n TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType,\n TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope,\n TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol,\n Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds,\n TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey,\n TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey,\n AdditionalEntities, AdditionalFields\n};\nparser(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, eventtype_in=eventtype_in, eventresult=eventresult, eventresultdetails_in=eventresultdetails_in, disabled=disabled, pack=pack)\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr_has_any_prefix:dynamic=dynamic([]),srchostname_has_any:dynamic=dynamic([]),username_has_any:dynamic=dynamic([]),targetappname_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresult:string='*',eventresultdetails_in:dynamic=dynamic([]),disabled:bool=False,pack:bool=False" } From c5470d63fbb49d3bb070d55381d7e185c065d670 Mon Sep 17 00:00:00 2001 From: Derrick Lee Date: Fri, 23 Oct 2026 16:00:40 -0700 Subject: [PATCH 5/6] Renames --- .../ASimAuthentication.json | 2 +- .../ASimAuthenticationCrowdStrikeFalcon.json | 36 ------------------- ...cationCrowdStrikeFalconDataReplicator.json | 36 +++++++++++++++++++ .../README.md | 8 ++--- .../ARM/FullDeploymentAuthentication.json | 8 ++--- .../imAuthentication/imAuthentication.json | 2 +- .../vimAuthenticationCrowdStrikeFalcon.json | 36 ------------------- .../README.md | 8 ++--- ...cationCrowdStrikeFalconDataReplicator.json | 36 +++++++++++++++++++ ...icationCrowdStrikeFalconDataReplicator.md} | 3 +- ...icationCrowdStrikeFalconDataReplicator.md} | 3 +- .../Parsers/ASimAuthentication.yaml | 4 +-- ...ationCrowdStrikeFalconDataReplicator.yaml} | 10 +++--- .../Parsers/imAuthentication.yaml | 4 +-- ...ationCrowdStrikeFalconDataReplicator.yaml} | 10 +++--- ...eplicator_Authentication_IngestedLogs.csv} | 0 16 files changed, 104 insertions(+), 102 deletions(-) delete mode 100644 Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json create mode 100644 Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/ASimAuthenticationCrowdStrikeFalconDataReplicator.json rename Parsers/ASimAuthentication/ARM/{ASimAuthenticationCrowdStrikeFalcon => ASimAuthenticationCrowdStrikeFalconDataReplicator}/README.md (67%) delete mode 100644 Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json rename Parsers/ASimAuthentication/ARM/{vimAuthenticationCrowdStrikeFalcon => vimAuthenticationCrowdStrikeFalconDataReplicator}/README.md (68%) create mode 100644 Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/vimAuthenticationCrowdStrikeFalconDataReplicator.json rename Parsers/ASimAuthentication/CHANGELOG/{ASimAuthenticationCrowdStrikeFalcon.md => ASimAuthenticationCrowdStrikeFalconDataReplicator.md} (75%) rename Parsers/ASimAuthentication/CHANGELOG/{vimAuthenticationCrowdStrikeFalcon.md => vimAuthenticationCrowdStrikeFalconDataReplicator.md} (75%) rename Parsers/ASimAuthentication/Parsers/{ASimAuthenticationCrowdStrikeFalcon.yaml => ASimAuthenticationCrowdStrikeFalconDataReplicator.yaml} (95%) rename Parsers/ASimAuthentication/Parsers/{vimAuthenticationCrowdStrikeFalcon.yaml => vimAuthenticationCrowdStrikeFalconDataReplicator.yaml} (97%) rename Sample Data/ASIM/{CrowdStrike_Falcon_Authentication_IngestedLogs.csv => CrowdStrike_Falcon Data Replicator_Authentication_IngestedLogs.csv} (100%) diff --git a/Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json b/Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json index 66c3eb1459e..c865e82db17 100644 --- a/Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json +++ b/Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json @@ -27,7 +27,7 @@ "displayName": "Authentication ASIM parser", "category": "ASIM", "FunctionAlias": "ASimAuthentication", - "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet ASimAuthenticationDisabled=toscalar('ExcludeASimAuthentication' in (DisabledParsers) or 'Any' in (DisabledParsers));\nunion isfuzzy=true\n vimAuthenticationEmpty,\n ASimAuthenticationAADManagedIdentitySignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADNonInteractiveUserSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADServicePrincipalSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAWSCloudTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAWSCloudTrail' in (DisabledParsers) )),\n ASimAuthenticationBarracudaWAF (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationBarracudaWAF' in (DisabledParsers) )),\n ASimAuthenticationCiscoASA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoASA' in (DisabledParsers) )),\n ASimAuthenticationCiscoDNAC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoDNAC' in (DisabledParsers) )),\n ASimAuthenticationCiscoFTD (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoFTD' in (DisabledParsers) )),\n ASimAuthenticationCiscoIOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoIOS' in (DisabledParsers) )),\n ASimAuthenticationCiscoISE (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISE' in (DisabledParsers) )),\n ASimAuthenticationCiscoISEAdministrator (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISEAdministrator' in (DisabledParsers) ),pack=pack),\n ASimAuthenticationCiscoMeraki (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMeraki' in (DisabledParsers) )),\n ASimAuthenticationCiscoMerakiSyslog (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )),\n ASimAuthenticationFortinetFortigate (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationFortinetFortigate' in (DisabledParsers) )),\n ASimAuthenticationM365Defender (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationM365Defender' in (DisabledParsers) )),\n ASimAuthenticationMD4IoT (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMD4IoT' in (DisabledParsers) )),\n ASimAuthenticationMicrosoftWindowsEvent (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )),\n ASimAuthenticationOktaSSO (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSSO' in (DisabledParsers) )),\n ASimAuthenticationOktaV2(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaV2' in (DisabledParsers) )),\n ASimAuthenticationOktaSystemLogs(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSystemLogs' in (DisabledParsers) )),\n ASimAuthenticationPostgreSQL (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPostgreSQL' in (DisabledParsers) )),\n ASimAuthenticationSigninLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSigninLogs' in (DisabledParsers) )),\n ASimAuthenticationSshd (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSshd' in (DisabledParsers) )),\n ASimAuthenticationSu (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSu' in (DisabledParsers) )),\n ASimAuthenticationSudo (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSudo' in (DisabledParsers) )),\n ASimAuthenticationSalesforceSC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceSC' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationSalesforceLoginHistory (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceLoginHistory' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationVectraXDRAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVectraXDRAudit' in (DisabledParsers) )),\n ASimAuthenticationSentinelOne (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSentinelOne' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspace (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspace' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspaceLogins (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspaceLogins' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoCortexDataLake (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )),\n ASimAuthenticationVMwareCarbonBlackCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )),\n ASimAuthenticationVMwareVCenter (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareVCenter' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )),\n ASimAuthenticationCrowdStrikeFalcon (disabled=(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalcon' in (DisabledParsers))), pack=pack),\n ASimAuthenticationIllumioSaaSCore (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationIllumioSaaSCore' in (DisabledParsers) )),\n ASimAuthenticationNative (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationNative' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoPanOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPanOS' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationPaloAltoGlobalProtect (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationVMwareESXi (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareESXi' in (DisabledParsers)), pack=pack),\n ASimAuthenticationPaloAltoPrismaCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPrismaCloud' in (DisabledParsers)), pack=pack),\n ASimAuthenticationAlibabaCloudActionTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAlibabaCloudActionTrail' in (DisabledParsers)), pack=pack),\n ASimAuthenticationWizCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationWizCloud' in (DisabledParsers)), pack=pack),\n ASimAuthenticationOracleOCI (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOracleOCI' in (DisabledParsers)), pack=pack),\n ASimAuthenticationArubaNetworksClearPass (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationArubaNetworksClearPass' in (DisabledParsers)), pack=pack),\n ASimAuthenticationCyberArkAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCyberArkAudit' in (DisabledParsers)), pack=pack),\n ASimAuthenticationZscalerZPA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationZscalerZPA' in (DisabledParsers)), pack=pack),\n ASimAuthenticationOktaAuth0 (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaAuth0' in (DisabledParsers)), pack=pack)\n", + "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet ASimAuthenticationDisabled=toscalar('ExcludeASimAuthentication' in (DisabledParsers) or 'Any' in (DisabledParsers));\nunion isfuzzy=true\n vimAuthenticationEmpty,\n ASimAuthenticationAADManagedIdentitySignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADNonInteractiveUserSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADServicePrincipalSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAWSCloudTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAWSCloudTrail' in (DisabledParsers) )),\n ASimAuthenticationBarracudaWAF (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationBarracudaWAF' in (DisabledParsers) )),\n ASimAuthenticationCiscoASA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoASA' in (DisabledParsers) )),\n ASimAuthenticationCiscoDNAC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoDNAC' in (DisabledParsers) )),\n ASimAuthenticationCiscoFTD (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoFTD' in (DisabledParsers) )),\n ASimAuthenticationCiscoIOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoIOS' in (DisabledParsers) )),\n ASimAuthenticationCiscoISE (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISE' in (DisabledParsers) )),\n ASimAuthenticationCiscoISEAdministrator (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISEAdministrator' in (DisabledParsers) ),pack=pack),\n ASimAuthenticationCiscoMeraki (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMeraki' in (DisabledParsers) )),\n ASimAuthenticationCiscoMerakiSyslog (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )),\n ASimAuthenticationFortinetFortigate (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationFortinetFortigate' in (DisabledParsers) )),\n ASimAuthenticationM365Defender (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationM365Defender' in (DisabledParsers) )),\n ASimAuthenticationMD4IoT (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMD4IoT' in (DisabledParsers) )),\n ASimAuthenticationMicrosoftWindowsEvent (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )),\n ASimAuthenticationOktaSSO (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSSO' in (DisabledParsers) )),\n ASimAuthenticationOktaV2(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaV2' in (DisabledParsers) )),\n ASimAuthenticationOktaSystemLogs(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSystemLogs' in (DisabledParsers) )),\n ASimAuthenticationPostgreSQL (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPostgreSQL' in (DisabledParsers) )),\n ASimAuthenticationSigninLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSigninLogs' in (DisabledParsers) )),\n ASimAuthenticationSshd (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSshd' in (DisabledParsers) )),\n ASimAuthenticationSu (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSu' in (DisabledParsers) )),\n ASimAuthenticationSudo (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSudo' in (DisabledParsers) )),\n ASimAuthenticationSalesforceSC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceSC' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationSalesforceLoginHistory (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceLoginHistory' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationVectraXDRAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVectraXDRAudit' in (DisabledParsers) )),\n ASimAuthenticationSentinelOne (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSentinelOne' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspace (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspace' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspaceLogins (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspaceLogins' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoCortexDataLake (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )),\n ASimAuthenticationVMwareCarbonBlackCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )),\n ASimAuthenticationVMwareVCenter (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareVCenter' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )),\n ASimAuthenticationCrowdStrikeFalconDataReplicator (disabled=(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack),\n ASimAuthenticationIllumioSaaSCore (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationIllumioSaaSCore' in (DisabledParsers) )),\n ASimAuthenticationNative (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationNative' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoPanOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPanOS' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationPaloAltoGlobalProtect (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationVMwareESXi (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareESXi' in (DisabledParsers)), pack=pack),\n ASimAuthenticationPaloAltoPrismaCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPrismaCloud' in (DisabledParsers)), pack=pack),\n ASimAuthenticationAlibabaCloudActionTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAlibabaCloudActionTrail' in (DisabledParsers)), pack=pack),\n ASimAuthenticationWizCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationWizCloud' in (DisabledParsers)), pack=pack),\n ASimAuthenticationOracleOCI (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOracleOCI' in (DisabledParsers)), pack=pack),\n ASimAuthenticationArubaNetworksClearPass (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationArubaNetworksClearPass' in (DisabledParsers)), pack=pack),\n ASimAuthenticationCyberArkAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCyberArkAudit' in (DisabledParsers)), pack=pack),\n ASimAuthenticationZscalerZPA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationZscalerZPA' in (DisabledParsers)), pack=pack),\n ASimAuthenticationOktaAuth0 (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaAuth0' in (DisabledParsers)), pack=pack)\n", "version": 1, "functionParameters": "pack:bool=False" } diff --git a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json deleted file mode 100644 index 782da8d21c3..00000000000 --- a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "Workspace": { - "type": "string", - "metadata": { - "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." - } - }, - "WorkspaceRegion": { - "type": "string", - "defaultValue": "[resourceGroup().location]", - "metadata": { - "description": "The region of the selected workspace. The default value will use the Region selection above." - } - } - }, - "resources": [ - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2020-08-01", - "name": "[concat(parameters('Workspace'), '/ASimAuthenticationCrowdStrikeFalcon')]", - "location": "[parameters('WorkspaceRegion')]", - "properties": { - "etag": "*", - "displayName": "Authentication ASIM parser for CrowdStrike Falcon", - "category": "ASIM", - "FunctionAlias": "ASimAuthenticationCrowdStrikeFalcon", - "query": "let parser = (disabled:bool = false, pack:bool = false) {\n CrowdStrike_Auth_Events_CL\n | where not(disabled)\n | extend EventName = coalesce(event_simpleName, tostring(split(name, \"V\")[0]))\n | where EventName in~ (\"UserLogon\", \"UserLogonMac\", \"UserLogonLin\", \"UserLogoff\", \"UserLogoffMac\", \"UserLogoffLin\", \"UserLogonFailed\", \"UserLogonFailed2\", \"UserLogonFailed2Mac\", \"UserLogonFailed2Lin\", \"IoSessionLoggedOn\")\n | extend SourceFields = iff(pack, pack_all(), dynamic({}))\n | extend\n EventType = iff(EventName startswith \"UserLogoff\", \"Logoff\", \"Logon\"),\n EventResult = iff(EventName startswith \"UserLogonFailed\", \"Failure\", \"Success\"),\n EventOriginalType = EventName,\n EventOriginalSubType = LogonType,\n EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat(\"/\", SubStatus), \"\")),\n EventStartTime = coalesce(\n unixtime_seconds_todatetime(ContextTimeStamp),\n unixtime_milliseconds_todatetime(timestamp),\n unixtime_seconds_todatetime(iff(EventName startswith \"UserLogoff\", LogoffTime, LogonTime)),\n TimeGenerated),\n DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip),\n ComputerName = tostring(AdditionalFields.ComputerName),\n SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6),\n TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains \"\\\\\" and UserName !contains \"@\", strcat(LogonDomain, \"\\\\\", UserName), UserName)),\n TargetUserId = coalesce(UserSid, UID),\n TargetUserIdType = case(isnotempty(UserSid), \"SID\", isnotempty(UID), \"UID\", \"\"),\n TargetUserType = case(UserIsAdmin == \"1\", \"Admin\", UserIsAdmin == \"0\", \"Regular\", \"\"),\n TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId),\n DvcOs = case(event_platform =~ \"Win\", \"Windows\", event_platform =~ \"Mac\", \"macOS\", event_platform =~ \"Lin\", \"Linux\", event_platform)\n | extend\n EventEndTime = EventStartTime,\n EventSubType = case(LogonType == \"0\", \"System\", LogonType in (\"2\", \"7\", \"11\"), \"Interactive\", LogonType == \"3\", \"Remote\", LogonType == \"5\", \"Service\", LogonType == \"8\", \"NetworkCleartext\", LogonType == \"10\", \"RemoteInteractive\", \"\"),\n EventResultDetails = iff(EventResult == \"Failure\", \"Other\", \"\"),\n TargetUsernameType = case(TargetUsername contains \"@\", \"UPN\", TargetUsername contains \"\\\\\", \"Windows\", isnotempty(TargetUsername), \"Simple\", \"\"),\n DvcHostname = iff(tostring(split(ComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ComputerName, \".