diff --git a/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_DNS_Events_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_DNS_Events_CL.json index 5f07460dddd..3730f036e64 100644 --- a/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_DNS_Events_CL.json +++ b/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_DNS_Events_CL.json @@ -144,6 +144,10 @@ { "name": "AdditionalFields", "type": "dynamic" + }, + { + "name": "Type", + "type": "string" } ] } \ No newline at end of file diff --git a/Parsers/ASimDns/ARM/ASimDns/ASimDns.json b/Parsers/ASimDns/ARM/ASimDns/ASimDns.json index bca2fbc5b3a..e04f382add0 100644 --- a/Parsers/ASimDns/ARM/ASimDns/ASimDns.json +++ b/Parsers/ASimDns/ARM/ASimDns/ASimDns.json @@ -27,7 +27,7 @@ "displayName": "DNS activity ASIM parser", "category": "ASIM", "FunctionAlias": "ASimDns", - "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimDns') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet imDnsBuiltInDisabled=toscalar('ExcludeASimDnsBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimDnsEmpty,\n ASimDnsAzureFirewall (imDnsBuiltInDisabled or ('ExcludeASimDnsAzureFirewall' in (DisabledParsers) )),\n ASimDnsCiscoUmbrella (imDnsBuiltInDisabled or ('ExcludeASimDnsCiscoUmbrella' in (DisabledParsers) )),\n ASimDnsCorelightZeek (imDnsBuiltInDisabled or ('ExcludeASimDnsCorelightZeek' in (DisabledParsers) )),\n ASimDnsFortinetFortiGate (imDnsBuiltInDisabled or ('ExcludeASimDnsFortinetFortiGate' in (DisabledParsers) )),\n ASimDnsGcp (imDnsBuiltInDisabled or ('ExcludeASimDnsGcp' in (DisabledParsers) )),\n ASimDnsInfobloxNIOS (imDnsBuiltInDisabled or ('ExcludeASimDnsInfobloxNIOS' in (DisabledParsers) )),\n ASimDnsMicrosoftNXlog (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftNXlog' in (DisabledParsers) )),\n ASimDnsMicrosoftOMS (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftOMS' in (DisabledParsers) )),\n ASimDnsMicrosoftSysmon (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftSysmon' in (DisabledParsers) )),\n ASimDnsMicrosoftSysmonWindowsEvent (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftSysmonWindowsEvent' in (DisabledParsers) )),\n ASimDnsNative (imDnsBuiltInDisabled or ('ExcludeASimDnsNative' in (DisabledParsers) )),\n ASimDnsSentinelOne (imDnsBuiltInDisabled or ('ExcludeASimDnsSentinelOne' in (DisabledParsers) )),\n ASimDnsVectraAI (imDnsBuiltInDisabled or ('ExcludeASimDnsVectraAI' in (DisabledParsers) )),\n ASimDnsZscalerZIA (imDnsBuiltInDisabled or ('ExcludeASimDnsZscalerZIA' in (DisabledParsers) )),\n ASimDnsInfobloxBloxOne (imDnsBuiltInDisabled or ('ExcludeASimDnsInfobloxBloxOne' in (DisabledParsers) )),\n ASimDnsHalcyon (imDnsBuiltInDisabled or ('ExcludeASimDnsHalcyon' in (DisabledParsers) )),\n ASimDnsGigamonVSeries (imDnsBuiltInDisabled or ('ExcludeASimDnsGigamonVSeries' in (DisabledParsers) ))", + "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimDns') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet imDnsBuiltInDisabled=toscalar('ExcludeASimDnsBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimDnsEmpty,\n ASimDnsAzureFirewall (imDnsBuiltInDisabled or ('ExcludeASimDnsAzureFirewall' in (DisabledParsers) )),\n ASimDnsCiscoUmbrella (imDnsBuiltInDisabled or ('ExcludeASimDnsCiscoUmbrella' in (DisabledParsers) )),\n ASimDnsCrowdStrikeFalconDataReplicator (disabled=(imDnsBuiltInDisabled or ('ExcludeASimDnsCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack),\n ASimDnsCorelightZeek (imDnsBuiltInDisabled or ('ExcludeASimDnsCorelightZeek' in (DisabledParsers) )),\n ASimDnsFortinetFortiGate (imDnsBuiltInDisabled or ('ExcludeASimDnsFortinetFortiGate' in (DisabledParsers) )),\n ASimDnsGcp (imDnsBuiltInDisabled or ('ExcludeASimDnsGcp' in (DisabledParsers) )),\n ASimDnsInfobloxNIOS (imDnsBuiltInDisabled or ('ExcludeASimDnsInfobloxNIOS' in (DisabledParsers) )),\n ASimDnsMicrosoftNXlog (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftNXlog' in (DisabledParsers) )),\n ASimDnsMicrosoftOMS (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftOMS' in (DisabledParsers) )),\n ASimDnsMicrosoftSysmon (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftSysmon' in (DisabledParsers) )),\n ASimDnsMicrosoftSysmonWindowsEvent (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftSysmonWindowsEvent' in (DisabledParsers) )),\n ASimDnsNative (imDnsBuiltInDisabled or ('ExcludeASimDnsNative' in (DisabledParsers) )),\n ASimDnsSentinelOne (imDnsBuiltInDisabled or ('ExcludeASimDnsSentinelOne' in (DisabledParsers) )),\n ASimDnsVectraAI (imDnsBuiltInDisabled or ('ExcludeASimDnsVectraAI' in (DisabledParsers) )),\n ASimDnsZscalerZIA (imDnsBuiltInDisabled or ('ExcludeASimDnsZscalerZIA' in (DisabledParsers) )),\n ASimDnsInfobloxBloxOne (imDnsBuiltInDisabled or ('ExcludeASimDnsInfobloxBloxOne' in (DisabledParsers) )),\n ASimDnsHalcyon (imDnsBuiltInDisabled or ('ExcludeASimDnsHalcyon' in (DisabledParsers) )),\n ASimDnsGigamonVSeries (imDnsBuiltInDisabled or ('ExcludeASimDnsGigamonVSeries' in (DisabledParsers) ))", "version": 1, "functionParameters": "pack:bool=False" } diff --git a/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/ASimDnsCrowdStrikeFalconDataReplicator.json b/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/ASimDnsCrowdStrikeFalconDataReplicator.json new file mode 100644 index 00000000000..fd4c26f7c8a --- /dev/null +++ b/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/ASimDnsCrowdStrikeFalconDataReplicator.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/ASimDnsCrowdStrikeFalconDataReplicator')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "DNS ASIM parser for CrowdStrike Falcon Data Replicator", + "category": "ASIM", + "FunctionAlias": "ASimDnsCrowdStrikeFalconDataReplicator", + "query": "let parser = (disabled: bool = false, pack: bool = false) {\n let queryTypes = datatable(DnsQueryType: int, DnsQueryTypeName: string) [\n 1, \"A\", 2, \"NS\", 5, \"CNAME\", 6, \"SOA\", 10, \"NULL\", 12, \"PTR\",\n 13, \"HINFO\", 15, \"MX\", 16, \"TXT\", 17, \"RP\", 18, \"AFSDB\", 24, \"SIG\",\n 25, \"KEY\", 28, \"AAAA\", 29, \"LOC\", 33, \"SRV\", 35, \"NAPTR\", 36, \"KX\",\n 37, \"CERT\", 39, \"DNAME\", 41, \"OPT\", 43, \"DS\", 44, \"SSHFP\",\n 45, \"IPSECKEY\", 46, \"RRSIG\", 47, \"NSEC\", 48, \"DNSKEY\",\n 49, \"DHCID\", 50, \"NSEC3\", 51, \"NSEC3PARAM\", 52, \"TLSA\", 53, \"SMIMEA\",\n 55, \"HIP\", 59, \"CDS\", 60, \"CDNSKEY\", 61, \"OPENPGPKEY\", 62, \"CSYNC\",\n 63, \"ZONEMD\", 64, \"SVCB\", 65, \"HTTPS\", 99, \"SPF\", 108, \"EUI48\",\n 109, \"EUI64\", 249, \"TKEY\", 250, \"TSIG\", 251, \"IXFR\", 252, \"AXFR\",\n 253, \"MAILB\", 254, \"MAILA\", 255, \"ANY\", 256, \"URI\", 257, \"CAA\",\n 258, \"AVC\", 259, \"DOA\", 260, \"AMTRELAY\"\n ];\n CrowdStrike_DNS_Events_CL\n | where not(disabled)\n | where event_simpleName in (\"DnsRequest\", \"SuspiciousDnsRequest\")\n | extend\n EventStartTime = coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated),\n DnsQuery = trim_end(@\"\\.+\", DomainName),\n DnsQueryType = toint(RequestType),\n _QueryStatus = tolong(QueryStatus)\n | lookup kind=leftouter queryTypes on DnsQueryType\n | extend\n DnsQueryTypeName = case(\n isnotempty(DnsQueryTypeName), DnsQueryTypeName,\n DnsQueryType between (0 .. 65535), strcat(\"TYPE\", DnsQueryType),\n \"\"),\n EventEndTime = EventStartTime,\n EventCount = toint(1),\n EventType = \"Query\",\n EventSubType = iff(isnotempty(QueryStatus) or isnotempty(IP4Records)\n or isnotempty(IP6Records) or isnotempty(CNAMERecords)\n or isnotempty(FirstIP4Record) or isnotempty(FirstIP6Record), \"response\", \"request\"),\n EventResult = case(_QueryStatus == 0, \"Success\",\n isnotnull(_QueryStatus), \"Failure\", \"NA\"),\n // Nonzero vendor statuses are not assumed to be DNS wire RCODEs.\n EventResultDetails = iff(_QueryStatus == 0, \"NOERROR\", \"NA\"),\n DnsResponseCode = iff(_QueryStatus == 0, toint(0), int(null)),\n DnsResponseName = trim(@\";+\", strcat_delim(\";\", IP4Records, IP6Records, CNAMERecords,\n FirstIP4Record, FirstIP6Record)),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon Data Replicator\",\n EventSchema = \"Dns\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = iff(event_simpleName == \"SuspiciousDnsRequest\", \"Low\", \"Informational\"),\n EventUid = CrowdStrikeId,\n DvcOs = case(event_platform == \"Win\", \"Windows\", event_platform == \"Lin\", \"Linux\",\n event_platform == \"Mac\", \"macOS\", event_platform),\n DvcIdType = iff(isnotempty(aid), \"Other\", \"\"),\n SrcDvcIdType = iff(isnotempty(aid), \"Other\", \"\"),\n Dvc = coalesce(aid, aip),\n Src = aid,\n Dst = RespondingDnsServer,\n SrcUsernameType = case(isempty(UserName), \"\", UserName contains \"\\\\\", \"Windows\",\n UserName contains \"@\", \"UPN\", \"Simple\"),\n DvcEntityKey = \"\",\n SrcSystemEntityKey = \"\",\n DstSystemEntityKey = \"\",\n SrcProcessEntityKey = \"\",\n SrcUserEntityKey = \"\",\n SrcUserAdditionalIds = dynamic([]),\n AdditionalEntities = dynamic([]),\n // Preserve unverified fields rather than inventing normalized semantics.\n AdditionalFields = iff(pack, bag_pack(\n \"ContextTimeStamp\", ContextTimeStamp,\n \"ConfigBuild\", ConfigBuild,\n \"ConfigStateHash\", ConfigStateHash,\n \"ContextProcessId\", ContextProcessId,\n \"ContextThreadId\", ContextThreadId,\n \"BoundingLimitCount\", BoundingLimitCount,\n \"BoundingLimitDuration\", BoundingLimitDuration,\n \"Entitlements\", Entitlements,\n \"EffectiveTransmissionClass\", EffectiveTransmissionClass,\n \"OciContainerId\", OciContainerId,\n \"TreeId\", TreeId,\n \"RequestType\", RequestType,\n \"IP4Records\", IP4Records,\n \"IP6Records\", IP6Records,\n \"CNAMERecords\", CNAMERecords,\n \"FirstIP4Record\", FirstIP4Record,\n \"FirstIP6Record\", FirstIP6Record,\n \"DnsRequestCount\", DnsRequestCount,\n \"DualRequest\", DualRequest,\n \"DnsResponseType\", DnsResponseType,\n \"EventOrigin\", EventOrigin,\n \"QueryStatus\", QueryStatus,\n \"OriginalAdditionalFields\", AdditionalFields), dynamic({}))\n | project-rename\n EventOriginalType = event_simpleName,\n EventOriginalSubType = name,\n EventOriginalUid = CrowdStrikeId,\n EventOriginalResultDetails = QueryStatus,\n DvcIpAddr = aip,\n DvcId = aid,\n DvcScopeId = cid,\n SrcUsername = UserName,\n DvcInterface = InterfaceIndex,\n DstIpAddr = RespondingDnsServer\n | extend\n Domain = DnsQuery,\n DnsResponseCodeName = EventResultDetails,\n User = SrcUsername,\n SrcDvcId = DvcId,\n SrcDvcScopeId = DvcScopeId,\n DvcInterface = tostring(DvcInterface)\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventType, EventSubType, EventResult, EventResultDetails, EventOriginalType,\n EventOriginalSubType, EventOriginalUid, EventUid, EventOriginalResultDetails,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n Dvc, DvcIpAddr, DvcId, DvcIdType, DvcScopeId, DvcOs, DvcInterface,\n Src, SrcDvcId, SrcDvcIdType, SrcDvcScopeId, SrcUsername, SrcUsernameType, User,\n Dst, DstIpAddr, DnsQuery, Domain, DnsQueryType, DnsQueryTypeName,\n DnsResponseName, DnsResponseCode, DnsResponseCodeName,\n DvcEntityKey, SrcSystemEntityKey, DstSystemEntityKey, SrcProcessEntityKey,\n SrcUserEntityKey, SrcUserAdditionalIds, AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n", + "version": 1, + "functionParameters": "disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md b/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md new file mode 100644 index 00000000000..01242fb4b8a --- /dev/null +++ b/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md @@ -0,0 +1,23 @@ +# CrowdStrike Falcon Data Replicator ASIM Dns Normalization Parser + +ARM template for ASIM Dns schema parser for CrowdStrike Falcon Data Replicator. + +Normalizes DnsRequest and SuspiciousDnsRequest records from CrowdStrike_DNS_Events_CL +to the ASIM DNS schema. +This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. + + +The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. + +For more information, see: + +- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) +- [Deploy all of ASIM](https://aka.ms/DeployASIM) +- [ASIM Dns normalization schema reference](https://aka.ms/ASimDnsDoc) + +For the changelog, see: +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md) + +
+ +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimDns%2FARM%2FASimDnsCrowdStrikeFalconDataReplicator%2FASimDnsCrowdStrikeFalconDataReplicator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimDns%2FARM%2FASimDnsCrowdStrikeFalconDataReplicator%2FASimDnsCrowdStrikeFalconDataReplicator.json) diff --git a/Parsers/ASimDns/ARM/FullDeploymentDns.json b/Parsers/ASimDns/ARM/FullDeploymentDns.json index 994103dcb98..64a30ef3795 100644 --- a/Parsers/ASimDns/ARM/FullDeploymentDns.json +++ b/Parsers/ASimDns/ARM/FullDeploymentDns.json @@ -98,6 +98,26 @@ } } }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "linkedASimDnsCrowdStrikeFalconDataReplicator", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/ASimDnsCrowdStrikeFalconDataReplicator.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "Workspace": { + "value": "[parameters('Workspace')]" + }, + "WorkspaceRegion": { + "value": "[parameters('WorkspaceRegion')]" + } + } + } + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", @@ -458,6 +478,26 @@ } } }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "linkedvimDnsCrowdStrikeFalconDataReplicator", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/vimDnsCrowdStrikeFalconDataReplicator.