\")[0]), \"\"),\n DvcDomain = iff(ComputerName contains \".\", substring(ComputerName, indexof(ComputerName, \".\") + 1), \"\"),\n DvcFQDN = iff(ComputerName contains \".\", ComputerName, \"\"),\n SrcHostname = iff(tostring(split(ClientComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ClientComputerName, \".\")[0]), \"\"),\n SrcDomain = iff(ClientComputerName contains \".\", substring(ClientComputerName, indexof(ClientComputerName, \".\") + 1), \"\"),\n SrcFQDN = iff(ClientComputerName contains \".\", ClientComputerName, \"\")\n | project-rename\n DvcId = aid,\n DvcScopeId = cid,\n TargetUserSid = UserSid,\n TargetUserUid = UID,\n TargetUserUpn = UserPrincipal,\n TargetUserScope = LogonDomain,\n TargetOriginalUserType = UserIsAdmin,\n LogonProtocol = AuthenticationPackage\n | extend\n Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName),\n DvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcDomainType = iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname),\n TargetHostname = DvcHostname,\n TargetDomain = DvcDomain,\n TargetDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n TargetFQDN = DvcFQDN,\n TargetDvcId = DvcId,\n TargetDvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n TargetIpAddr = DvcIpAddr,\n TargetDvcOs = DvcOs,\n TargetDvcScopeId = DvcScopeId,\n EventCount = int(1),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = \"Informational\",\n DvcEntityKey = \"\",\n ActorUserEntityKey = \"\",\n ActorUserAdditionalIds = dynamic([]),\n TargetUserEntityKey = \"\",\n TargetUserAdditionalIds = dynamic([]),\n SrcSystemEntityKey = \"\",\n TargetSystemEntityKey = \"\",\n ActingApplicationEntityKey = \"\",\n TargetApplicationEntityKey = \"\",\n AdditionalEntities = dynamic([]),\n AdditionalFields = SourceFields\n | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n EventType, EventSubType, EventResult, EventResultDetails,\n EventOriginalType, EventOriginalSubType, EventOriginalResultDetails,\n Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType,\n DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey,\n Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN,\n TargetHostname, TargetDomain, TargetDomainType, TargetFQDN,\n TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId,\n TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType,\n TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope,\n TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol,\n Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds,\n TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey,\n TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey,\n AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n", - "version": 1, - "functionParameters": "disabled:bool=False,pack:bool=False" - } - } - ] -} \ No newline at end of file diff --git a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/ASimAuthenticationCrowdStrikeFalconDataReplicator.json b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/ASimAuthenticationCrowdStrikeFalconDataReplicator.json new file mode 100644 index 00000000000..a28b27c5f57 --- /dev/null +++ b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/ASimAuthenticationCrowdStrikeFalconDataReplicator.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/ASimAuthenticationCrowdStrikeFalconDataReplicator')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "Authentication ASIM parser for CrowdStrike Falcon Data Replicator", + "category": "ASIM", + "FunctionAlias": "ASimAuthenticationCrowdStrikeFalconDataReplicator", + "query": "let parser = (disabled:bool = false, pack:bool = false) {\n CrowdStrike_Auth_Events_CL\n | where not(disabled)\n | extend SourceFields = iff(pack, pack_all(), dynamic({}))\n | extend\n EventType = iff(event_simpleName startswith \"UserLogoff\", \"Logoff\", \"Logon\"),\n EventResult = iff(event_simpleName startswith \"UserLogonFailed\", \"Failure\", \"Success\"),\n EventOriginalSubType = LogonType,\n EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat(\"/\", SubStatus), \"\")),\n EventStartTime = coalesce(\n unixtime_seconds_todatetime(ContextTimeStamp),\n unixtime_milliseconds_todatetime(timestamp),\n unixtime_seconds_todatetime(iff(event_simpleName startswith \"UserLogoff\", LogoffTime, LogonTime)),\n TimeGenerated),\n DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip),\n ComputerName = tostring(AdditionalFields.ComputerName),\n SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6),\n TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains \"\\\\\" and UserName !contains \"@\", strcat(LogonDomain, \"\\\\\", UserName), UserName)),\n TargetUserId = coalesce(UserSid, UID),\n TargetUserIdType = case(isnotempty(UserSid), \"SID\", isnotempty(UID), \"UID\", \"\"),\n TargetUserType = case(UserIsAdmin == \"1\", \"Admin\", UserIsAdmin == \"0\", \"Regular\", \"\"),\n TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId),\n DvcOs = case(event_platform =~ \"Win\", \"Windows\", event_platform =~ \"Mac\", \"macOS\", event_platform =~ \"Lin\", \"Linux\", event_platform)\n | extend\n EventEndTime = EventStartTime,\n EventSubType = case(LogonType == \"0\", \"System\", LogonType in (\"2\", \"7\", \"11\"), \"Interactive\", LogonType == \"3\", \"Remote\", LogonType == \"5\", \"Service\", LogonType == \"8\", \"NetworkCleartext\", LogonType == \"10\", \"RemoteInteractive\", \"\"),\n EventResultDetails = iff(EventResult == \"Failure\", \"Other\", \"\"),\n TargetUsernameType = case(TargetUsername contains \"@\", \"UPN\", TargetUsername contains \"\\\\\", \"Windows\", isnotempty(TargetUsername), \"Simple\", \"\"),\n DvcHostname = iff(tostring(split(ComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ComputerName, \".\")[0]), \"\"),\n DvcDomain = iff(ComputerName contains \".\", substring(ComputerName, indexof(ComputerName, \".\") + 1), \"\"),\n DvcFQDN = iff(ComputerName contains \".\", ComputerName, \"\"),\n SrcHostname = iff(tostring(split(ClientComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ClientComputerName, \".\")[0]), \"\"),\n SrcDomain = iff(ClientComputerName contains \".\", substring(ClientComputerName, indexof(ClientComputerName, \".\") + 1), \"\"),\n SrcFQDN = iff(ClientComputerName contains \".\", ClientComputerName, \"\")\n | project-rename\n EventOriginalType = event_simpleName,\n DvcId = aid,\n DvcScopeId = cid,\n TargetUserSid = UserSid,\n TargetUserUid = UID,\n TargetUserUpn = UserPrincipal,\n TargetUserScope = LogonDomain,\n TargetOriginalUserType = UserIsAdmin,\n LogonProtocol = AuthenticationPackage\n | extend\n Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName),\n DvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcDomainType = iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname),\n TargetHostname = DvcHostname,\n TargetDomain = DvcDomain,\n TargetDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n TargetFQDN = DvcFQDN,\n TargetDvcId = DvcId,\n TargetDvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n TargetIpAddr = DvcIpAddr,\n TargetDvcOs = DvcOs,\n TargetDvcScopeId = DvcScopeId,\n EventCount = int(1),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon Data Replicator\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = \"Informational\",\n DvcEntityKey = \"\",\n ActorUserEntityKey = \"\",\n ActorUserAdditionalIds = dynamic([]),\n TargetUserEntityKey = \"\",\n TargetUserAdditionalIds = dynamic([]),\n SrcSystemEntityKey = \"\",\n TargetSystemEntityKey = \"\",\n ActingApplicationEntityKey = \"\",\n TargetApplicationEntityKey = \"\",\n AdditionalEntities = dynamic([]),\n AdditionalFields = SourceFields\n | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n EventType, EventSubType, EventResult, EventResultDetails,\n EventOriginalType, EventOriginalSubType, EventOriginalResultDetails,\n Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType,\n DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey,\n Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN,\n TargetHostname, TargetDomain, TargetDomainType, TargetFQDN,\n TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId,\n TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType,\n TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope,\n TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol,\n Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds,\n TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey,\n TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey,\n AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n", + "version": 1, + "functionParameters": "disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/README.md b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/README.md similarity index 67% rename from Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/README.md rename to Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/README.md index 2c53890ae86..3b6c9bc09ef 100644 --- a/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/README.md +++ b/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/README.md @@ -1,6 +1,6 @@ -# CrowdStrike Falcon ASIM Authentication Normalization Parser +# CrowdStrike Falcon Data Replicator ASIM Authentication Normalization Parser -ARM template for ASIM Authentication schema parser for CrowdStrike Falcon. +ARM template for ASIM Authentication schema parser for CrowdStrike Falcon Data Replicator. Normalizes CrowdStrike Falcon Data Replicator authentication events from CrowdStrike_Auth_Events_CL to the ASIM Authentication schema. This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. @@ -15,8 +15,8 @@ For more information, see: - [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc) For the changelog, see: -- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md) +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalconDataReplicator.md)
-[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationCrowdStrikeFalcon%2FASimAuthenticationCrowdStrikeFalcon.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationCrowdStrikeFalcon%2FASimAuthenticationCrowdStrikeFalcon.json) +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationCrowdStrikeFalconDataReplicator%2FASimAuthenticationCrowdStrikeFalconDataReplicator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationCrowdStrikeFalconDataReplicator%2FASimAuthenticationCrowdStrikeFalconDataReplicator.json) diff --git a/Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json b/Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json index e0aa24fc370..e29849357f0 100644 --- a/Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json +++ b/Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json @@ -361,11 +361,11 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", - "name": "linkedASimAuthenticationCrowdStrikeFalcon", + "name": "linkedASimAuthenticationCrowdStrikeFalconDataReplicator", "properties": { "mode": "Incremental", "templateLink": { - "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalcon/ASimAuthenticationCrowdStrikeFalcon.json", + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/ASimAuthenticationCrowdStrikeFalconDataReplicator/ASimAuthenticationCrowdStrikeFalconDataReplicator.json", "contentVersion": "1.0.0.0" }, "parameters": { @@ -1361,11 +1361,11 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", - "name": "linkedvimAuthenticationCrowdStrikeFalcon", + "name": "linkedvimAuthenticationCrowdStrikeFalconDataReplicator", "properties": { "mode": "Incremental", "templateLink": { - "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json", + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/vimAuthenticationCrowdStrikeFalconDataReplicator.json", "contentVersion": "1.0.0.0" }, "parameters": { diff --git a/Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json b/Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json index 6e2f4f55048..a20d64cd7a6 100644 --- a/Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json +++ b/Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json @@ -27,7 +27,7 @@ "displayName": "Authentication ASIM filtering parser", "category": "ASIM", "FunctionAlias": "imAuthentication", - "query": "let Generic=(starttime: datetime=datetime(null), endtime: datetime=datetime(null), username_has_any: dynamic = dynamic([]), targetappname_has_any: dynamic = dynamic([]), srcipaddr_has_any_prefix: dynamic = dynamic([]), srchostname_has_any: dynamic = dynamic([]), eventtype_in: dynamic = dynamic([]), eventresultdetails_in: dynamic = dynamic([]), eventresult: string = '*', pack: bool=false) {\n let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\n let imAuthenticationBuiltInDisabled=toscalar('ExcludeimAuthenticationBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers));\n union isfuzzy=true\n vimAuthenticationEmpty\n , vimAuthenticationAADManagedIdentitySignInLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )))\n , vimAuthenticationAADNonInteractiveUserSignInLogs(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )))\n , vimAuthenticationAADServicePrincipalSignInLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )))\n , vimAuthenticationSigninLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSigninLogs' in (DisabledParsers) )))\n , vimAuthenticationAWSCloudTrail (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled = (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAWSCloudTrail' in (DisabledParsers) )))\n , vimAuthenticationOktaSSO (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaSSO' in (DisabledParsers) )))\n , vimAuthenticationOktaSystemLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaSystemLogs' in (DisabledParsers) )))\n , vimAuthenticationOktaV2 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaV2' in (DisabledParsers) )))\n , vimAuthenticationM365Defender (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationM365Defender' in (DisabledParsers) )))\n , vimAuthenticationMicrosoftWindowsEvent (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )))\n , vimAuthenticationMD4IoT (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationMD4IoT' in (DisabledParsers) )))\n , vimAuthenticationPostgreSQL (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPostgreSQL' in (DisabledParsers) )))\n , vimAuthenticationSshd (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSshd' in (DisabledParsers) )))\n , vimAuthenticationSu (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSu' in (DisabledParsers) )))\n , vimAuthenticationSudo (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSudo' in (DisabledParsers) )))\n , vimAuthenticationCiscoASA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoASA' in (DisabledParsers) )))\n , vimAuthenticationCiscoDNAC (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoDNAC' in (DisabledParsers) )))\n , vimAuthenticationCiscoFTD (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoFTD' in (DisabledParsers) )))\n , vimAuthenticationCiscoMeraki (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoMeraki' in (DisabledParsers) )))\n , vimAuthenticationCiscoMerakiSyslog (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )))\n , vimAuthenticationCiscoIOS (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoIOS' in (DisabledParsers) )))\n , vimAuthenticationCiscoISE (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoISE' in (DisabledParsers) )))\n , vimAuthenticationCiscoISEAdministrator (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoISEAdministrator' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationBarracudaWAF (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationBarracudaWAF' in (DisabledParsers) )))\n , vimAuthenticationVectraXDRAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVectraXDRAudit' in (DisabledParsers) )))\n , vimAuthenticationGoogleWorkspace (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationGoogleWorkspace' in (DisabledParsers) )))\n , vimAuthenticationGoogleWorkspaceLogins (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationGoogleWorkspaceLogins' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationSalesforceSC (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSalesforceSC' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationSalesforceLoginHistory (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSalesforceLoginHistory' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoCortexDataLake (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )))\n , vimAuthenticationSentinelOne (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSentinelOne' in (DisabledParsers) )))\n , vimAuthenticationCrowdStrikeFalconHost (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )))\n , vimAuthenticationVMwareCarbonBlackCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )))\n , vimAuthenticationVMwareVCenter (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationIllumioSaaSCore (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationIllumioSaaS' in (DisabledParsers) )))\n , vimAuthenticationNative (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationNative' in (DisabledParsers) )))\n , vimAuthenticationFortinetFortigate (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationFortigate' in (DisabledParsers) )))\n , vimAuthenticationVMwareESXi (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareESXi' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoPanOS (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoPanOS' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoGlobalProtect (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoPrismaCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoPrismaCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationAlibabaCloudActionTrail (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAlibabaCloudActionTrail' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationWizCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationWizCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationOracleOCI (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOracleOCI' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationArubaNetworksClearPass (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationArubaNetworksClearPass' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationCyberArkAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCyberArkAudit' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationZscalerZPA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationZscalerZPA' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationOktaAuth0 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaAuth0' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationCrowdStrikeFalcon (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled=(imAuthenticationBuiltInDisabled or ('ExcludevimAuthenticationCrowdStrikeFalcon' in (DisabledParsers))), pack=pack)\n};\nGeneric(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, pack=pack)\n", + "query": "let Generic=(starttime: datetime=datetime(null), endtime: datetime=datetime(null), username_has_any: dynamic = dynamic([]), targetappname_has_any: dynamic = dynamic([]), srcipaddr_has_any_prefix: dynamic = dynamic([]), srchostname_has_any: dynamic = dynamic([]), eventtype_in: dynamic = dynamic([]), eventresultdetails_in: dynamic = dynamic([]), eventresult: string = '*', pack: bool=false) {\n let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\n let imAuthenticationBuiltInDisabled=toscalar('ExcludeimAuthenticationBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers));\n union isfuzzy=true\n vimAuthenticationEmpty\n , vimAuthenticationAADManagedIdentitySignInLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )))\n , vimAuthenticationAADNonInteractiveUserSignInLogs(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )))\n , vimAuthenticationAADServicePrincipalSignInLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )))\n , vimAuthenticationSigninLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSigninLogs' in (DisabledParsers) )))\n , vimAuthenticationAWSCloudTrail (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled = (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAWSCloudTrail' in (DisabledParsers) )))\n , vimAuthenticationOktaSSO (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaSSO' in (DisabledParsers) )))\n , vimAuthenticationOktaSystemLogs (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaSystemLogs' in (DisabledParsers) )))\n , vimAuthenticationOktaV2 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaV2' in (DisabledParsers) )))\n , vimAuthenticationM365Defender (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationM365Defender' in (DisabledParsers) )))\n , vimAuthenticationMicrosoftWindowsEvent (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )))\n , vimAuthenticationMD4IoT (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationMD4IoT' in (DisabledParsers) )))\n , vimAuthenticationPostgreSQL (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPostgreSQL' in (DisabledParsers) )))\n , vimAuthenticationSshd (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSshd' in (DisabledParsers) )))\n , vimAuthenticationSu (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSu' in (DisabledParsers) )))\n , vimAuthenticationSudo (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSudo' in (DisabledParsers) )))\n , vimAuthenticationCiscoASA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoASA' in (DisabledParsers) )))\n , vimAuthenticationCiscoDNAC (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoDNAC' in (DisabledParsers) )))\n , vimAuthenticationCiscoFTD (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoFTD' in (DisabledParsers) )))\n , vimAuthenticationCiscoMeraki (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoMeraki' in (DisabledParsers) )))\n , vimAuthenticationCiscoMerakiSyslog (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )))\n , vimAuthenticationCiscoIOS (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoIOS' in (DisabledParsers) )))\n , vimAuthenticationCiscoISE (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoISE' in (DisabledParsers) )))\n , vimAuthenticationCiscoISEAdministrator (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCiscoISEAdministrator' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationBarracudaWAF (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationBarracudaWAF' in (DisabledParsers) )))\n , vimAuthenticationVectraXDRAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVectraXDRAudit' in (DisabledParsers) )))\n , vimAuthenticationGoogleWorkspace (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationGoogleWorkspace' in (DisabledParsers) )))\n , vimAuthenticationGoogleWorkspaceLogins (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationGoogleWorkspaceLogins' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationSalesforceSC (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSalesforceSC' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationSalesforceLoginHistory (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSalesforceLoginHistory' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoCortexDataLake (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )))\n , vimAuthenticationSentinelOne (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationSentinelOne' in (DisabledParsers) )))\n , vimAuthenticationCrowdStrikeFalconHost (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )))\n , vimAuthenticationVMwareCarbonBlackCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )))\n , vimAuthenticationVMwareVCenter (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationIllumioSaaSCore (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationIllumioSaaS' in (DisabledParsers) )))\n , vimAuthenticationNative (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationNative' in (DisabledParsers) )))\n , vimAuthenticationFortinetFortigate (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationFortigate' in (DisabledParsers) )))\n , vimAuthenticationVMwareESXi (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationVMwareESXi' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoPanOS (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoPanOS' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoGlobalProtect (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationPaloAltoPrismaCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationPaloAltoPrismaCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationAlibabaCloudActionTrail (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationAlibabaCloudActionTrail' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationWizCloud (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationWizCloud' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationOracleOCI (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOracleOCI' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationArubaNetworksClearPass (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationArubaNetworksClearPass' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationCyberArkAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCyberArkAudit' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationZscalerZPA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationZscalerZPA' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationOktaAuth0 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaAuth0' in (DisabledParsers) )), pack=pack)\n , vimAuthenticationCrowdStrikeFalconDataReplicator (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled=(imAuthenticationBuiltInDisabled or ('ExcludevimAuthenticationCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack)\n};\nGeneric(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, pack=pack)\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),username_has_any:dynamic=dynamic([]),targetappname_has_any:dynamic=dynamic([]),srcipaddr_has_any_prefix:dynamic=dynamic([]),srchostname_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresultdetails_in:dynamic=dynamic([]),eventresult:string='*',pack:bool=False" } diff --git a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json deleted file mode 100644 index 532c931f9c6..00000000000 --- a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/vimAuthenticationCrowdStrikeFalcon.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "Workspace": { - "type": "string", - "metadata": { - "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." - } - }, - "WorkspaceRegion": { - "type": "string", - "defaultValue": "[resourceGroup().location]", - "metadata": { - "description": "The region of the selected workspace. The default value will use the Region selection above." - } - } - }, - "resources": [ - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2020-08-01", - "name": "[concat(parameters('Workspace'), '/vimAuthenticationCrowdStrikeFalcon')]", - "location": "[parameters('WorkspaceRegion')]", - "properties": { - "etag": "*", - "displayName": "Authentication ASIM filtering parser for CrowdStrike Falcon", - "category": "ASIM", - "FunctionAlias": "vimAuthenticationCrowdStrikeFalcon", - "query": "let parser = (\n starttime:datetime = datetime(null),\n endtime:datetime = datetime(null),\n srcipaddr_has_any_prefix:dynamic = dynamic([]),\n srchostname_has_any:dynamic = dynamic([]),\n username_has_any:dynamic = dynamic([]),\n targetappname_has_any:dynamic = dynamic([]),\n eventtype_in:dynamic = dynamic([]),\n eventresult:string = \"*\",\n eventresultdetails_in:dynamic = dynamic([]),\n disabled:bool = false,\n pack:bool = false\n) {\n CrowdStrike_Auth_Events_CL\n | where not(disabled)\n // This source has no target application name; an active application filter cannot match.