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "Workspace": { + "value": "[parameters('Workspace')]" + }, + "WorkspaceRegion": { + "value": "[parameters('WorkspaceRegion')]" + } + } + } + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", diff --git a/Parsers/ASimDns/ARM/imDns/imDns.json b/Parsers/ASimDns/ARM/imDns/imDns.json index 4de9aa5a96e..4e4cb671a5a 100644 --- a/Parsers/ASimDns/ARM/imDns/imDns.json +++ b/Parsers/ASimDns/ARM/imDns/imDns.json @@ -27,7 +27,7 @@ "displayName": "DNS activity ASIM filtering parser.", "category": "ASIM", "FunctionAlias": "imDns", - "query": "let Generic=(starttime:datetime=datetime(null), endtime:datetime=datetime(null) , srcipaddr:string='*' , domain_has_any:dynamic=dynamic([]) , responsecodename:string='*', response_has_ipv4:string='*' , response_has_any_prefix:dynamic=dynamic([]) , eventtype:string='Query', pack:bool=false ){\nlet DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimDns') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet imDnsBuiltInDisabled=toscalar('ExcludeimDnsBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimDnsEmpty,\n vimDnsAzureFirewall ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsAzureFirewall' in (DisabledParsers) ))),\n vimDnsCiscoUmbrella ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsCiscoUmbrella' in (DisabledParsers) ))),\n vimDnsCorelightZeek ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsCorelightZeek' in (DisabledParsers) ))),\n vimDnsFortinetFortiGate ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsFortinetFortiGate' in (DisabledParsers) ))),\n vimDnsGcp ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsGcp' in (DisabledParsers) ))),\n vimDnsInfobloxNIOS ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsInfobloxNIOS' in (DisabledParsers) ))),\n vimDnsMicrosoftNXlog ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftNXlog' in (DisabledParsers) ))),\n vimDnsMicrosoftOMS ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftOMS' in (DisabledParsers) ))),\n vimDnsMicrosoftSysmon ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftSysmon' in (DisabledParsers) ))),\n vimDnsMicrosoftSysmonWindowsEvent ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftSysmonWindowsEvent' in (DisabledParsers) ))),\n vimDnsNative ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsNative' in (DisabledParsers) ))),\n vimDnsSentinelOne ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsSentinelOne' in (DisabledParsers) ))),\n vimDnsVectraAI ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsVectraAI' in (DisabledParsers) ))),\n vimDnsZscalerZIA ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsZscalerZIA' in (DisabledParsers) ))),\n vimDnsInfobloxBloxOne ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsInfobloxBloxOne' in (DisabledParsers) ))),\n vimDnsHalcyon ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsHalcyon' in (DisabledParsers) ))),\n vimDnsGigamonVSeries ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, pack, (imDnsBuiltInDisabled or('ExcludevimDnsGigamonVSeries' in (DisabledParsers) )))\n };\nGeneric( starttime=starttime, endtime=endtime, srcipaddr=srcipaddr, domain_has_any=domain_has_any, responsecodename=responsecodename, response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix, eventtype=eventtype, pack=pack)\n", + "query": "let Generic=(starttime:datetime=datetime(null), endtime:datetime=datetime(null) , srcipaddr:string='*' , domain_has_any:dynamic=dynamic([]) , responsecodename:string='*', response_has_ipv4:string='*' , response_has_any_prefix:dynamic=dynamic([]) , eventtype:string='Query', pack:bool=false ){\nlet DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimDns') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet imDnsBuiltInDisabled=toscalar('ExcludeimDnsBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimDnsEmpty,\n vimDnsAzureFirewall ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsAzureFirewall' in (DisabledParsers) ))),\n vimDnsCiscoUmbrella ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsCiscoUmbrella' in (DisabledParsers) ))),\n vimDnsCrowdStrikeFalconDataReplicator (starttime=starttime, endtime=endtime, srcipaddr=srcipaddr, domain_has_any=domain_has_any, responsecodename=responsecodename, response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix, eventtype=eventtype, disabled=(imDnsBuiltInDisabled or ('ExcludevimDnsCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack),\n vimDnsCorelightZeek ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsCorelightZeek' in (DisabledParsers) ))),\n vimDnsFortinetFortiGate ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsFortinetFortiGate' in (DisabledParsers) ))),\n vimDnsGcp ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsGcp' in (DisabledParsers) ))),\n vimDnsInfobloxNIOS ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsInfobloxNIOS' in (DisabledParsers) ))),\n vimDnsMicrosoftNXlog ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftNXlog' in (DisabledParsers) ))),\n vimDnsMicrosoftOMS ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftOMS' in (DisabledParsers) ))),\n vimDnsMicrosoftSysmon ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftSysmon' in (DisabledParsers) ))),\n vimDnsMicrosoftSysmonWindowsEvent ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftSysmonWindowsEvent' in (DisabledParsers) ))),\n vimDnsNative ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsNative' in (DisabledParsers) ))),\n vimDnsSentinelOne ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsSentinelOne' in (DisabledParsers) ))),\n vimDnsVectraAI ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsVectraAI' in (DisabledParsers) ))),\n vimDnsZscalerZIA ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsZscalerZIA' in (DisabledParsers) ))),\n vimDnsInfobloxBloxOne ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsInfobloxBloxOne' in (DisabledParsers) ))),\n vimDnsHalcyon ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsHalcyon' in (DisabledParsers) ))),\n vimDnsGigamonVSeries ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, pack, (imDnsBuiltInDisabled or('ExcludevimDnsGigamonVSeries' in (DisabledParsers) )))\n };\nGeneric( starttime=starttime, endtime=endtime, srcipaddr=srcipaddr, domain_has_any=domain_has_any, responsecodename=responsecodename, response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix, eventtype=eventtype, pack=pack)\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr:string='*',domain_has_any:dynamic=dynamic([]),responsecodename:string='*',response_has_ipv4:string='*',response_has_any_prefix:dynamic=dynamic([]),eventtype:string='Query',pack:bool=False" } diff --git a/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/README.md b/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/README.md new file mode 100644 index 00000000000..62669414214 --- /dev/null +++ b/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/README.md @@ -0,0 +1,23 @@ +# CrowdStrike Falcon Data Replicator ASIM Dns Normalization Parser + +ARM template for ASIM Dns schema parser for CrowdStrike Falcon Data Replicator. + +Filters and normalizes DnsRequest and SuspiciousDnsRequest records from +CrowdStrike_DNS_Events_CL to the ASIM DNS schema. +This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. + + +The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. + +For more information, see: + +- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) +- [Deploy all of ASIM](https://aka.ms/DeployASIM) +- [ASIM Dns normalization schema reference](https://aka.ms/ASimDnsDoc) + +For the changelog, see: +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md) + +
+ +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimDns%2FARM%2FvimDnsCrowdStrikeFalconDataReplicator%2FvimDnsCrowdStrikeFalconDataReplicator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimDns%2FARM%2FvimDnsCrowdStrikeFalconDataReplicator%2FvimDnsCrowdStrikeFalconDataReplicator.json) diff --git a/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/vimDnsCrowdStrikeFalconDataReplicator.json b/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/vimDnsCrowdStrikeFalconDataReplicator.json new file mode 100644 index 00000000000..59f221efb8b --- /dev/null +++ b/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/vimDnsCrowdStrikeFalconDataReplicator.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/vimDnsCrowdStrikeFalconDataReplicator')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "DNS ASIM filtering parser for CrowdStrike Falcon Data Replicator", + "category": "ASIM", + "FunctionAlias": "vimDnsCrowdStrikeFalconDataReplicator", + "query": "let parser = (\n starttime: datetime = datetime(null),\n endtime: datetime = datetime(null),\n srcipaddr: string = \"\",\n domain_has_any: dynamic = dynamic([]),\n responsecodename: string = \"\",\n response_has_ipv4: string = \"\",\n response_has_any_prefix: dynamic = dynamic([]),\n eventtype: string = \"Query\",\n disabled: bool = false,\n pack: bool = false\n) {\n let responsePrefixes = iff(isnull(response_has_any_prefix), dynamic([]), response_has_any_prefix);\n let