\n | where array_length(targetappname_has_any) == 0\n | extend EventName = coalesce(event_simpleName, tostring(split(name, \"V\")[0]))\n | where EventName in~ (\"UserLogon\", \"UserLogonMac\", \"UserLogonLin\", \"UserLogoff\", \"UserLogoffMac\", \"UserLogoffLin\", \"UserLogonFailed\", \"UserLogonFailed2\", \"UserLogonFailed2Mac\", \"UserLogonFailed2Lin\", \"IoSessionLoggedOn\")\n | extend SourceFields = iff(pack, pack_all(), dynamic({}))\n | extend\n EventType = iff(EventName startswith \"UserLogoff\", \"Logoff\", \"Logon\"),\n EventResult = iff(EventName startswith \"UserLogonFailed\", \"Failure\", \"Success\"),\n EventOriginalType = EventName,\n EventOriginalSubType = LogonType,\n EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat(\"/\", SubStatus), \"\")),\n EventStartTime = coalesce(\n unixtime_seconds_todatetime(ContextTimeStamp),\n unixtime_milliseconds_todatetime(timestamp),\n unixtime_seconds_todatetime(iff(EventName startswith \"UserLogoff\", LogoffTime, LogonTime)),\n TimeGenerated),\n DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip),\n ComputerName = tostring(AdditionalFields.ComputerName),\n SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6),\n TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains \"\\\\\" and UserName !contains \"@\", strcat(LogonDomain, \"\\\\\", UserName), UserName)),\n TargetUserId = coalesce(UserSid, UID),\n TargetUserIdType = case(isnotempty(UserSid), \"SID\", isnotempty(UID), \"UID\", \"\"),\n TargetUserType = case(UserIsAdmin == \"1\", \"Admin\", UserIsAdmin == \"0\", \"Regular\", \"\"),\n TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId),\n DvcOs = case(event_platform =~ \"Win\", \"Windows\", event_platform =~ \"Mac\", \"macOS\", event_platform =~ \"Lin\", \"Linux\", event_platform)\n | where (isnull(starttime) or EventStartTime >= starttime)\n and (isnull(endtime) or EventStartTime <= endtime)\n and (array_length(eventtype_in) == 0 or EventType in~ (eventtype_in))\n and (eventresult == \"*\" or EventResult =~ eventresult)\n and (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix) or SrcIpAddr in~ (srcipaddr_has_any_prefix))\n and (array_length(username_has_any) == 0 or TargetUsername has_any (username_has_any))\n | extend\n EventEndTime = EventStartTime,\n EventSubType = case(LogonType == \"0\", \"System\", LogonType in (\"2\", \"7\", \"11\"), \"Interactive\", LogonType == \"3\", \"Remote\", LogonType == \"5\", \"Service\", LogonType == \"8\", \"NetworkCleartext\", LogonType == \"10\", \"RemoteInteractive\", \"\"),\n EventResultDetails = iff(EventResult == \"Failure\", \"Other\", \"\"),\n TargetUsernameType = case(TargetUsername contains \"@\", \"UPN\", TargetUsername contains \"\\\\\", \"Windows\", isnotempty(TargetUsername), \"Simple\", \"\"),\n DvcHostname = iff(tostring(split(ComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ComputerName, \".\")[0]), \"\"),\n DvcDomain = iff(ComputerName contains \".\", substring(ComputerName, indexof(ComputerName, \".\") + 1), \"\"),\n DvcFQDN = iff(ComputerName contains \".\", ComputerName, \"\"),\n SrcHostname = iff(tostring(split(ClientComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ClientComputerName, \".\")[0]), \"\"),\n SrcDomain = iff(ClientComputerName contains \".\", substring(ClientComputerName, indexof(ClientComputerName, \".\") + 1), \"\"),\n SrcFQDN = iff(ClientComputerName contains \".\", ClientComputerName, \"\")\n | where (array_length(srchostname_has_any) == 0 or SrcHostname has_any (srchostname_has_any))\n and (array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in))\n | project-rename\n DvcId = aid,\n DvcScopeId = cid,\n TargetUserSid = UserSid,\n TargetUserUid = UID,\n TargetUserUpn = UserPrincipal,\n TargetUserScope = LogonDomain,\n TargetOriginalUserType = UserIsAdmin,\n LogonProtocol = AuthenticationPackage\n | extend\n Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName),\n DvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcDomainType = iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname),\n TargetHostname = DvcHostname,\n TargetDomain = DvcDomain,\n TargetDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n TargetFQDN = DvcFQDN,\n TargetDvcId = DvcId,\n TargetDvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n TargetIpAddr = DvcIpAddr,\n TargetDvcOs = DvcOs,\n TargetDvcScopeId = DvcScopeId,\n EventCount = int(1),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = \"Informational\",\n DvcEntityKey = \"\",\n ActorUserEntityKey = \"\",\n ActorUserAdditionalIds = dynamic([]),\n TargetUserEntityKey = \"\",\n TargetUserAdditionalIds = dynamic([]),\n SrcSystemEntityKey = \"\",\n TargetSystemEntityKey = \"\",\n ActingApplicationEntityKey = \"\",\n TargetApplicationEntityKey = \"\",\n AdditionalEntities = dynamic([]),\n AdditionalFields = SourceFields\n | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n EventType, EventSubType, EventResult, EventResultDetails,\n EventOriginalType, EventOriginalSubType, EventOriginalResultDetails,\n Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType,\n DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey,\n Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN,\n TargetHostname, TargetDomain, TargetDomainType, TargetFQDN,\n TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId,\n TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType,\n TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope,\n TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol,\n Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds,\n TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey,\n TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey,\n AdditionalEntities, AdditionalFields\n};\nparser(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, eventtype_in=eventtype_in, eventresult=eventresult, eventresultdetails_in=eventresultdetails_in, disabled=disabled, pack=pack)\n", - "version": 1, - "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr_has_any_prefix:dynamic=dynamic([]),srchostname_has_any:dynamic=dynamic([]),username_has_any:dynamic=dynamic([]),targetappname_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresult:string='*',eventresultdetails_in:dynamic=dynamic([]),disabled:bool=False,pack:bool=False" - } - } - ] -} \ No newline at end of file diff --git a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/README.md b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/README.md similarity index 68% rename from Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/README.md rename to Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/README.md index a3e7d5f2a0b..0e0c8ae4629 100644 --- a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalcon/README.md +++ b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/README.md @@ -1,6 +1,6 @@ -# CrowdStrike Falcon ASIM Authentication Normalization Parser +# CrowdStrike Falcon Data Replicator ASIM Authentication Normalization Parser -ARM template for ASIM Authentication schema parser for CrowdStrike Falcon. +ARM template for ASIM Authentication schema parser for CrowdStrike Falcon Data Replicator. Filters and normalizes CrowdStrike Falcon Data Replicator authentication events from CrowdStrike_Auth_Events_CL to the ASIM Authentication schema. This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. @@ -15,8 +15,8 @@ For more information, see: - [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc) For the changelog, see: -- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md) +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalconDataReplicator.md)
-[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationCrowdStrikeFalcon%2FvimAuthenticationCrowdStrikeFalcon.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationCrowdStrikeFalcon%2FvimAuthenticationCrowdStrikeFalcon.json) +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationCrowdStrikeFalconDataReplicator%2FvimAuthenticationCrowdStrikeFalconDataReplicator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationCrowdStrikeFalconDataReplicator%2FvimAuthenticationCrowdStrikeFalconDataReplicator.json) diff --git a/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/vimAuthenticationCrowdStrikeFalconDataReplicator.json b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/vimAuthenticationCrowdStrikeFalconDataReplicator.json new file mode 100644 index 00000000000..de09d1387e9 --- /dev/null +++ b/Parsers/ASimAuthentication/ARM/vimAuthenticationCrowdStrikeFalconDataReplicator/vimAuthenticationCrowdStrikeFalconDataReplicator.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/vimAuthenticationCrowdStrikeFalconDataReplicator')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "Authentication ASIM filtering parser for CrowdStrike Falcon Data Replicator", + "category": "ASIM", + "FunctionAlias": "vimAuthenticationCrowdStrikeFalconDataReplicator", + "query": "let parser = (\n starttime:datetime = datetime(null),\n endtime:datetime = datetime(null),\n srcipaddr_has_any_prefix:dynamic = dynamic([]),\n srchostname_has_any:dynamic = dynamic([]),\n username_has_any:dynamic = dynamic([]),\n targetappname_has_any:dynamic = dynamic([]),\n eventtype_in:dynamic = dynamic([]),\n eventresult:string = \"*\",\n eventresultdetails_in:dynamic = dynamic([]),\n disabled:bool = false,\n pack:bool = false\n) {\n CrowdStrike_Auth_Events_CL\n | where not(disabled)\n // This source has no target application name; an active application filter cannot match.