queryTypes = datatable(DnsQueryType: int, DnsQueryTypeName: string) [\n 1, \"A\", 2, \"NS\", 5, \"CNAME\", 6, \"SOA\", 10, \"NULL\", 12, \"PTR\",\n 13, \"HINFO\", 15, \"MX\", 16, \"TXT\", 17, \"RP\", 18, \"AFSDB\", 24, \"SIG\",\n 25, \"KEY\", 28, \"AAAA\", 29, \"LOC\", 33, \"SRV\", 35, \"NAPTR\", 36, \"KX\",\n 37, \"CERT\", 39, \"DNAME\", 41, \"OPT\", 43, \"DS\", 44, \"SSHFP\",\n 45, \"IPSECKEY\", 46, \"RRSIG\", 47, \"NSEC\", 48, \"DNSKEY\",\n 49, \"DHCID\", 50, \"NSEC3\", 51, \"NSEC3PARAM\", 52, \"TLSA\", 53, \"SMIMEA\",\n 55, \"HIP\", 59, \"CDS\", 60, \"CDNSKEY\", 61, \"OPENPGPKEY\", 62, \"CSYNC\",\n 63, \"ZONEMD\", 64, \"SVCB\", 65, \"HTTPS\", 99, \"SPF\", 108, \"EUI48\",\n 109, \"EUI64\", 249, \"TKEY\", 250, \"TSIG\", 251, \"IXFR\", 252, \"AXFR\",\n 253, \"MAILB\", 254, \"MAILA\", 255, \"ANY\", 256, \"URI\", 257, \"CAA\",\n 258, \"AVC\", 259, \"DOA\", 260, \"AMTRELAY\"\n ];\n CrowdStrike_DNS_Events_CL\n | where not(disabled)\n | where event_simpleName in (\"DnsRequest\", \"SuspiciousDnsRequest\")\n | where isnull(starttime) or TimeGenerated >= starttime\n | where isnull(endtime) or TimeGenerated <= endtime\n | where isempty(eventtype) or eventtype =~ \"Query\"\n // aip is the reporting agent's address, not a proven DNS client address.\n | where isempty(srcipaddr) or srcipaddr == \"*\"\n | where array_length(domain_has_any) == 0 or isempty(tostring(domain_has_any))\n or DomainName has_any (domain_has_any)\n | extend\n EventStartTime = coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated),\n DnsQuery = trim_end(@\"\\.+\", DomainName),\n DnsQueryType = toint(RequestType),\n _QueryStatus = tolong(QueryStatus),\n DnsResponseName = trim(@\";+\", strcat_delim(\";\", IP4Records, IP6Records, CNAMERecords,\n FirstIP4Record, FirstIP6Record))\n | where isempty(response_has_ipv4) or response_has_ipv4 == \"*\"\n or has_ipv4(DnsResponseName, response_has_ipv4)\n or has_ipv4_prefix(DnsResponseName, response_has_ipv4)\n | where array_length(responsePrefixes) == 0\n or has_any_ipv4(DnsResponseName, responsePrefixes)\n or has_any_ipv4_prefix(DnsResponseName, responsePrefixes)\n | lookup kind=leftouter queryTypes on DnsQueryType\n | extend\n DnsQueryTypeName = case(\n isnotempty(DnsQueryTypeName), DnsQueryTypeName,\n DnsQueryType between (0 .. 65535), strcat(\"TYPE\", DnsQueryType),\n \"\"),\n EventEndTime = EventStartTime,\n EventCount = toint(1),\n EventType = \"Query\",\n EventSubType = iff(isnotempty(QueryStatus) or isnotempty(IP4Records)\n or isnotempty(IP6Records) or isnotempty(CNAMERecords)\n or isnotempty(FirstIP4Record) or isnotempty(FirstIP6Record), \"response\", \"request\"),\n EventResult = case(_QueryStatus == 0, \"Success\",\n isnotnull(_QueryStatus), \"Failure\", \"NA\"),\n // Nonzero vendor statuses are not assumed to be DNS wire RCODEs.\n EventResultDetails = iff(_QueryStatus == 0, \"NOERROR\", \"NA\"),\n DnsResponseCode = iff(_QueryStatus == 0, toint(0), int(null)),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon Data Replicator\",\n EventSchema = \"Dns\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = iff(event_simpleName == \"SuspiciousDnsRequest\", \"Low\", \"Informational\"),\n EventUid = CrowdStrikeId,\n DvcOs = case(event_platform == \"Win\", \"Windows\", event_platform == \"Lin\", \"Linux\",\n event_platform == \"Mac\", \"macOS\", event_platform),\n DvcIdType = iff(isnotempty(aid), \"Other\", \"\"),\n SrcDvcIdType = iff(isnotempty(aid), \"Other\", \"\"),\n Dvc = coalesce(aid, aip),\n Src = aid,\n Dst = RespondingDnsServer,\n SrcUsernameType = case(isempty(UserName), \"\", UserName contains \"\\\\\", \"Windows\",\n UserName contains \"@\", \"UPN\", \"Simple\"),\n DvcEntityKey = \"\",\n SrcSystemEntityKey = \"\",\n DstSystemEntityKey = \"\",\n SrcProcessEntityKey = \"\",\n SrcUserEntityKey = \"\",\n SrcUserAdditionalIds = dynamic([]),\n AdditionalEntities = dynamic([]),\n // Preserve unverified fields rather than inventing normalized semantics.