\n | where array_length(targetappname_has_any) == 0\n | where array_length(eventtype_in) == 0\n or (event_simpleName startswith \"UserLogoff\" and \"Logoff\" in~ (eventtype_in))\n or (event_simpleName !startswith \"UserLogoff\" and \"Logon\" in~ (eventtype_in))\n | where eventresult == \"*\"\n or (event_simpleName startswith \"UserLogonFailed\" and eventresult =~ \"Failure\")\n or (event_simpleName !startswith \"UserLogonFailed\" and eventresult =~ \"Success\")\n | extend SourceFields = iff(pack, pack_all(), dynamic({}))\n | extend EventStartTime = coalesce(\n unixtime_seconds_todatetime(ContextTimeStamp),\n unixtime_milliseconds_todatetime(timestamp),\n unixtime_seconds_todatetime(iff(event_simpleName startswith \"UserLogoff\", LogoffTime, LogonTime)),\n TimeGenerated)\n | where (isnull(starttime) or EventStartTime >= starttime)\n and (isnull(endtime) or EventStartTime <= endtime)\n | extend SrcIpAddr = coalesce(RemoteAddressIP4, RemoteAddressIP6)\n | where array_length(srcipaddr_has_any_prefix) == 0\n or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix)\n or SrcIpAddr in~ (srcipaddr_has_any_prefix)\n | extend TargetUsername = coalesce(UserPrincipal, UserCanonical, iff(isnotempty(LogonDomain) and isnotempty(UserName) and UserName !contains \"\\\\\" and UserName !contains \"@\", strcat(LogonDomain, \"\\\\\", UserName), UserName))\n | where array_length(username_has_any) == 0 or TargetUsername has_any (username_has_any)\n | extend SrcHostname = iff(tostring(split(ClientComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ClientComputerName, \".\")[0]), \"\")\n | where array_length(srchostname_has_any) == 0 or SrcHostname has_any (srchostname_has_any)\n | extend EventResultDetails = iff(event_simpleName startswith \"UserLogonFailed\", \"Other\", \"\")\n | where array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in)\n | extend\n EventType = iff(event_simpleName startswith \"UserLogoff\", \"Logoff\", \"Logon\"),\n EventResult = iff(event_simpleName startswith \"UserLogonFailed\", \"Failure\", \"Success\"),\n EventOriginalSubType = LogonType,\n EventOriginalResultDetails = strcat(Status, iff(isnotempty(SubStatus), strcat(\"/\", SubStatus), \"\")),\n DvcIpAddr = coalesce(tostring(AdditionalFields.LocalAddressIP4), tostring(AdditionalFields.LocalAddressIP6), aip),\n ComputerName = tostring(AdditionalFields.ComputerName),\n TargetUserId = coalesce(UserSid, UID),\n TargetUserIdType = case(isnotempty(UserSid), \"SID\", isnotempty(UID), \"UID\", \"\"),\n TargetUserType = case(UserIsAdmin == \"1\", \"Admin\", UserIsAdmin == \"0\", \"Regular\", \"\"),\n TargetSessionId = coalesce(AuthenticationUuidAsString, AuthenticationUuid, AuthenticationId, AuthenticationIdMac, LogonId, LoginSessionId, SessionId),\n DvcOs = case(event_platform =~ \"Win\", \"Windows\", event_platform =~ \"Mac\", \"macOS\", event_platform =~ \"Lin\", \"Linux\", event_platform)\n | extend\n EventEndTime = EventStartTime,\n EventSubType = case(LogonType == \"0\", \"System\", LogonType in (\"2\", \"7\", \"11\"), \"Interactive\", LogonType == \"3\", \"Remote\", LogonType == \"5\", \"Service\", LogonType == \"8\", \"NetworkCleartext\", LogonType == \"10\", \"RemoteInteractive\", \"\"),\n TargetUsernameType = case(TargetUsername contains \"@\", \"UPN\", TargetUsername contains \"\\\\\", \"Windows\", isnotempty(TargetUsername), \"Simple\", \"\"),\n DvcHostname = iff(tostring(split(ComputerName, \".\")[0]) matches regex @\"^[a-zA-Z0-9-]{1,61}$\", tostring(split(ComputerName, \".\")[0]), \"\"),\n DvcDomain = iff(ComputerName contains \".\", substring(ComputerName, indexof(ComputerName, \".\") + 1), \"\"),\n DvcFQDN = iff(ComputerName contains \".\", ComputerName, \"\"),\n SrcDomain = iff(ClientComputerName contains \".\", substring(ClientComputerName, indexof(ClientComputerName, \".\") + 1), \"\"),\n SrcFQDN = iff(ClientComputerName contains \".\", ClientComputerName, \"\")\n | project-rename\n EventOriginalType = event_simpleName,\n DvcId = aid,\n DvcScopeId = cid,\n TargetUserSid = UserSid,\n TargetUserUid = UID,\n TargetUserUpn = UserPrincipal,\n TargetUserScope = LogonDomain,\n TargetOriginalUserType = UserIsAdmin,\n LogonProtocol = AuthenticationPackage\n | extend\n Dvc = coalesce(DvcFQDN, DvcHostname, DvcId, DvcIpAddr, ComputerName),\n DvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n DvcDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n SrcDomainType = iff(isnotempty(SrcDomain), \"FQDN\", \"\"),\n Src = coalesce(SrcIpAddr, SrcFQDN, SrcHostname),\n TargetHostname = DvcHostname,\n TargetDomain = DvcDomain,\n TargetDomainType = iff(isnotempty(DvcDomain), \"FQDN\", \"\"),\n TargetFQDN = DvcFQDN,\n TargetDvcId = DvcId,\n TargetDvcIdType = iff(isnotempty(DvcId), \"Other\", \"\"),\n TargetIpAddr = DvcIpAddr,\n TargetDvcOs = DvcOs,\n TargetDvcScopeId = DvcScopeId,\n EventCount = int(1),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon Data Replicator\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = \"Informational\",\n DvcEntityKey = \"\",\n ActorUserEntityKey = \"\",\n ActorUserAdditionalIds = dynamic([]),\n TargetUserEntityKey = \"\",\n TargetUserAdditionalIds = dynamic([]),\n SrcSystemEntityKey = \"\",\n TargetSystemEntityKey = \"\",\n ActingApplicationEntityKey = \"\",\n TargetApplicationEntityKey = \"\",\n AdditionalEntities = dynamic([]),\n AdditionalFields = SourceFields\n | extend Dst = Dvc, User = TargetUsername, IpAddr = SrcIpAddr\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n EventType, EventSubType, EventResult, EventResultDetails,\n EventOriginalType, EventOriginalSubType, EventOriginalResultDetails,\n Dvc, DvcId, DvcIdType, DvcIpAddr, DvcHostname, DvcDomain, DvcDomainType,\n DvcFQDN, DvcOs, DvcScopeId, DvcEntityKey,\n Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN,\n TargetHostname, TargetDomain, TargetDomainType, TargetFQDN,\n TargetDvcId, TargetDvcIdType, TargetIpAddr, TargetDvcOs, TargetDvcScopeId,\n TargetUsername, TargetUsernameType, TargetUserId, TargetUserIdType,\n TargetUserSid, TargetUserUid, TargetUserUpn, TargetUserScope,\n TargetUserType, TargetOriginalUserType, TargetSessionId, LogonProtocol,\n Dst, User, IpAddr, ActorUserEntityKey, ActorUserAdditionalIds,\n TargetUserEntityKey, TargetUserAdditionalIds, SrcSystemEntityKey,\n TargetSystemEntityKey, ActingApplicationEntityKey, TargetApplicationEntityKey,\n AdditionalEntities, AdditionalFields\n};\nparser(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, eventtype_in=eventtype_in, eventresult=eventresult, eventresultdetails_in=eventresultdetails_in, disabled=disabled, pack=pack)\n", + "version": 1, + "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr_has_any_prefix:dynamic=dynamic([]),srchostname_has_any:dynamic=dynamic([]),username_has_any:dynamic=dynamic([]),targetappname_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresult:string='*',eventresultdetails_in:dynamic=dynamic([]),disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalconDataReplicator.md similarity index 75% rename from Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md rename to Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalconDataReplicator.md index dc6aec59cd3..7c60abcf125 100644 --- a/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalcon.md +++ b/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCrowdStrikeFalconDataReplicator.md @@ -1,4 +1,4 @@ -# Changelog for ASimAuthenticationCrowdStrikeFalcon.yaml +# Changelog for ASimAuthenticationCrowdStrikeFalconDataReplicator.yaml ## Version 0.1.0 @@ -6,3 +6,4 @@ - Normalize supported logon, failed logon, and logoff events, including versioned event-name fallbacks. - Map available identity, device, address, protocol, and session fields, including columns empty in the initial source sample. - Preserve all original columns with pack=true without decoding undocumented flags or status codes. +- Use Falcon Data Replicator consistently in product metadata, parser names, and built-in aliases. diff --git a/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md b/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalconDataReplicator.md similarity index 75% rename from Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md rename to Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalconDataReplicator.md index 5b921bebe32..faa5399a15f 100644 --- a/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalcon.md +++ b/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCrowdStrikeFalconDataReplicator.md @@ -1,4 +1,4 @@ -# Changelog for vimAuthenticationCrowdStrikeFalcon.yaml +# Changelog for vimAuthenticationCrowdStrikeFalconDataReplicator.yaml ## Version 0.1.0 @@ -6,3 +6,4 @@ - Support time, source IPv4 prefix or exact IP, source hostname, username, event type, result, and result-detail filtering. - Return no events for a nonempty target application filter because the source has no target application name. - Preserve the parameterless parser mappings and optional original-source packing. +- Use Falcon Data Replicator consistently in product metadata, parser names, and built-in aliases. diff --git a/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml b/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml index 0c27510416c..cdffb74a101 100644 --- a/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml +++ b/Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml @@ -60,7 +60,7 @@ ParserQuery: | ASimAuthenticationVMwareCarbonBlackCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )), ASimAuthenticationVMwareVCenter (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareVCenter' in (DisabledParsers) ), pack=pack), ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalconHost' in (DisabledParsers) )), - ASimAuthenticationCrowdStrikeFalcon (disabled=(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalcon' in (DisabledParsers))), pack=pack), + ASimAuthenticationCrowdStrikeFalconDataReplicator (disabled=(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack), ASimAuthenticationIllumioSaaSCore (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationIllumioSaaSCore' in (DisabledParsers) )), ASimAuthenticationNative (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationNative' in (DisabledParsers) )), ASimAuthenticationPaloAltoPanOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPanOS' in (DisabledParsers) ), pack=pack), @@ -109,7 +109,7 @@ Parsers: - _ASim_Authentication_VMwareCarbonBlackCloud - _ASim_Authentication_VMwareVCenter - _ASim_Authentication_CrowdStrikeFalconHost - - _ASim_Authentication_CrowdStrikeFalcon + - _ASim_Authentication_CrowdStrikeFalconDataReplicator - _ASim_Authentication_GoogleWorkspace - _ASim_Authentication_GoogleWorkspaceLogins - _ASim_Authentication_SalesforceSC diff --git a/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalcon.yaml b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalconDataReplicator.yaml similarity index 95% rename from Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalcon.yaml rename to Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalconDataReplicator.yaml index a7700704d09..051ea9aaf00 100644 --- a/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalcon.yaml +++ b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalconDataReplicator.yaml @@ -1,9 +1,9 @@ Parser: - Title: Authentication ASIM parser for CrowdStrike Falcon + Title: Authentication ASIM parser for CrowdStrike Falcon Data Replicator Version: '0.1.0' LastUpdated: Oct 23, 2026 Product: - Name: CrowdStrike Falcon + Name: CrowdStrike Falcon Data Replicator Normalization: Schema: Authentication Version: '1.0.0' @@ -17,8 +17,8 @@ References: Description: | Normalizes CrowdStrike Falcon Data Replicator authentication events from CrowdStrike_Auth_Events_CL to the ASIM Authentication schema. This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. -ParserName: ASimAuthenticationCrowdStrikeFalcon -EquivalentBuiltInParser: _ASim_Authentication_CrowdStrikeFalcon +ParserName: ASimAuthenticationCrowdStrikeFalconDataReplicator +EquivalentBuiltInParser: _ASim_Authentication_CrowdStrikeFalconDataReplicator ParserParams: - Name: disabled Type: bool @@ -88,7 +88,7 @@ ParserQuery: | TargetDvcScopeId = DvcScopeId, EventCount = int(1), EventVendor = "CrowdStrike", - EventProduct = "Falcon", + EventProduct = "Falcon Data Replicator", EventSchema = "Authentication", EventSchemaVersion = "1.0.0", EventSeverity = "Informational", diff --git a/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml b/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml index 305c4766931..873958bda30 100644 --- a/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml +++ b/Parsers/ASimAuthentication/Parsers/imAuthentication.yaml @@ -101,12 +101,12 @@ ParserQuery: | , vimAuthenticationCyberArkAudit (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationCyberArkAudit' in (DisabledParsers) )), pack=pack) , vimAuthenticationZscalerZPA (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationZscalerZPA' in (DisabledParsers) )), pack=pack) , vimAuthenticationOktaAuth0 (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled= (imAuthenticationBuiltInDisabled or('ExcludevimAuthenticationOktaAuth0' in (DisabledParsers) )), pack=pack) - , vimAuthenticationCrowdStrikeFalcon (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled=(imAuthenticationBuiltInDisabled or ('ExcludevimAuthenticationCrowdStrikeFalcon' in (DisabledParsers))), pack=pack) + , vimAuthenticationCrowdStrikeFalconDataReplicator (starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, disabled=(imAuthenticationBuiltInDisabled or ('ExcludevimAuthenticationCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack) }; Generic(starttime=starttime, endtime=endtime, username_has_any=username_has_any, targetappname_has_any=targetappname_has_any, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, srchostname_has_any=srchostname_has_any, eventtype_in=eventtype_in, eventresultdetails_in=eventresultdetails_in, eventresult=eventresult, pack=pack) Parsers: - _Im_Authentication_Empty - - _Im_Authentication_CrowdStrikeFalcon + - _Im_Authentication_CrowdStrikeFalconDataReplicator - _Im_Authentication_AADManagedIdentitySignInLogs - _Im_Authentication_AADNonInteractiveUserSignInLogs - _Im_Authentication_AADServicePrincipalSignInLogs diff --git a/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalcon.yaml b/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalconDataReplicator.yaml similarity index 97% rename from Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalcon.yaml rename to Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalconDataReplicator.yaml index 99f7d696fda..34eb1472e45 100644 --- a/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalcon.yaml +++ b/Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalconDataReplicator.yaml @@ -1,9 +1,9 @@ Parser: - Title: Authentication ASIM filtering parser for CrowdStrike Falcon + Title: Authentication ASIM filtering parser for CrowdStrike Falcon Data Replicator Version: '0.1.0' LastUpdated: Oct 23, 2026 Product: - Name: CrowdStrike Falcon + Name: CrowdStrike Falcon Data Replicator Normalization: Schema: Authentication Version: '1.0.0' @@ -17,8 +17,8 @@ References: Description: | Filters and normalizes CrowdStrike Falcon Data Replicator authentication events from CrowdStrike_Auth_Events_CL to the ASIM Authentication schema. This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. -ParserName: vimAuthenticationCrowdStrikeFalcon -EquivalentBuiltInParser: _Im_Authentication_CrowdStrikeFalcon +ParserName: vimAuthenticationCrowdStrikeFalconDataReplicator +EquivalentBuiltInParser: _Im_Authentication_CrowdStrikeFalconDataReplicator ParserParams: - Name: starttime Type: datetime @@ -143,7 +143,7 @@ ParserQuery: | TargetDvcScopeId = DvcScopeId, EventCount = int(1), EventVendor = "CrowdStrike", - EventProduct = "Falcon", + EventProduct = "Falcon Data Replicator", EventSchema = "Authentication", EventSchemaVersion = "1.0.0", EventSeverity = "Informational", diff --git a/Sample Data/ASIM/CrowdStrike_Falcon_Authentication_IngestedLogs.csv b/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_Authentication_IngestedLogs.csv similarity index 100% rename from Sample Data/ASIM/CrowdStrike_Falcon_Authentication_IngestedLogs.csv rename to Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_Authentication_IngestedLogs.csv From b648ca94bbcc578f689e8919c7b2df81a9c91653 Mon Sep 17 00:00:00 2001 From: Derrick Lee Date: Mon, 26 Oct 2026 09:44:30 -0700 Subject: [PATCH 6/6] Add schema csv --- .../CrowdStrike_Auth_Events_CL_Schema.csv | 63 +++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 Sample Data/ASIM/CrowdStrike_Auth_Events_CL_Schema.csv diff --git a/Sample Data/ASIM/CrowdStrike_Auth_Events_CL_Schema.csv b/Sample Data/ASIM/CrowdStrike_Auth_Events_CL_Schema.csv new file mode 100644 index 00000000000..7c8b37dcba6 --- /dev/null +++ b/Sample Data/ASIM/CrowdStrike_Auth_Events_CL_Schema.csv @@ -0,0 +1,63 @@ +ColumnName,ColumnType +TimeGenerated,datetime +event_simpleName,string +timestamp,long +aip,string +aid,string +UserName,string +event_platform,string +ContextTimeStamp,real +name,string +ConfigBuild,string +CrowdStrikeId,string +ConfigStateHash,string +ContextProcessId,string +ContextThreadId,string +BoundingLimitCount,long +BoundingLimitDuration,string +Entitlements,string +EffectiveTransmissionClass,string +cid,string +OciContainerId,string +TreeId,string +LogonType,string +LogonTime,real +UserIsAdmin,string +LogonDomain,string +RemoteAccount,string +ClientComputerName,string +UserPrincipal,string +RawProcessId,string +UserSid,string +LogonServer,string +AuthenticationPackage,string +AuthenticationId,string +UserLogonFlags,string +RemoteAddressIP4,string +RemoteAddressIP6,string +UserLogoffType,string +LogoffTime,real +SessionId,string +UserFlags,string +PrivilegesBitmask,string +PasswordLastSet,string +EventOrigin,string +TargetProcessId,string +Status,string +EtwRawProcessId,string +EtwRawThreadId,long +SubStatus,string +LocalSession,string +EnabledPrivilegesBitmask,string +UserGroupsBitmask,string +LinkedAuthenticationId,string +UserCanonical,string +LoginSessionId,string +AuthenticationUuidAsString,string +UID,string +AuthenticationUuid,string +AuthenticationIdMac,string +ResendToCloud,string +LogonId,string +ConfigStateHashA1,string +AdditionalFields,dynamic