\n AdditionalFields = iff(pack, bag_pack(\n \"ContextTimeStamp\", ContextTimeStamp,\n \"ConfigBuild\", ConfigBuild,\n \"ConfigStateHash\", ConfigStateHash,\n \"ContextProcessId\", ContextProcessId,\n \"ContextThreadId\", ContextThreadId,\n \"BoundingLimitCount\", BoundingLimitCount,\n \"BoundingLimitDuration\", BoundingLimitDuration,\n \"Entitlements\", Entitlements,\n \"EffectiveTransmissionClass\", EffectiveTransmissionClass,\n \"OciContainerId\", OciContainerId,\n \"TreeId\", TreeId,\n \"RequestType\", RequestType,\n \"IP4Records\", IP4Records,\n \"IP6Records\", IP6Records,\n \"CNAMERecords\", CNAMERecords,\n \"FirstIP4Record\", FirstIP4Record,\n \"FirstIP6Record\", FirstIP6Record,\n \"DnsRequestCount\", DnsRequestCount,\n \"DualRequest\", DualRequest,\n \"DnsResponseType\", DnsResponseType,\n \"EventOrigin\", EventOrigin,\n \"QueryStatus\", QueryStatus,\n \"OriginalAdditionalFields\", AdditionalFields), dynamic({}))\n | where isempty(responsecodename) or responsecodename == \"*\" or EventResultDetails =~ responsecodename\n | project-rename\n EventOriginalType = event_simpleName,\n EventOriginalSubType = name,\n EventOriginalUid = CrowdStrikeId,\n EventOriginalResultDetails = QueryStatus,\n DvcIpAddr = aip,\n DvcId = aid,\n DvcScopeId = cid,\n SrcUsername = UserName,\n DvcInterface = InterfaceIndex,\n DstIpAddr = RespondingDnsServer\n | extend\n Domain = DnsQuery,\n DnsResponseCodeName = EventResultDetails,\n User = SrcUsername,\n SrcDvcId = DvcId,\n SrcDvcScopeId = DvcScopeId,\n DvcInterface = tostring(DvcInterface)\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventType, EventSubType, EventResult, EventResultDetails, EventOriginalType,\n EventOriginalSubType, EventOriginalUid, EventUid, EventOriginalResultDetails,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n Dvc, DvcIpAddr, DvcId, DvcIdType, DvcScopeId, DvcOs, DvcInterface,\n Src, SrcDvcId, SrcDvcIdType, SrcDvcScopeId, SrcUsername, SrcUsernameType, User,\n Dst, DstIpAddr, DnsQuery, Domain, DnsQueryType, DnsQueryTypeName,\n DnsResponseName, DnsResponseCode, DnsResponseCodeName,\n DvcEntityKey, SrcSystemEntityKey, DstSystemEntityKey, SrcProcessEntityKey,\n SrcUserEntityKey, SrcUserAdditionalIds, AdditionalEntities, AdditionalFields\n};\nparser(starttime=starttime, endtime=endtime, srcipaddr=srcipaddr,\n domain_has_any=domain_has_any, responsecodename=responsecodename,\n response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix,\n eventtype=eventtype, disabled=disabled, pack=pack)\n", + "version": 1, + "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr:string='*',domain_has_any:dynamic=dynamic([]),responsecodename:string='*',response_has_ipv4:string='*',response_has_any_prefix:dynamic=dynamic([]),eventtype:string='Query',disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimDns/CHANGELOG/ASimDns.md b/Parsers/ASimDns/CHANGELOG/ASimDns.md index ed2d4f83e76..49a54bd9b03 100644 --- a/Parsers/ASimDns/CHANGELOG/ASimDns.md +++ b/Parsers/ASimDns/CHANGELOG/ASimDns.md @@ -1,4 +1,9 @@ # Changelog for ASimDns.yaml + +## Version 0.5.6 + +- (2026-10-23) Added the CrowdStrike Falcon Data Replicator DNS parser with disable-watchlist and `pack` parameter support - [PR #15417](https://github.com/Azure/Azure-Sentinel/pull/15417) + ## Version 0.5.5 - (2026-10-08) Corrected the Azure Firewall and GCP parser disable watchlist keys - [PR #15291](https://github.com/Azure/Azure-Sentinel/pull/15291) diff --git a/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md b/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md new file mode 100644 index 00000000000..1f113a950ba --- /dev/null +++ b/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md @@ -0,0 +1,7 @@ +# Changelog for ASimDnsCrowdStrikeFalconDataReplicator.yaml + +## Version 0.1.0 + +- (2026-10-23) Initial DNS parser for CrowdStrike Falcon Data Replicator events in `CrowdStrike_DNS_Events_CL` - [PR #15417](https://github.com/Azure/Azure-Sentinel/pull/15417) +- Uses populated `event_simpleName` values to select DNS events and includes mappings for currently empty columns. +- Preserves unverified vendor metadata with `pack=true`, without event enrichment or row expansion. \ No newline at end of file diff --git a/Parsers/ASimDns/CHANGELOG/imDns.md b/Parsers/ASimDns/CHANGELOG/imDns.md index 911db15cf21..07de22be337 100644 --- a/Parsers/ASimDns/CHANGELOG/imDns.md +++ b/Parsers/ASimDns/CHANGELOG/imDns.md @@ -1,4 +1,9 @@ # Changelog for imDns.yaml + +## Version 0.5.7 + +- (2026-10-23) Added the CrowdStrike Falcon Data Replicator DNS filtering parser, forwarding all DNS filters, the disable-watchlist setting, and `pack` - [PR #15417](https://github.com/Azure/Azure-Sentinel/pull/15417) + ## Version 0.5.6 - (2026-10-08) Corrected the GCP and Microsoft Sysmon Windows Event parser disable watchlist keys - [PR #15291](https://github.com/Azure/Azure-Sentinel/pull/15291) diff --git a/Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md b/Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md new file mode 100644 index 00000000000..df591e39e11 --- /dev/null +++ b/Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md @@ -0,0 +1,7 @@ +# Changelog for vimDnsCrowdStrikeFalconDataReplicator.yaml + +## Version 0.1.0 + +- (2026-10-23) Initial filtering DNS parser for CrowdStrike Falcon Data Replicator - [PR #15417](https://github.com/Azure/Azure-Sentinel/pull/15417) +- Supports inclusive `TimeGenerated` boundaries, domain matching, IPv4 answer and prefix filters, response codes, event types, disabling, and optional vendor metadata packing. +- Retains the same record-local mappings and normalization boundaries as the parameterless parser. diff --git a/Parsers/ASimDns/Parsers/ASimDns.yaml b/Parsers/ASimDns/Parsers/ASimDns.yaml index ef9ddc8de3a..e77181e11d7 100644 --- a/Parsers/ASimDns/Parsers/ASimDns.yaml +++ b/Parsers/ASimDns/Parsers/ASimDns.yaml @@ -1,7 +1,7 @@ Parser: Title: DNS activity ASIM parser - Version: '0.5.5' - LastUpdated: Oct 08, 2026 + Version: '0.5.6' + LastUpdated: Oct 23, 2026 Product: Name: Source agnostic Normalization: @@ -20,6 +20,7 @@ Parsers: - _Im_Dns_Empty - _ASim_Dns_AzureFirewall - _ASim_Dns_CiscoUmbrella + - _ASim_Dns_CrowdStrikeFalconDataReplicator - _ASim_Dns_CorelightZeek - _ASim_Dns_FortinetFortiGate - _ASim_Dns_Gcp @@ -46,6 +47,7 @@ ParserQuery: | vimDnsEmpty, ASimDnsAzureFirewall (imDnsBuiltInDisabled or ('ExcludeASimDnsAzureFirewall' in (DisabledParsers) )), ASimDnsCiscoUmbrella (imDnsBuiltInDisabled or ('ExcludeASimDnsCiscoUmbrella' in (DisabledParsers) )), + ASimDnsCrowdStrikeFalconDataReplicator (disabled=(imDnsBuiltInDisabled or ('ExcludeASimDnsCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack), ASimDnsCorelightZeek (imDnsBuiltInDisabled or ('ExcludeASimDnsCorelightZeek' in (DisabledParsers) )), ASimDnsFortinetFortiGate (imDnsBuiltInDisabled or ('ExcludeASimDnsFortinetFortiGate' in (DisabledParsers) )), ASimDnsGcp (imDnsBuiltInDisabled or ('ExcludeASimDnsGcp' in (DisabledParsers) )), diff --git a/Parsers/ASimDns/Parsers/ASimDnsCrowdStrikeFalconDataReplicator.yaml b/Parsers/ASimDns/Parsers/ASimDnsCrowdStrikeFalconDataReplicator.yaml new file mode 100644 index 00000000000..958469a5700 --- /dev/null +++ b/Parsers/ASimDns/Parsers/ASimDnsCrowdStrikeFalconDataReplicator.yaml @@ -0,0 +1,149 @@ +Parser: + Title: DNS ASIM parser for CrowdStrike Falcon Data Replicator + Version: '0.1.0' + LastUpdated: Oct 23, 2026 +Product: + Name: CrowdStrike Falcon Data Replicator +Normalization: + Schema: Dns + Version: '1.0.0' +References: +- Title: ASIM Dns Schema + Link: https://aka.ms/ASimDnsDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: CrowdStrike Falcon Data Replicator connector + Link: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/CrowdStrikeS3FDR_ccp/DataConnectorDefinition.json +Description: | + Normalizes DnsRequest and SuspiciousDnsRequest records from CrowdStrike_DNS_Events_CL + to the ASIM DNS schema. + This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. +ParserName: ASimDnsCrowdStrikeFalconDataReplicator +EquivalentBuiltInParser: _ASim_Dns_CrowdStrikeFalconDataReplicator +ParserParams: + - Name: disabled + Type: bool + Default: false + - Name: pack + Type: bool + Default: false +ParserQuery: | + let parser = (disabled: bool = false, pack: bool = false) { + let queryTypes = datatable(DnsQueryType: int, DnsQueryTypeName: string) [ + 1, "A", 2, "NS", 5, "CNAME", 6, "SOA", 10, "NULL", 12, "PTR", + 13, "HINFO", 15, "MX", 16, "TXT", 17, "RP", 18, "AFSDB", 24, "SIG", + 25, "KEY", 28, "AAAA", 29, "LOC", 33, "SRV", 35, "NAPTR", 36, "KX", + 37, "CERT", 39, "DNAME", 41, "OPT", 43, "DS", 44, "SSHFP", + 45, "IPSECKEY", 46, "RRSIG", 47, "NSEC", 48, "DNSKEY", + 49, "DHCID", 50, "NSEC3", 51, "NSEC3PARAM", 52, "TLSA", 53, "SMIMEA", + 55, "HIP", 59, "CDS", 60, "CDNSKEY", 61, "OPENPGPKEY", 62, "CSYNC", + 63, "ZONEMD", 64, "SVCB", 65, "HTTPS", 99, "SPF", 108, "EUI48", + 109, "EUI64", 249, "TKEY", 250, "TSIG", 251, "IXFR", 252, "AXFR", + 253, "MAILB", 254, "MAILA", 255, "ANY", 256, "URI", 257, "CAA", + 258, "AVC", 259, "DOA", 260, "AMTRELAY" + ]; + CrowdStrike_DNS_Events_CL + | where not(disabled) + | where event_simpleName in ("DnsRequest", "SuspiciousDnsRequest") + | extend + EventStartTime = coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated), + DnsQuery = trim_end(@"\.+", DomainName), + DnsQueryType = toint(RequestType), + _QueryStatus = tolong(QueryStatus) + | lookup kind=leftouter queryTypes on DnsQueryType + | extend + DnsQueryTypeName = case( + isnotempty(DnsQueryTypeName), DnsQueryTypeName, + DnsQueryType between (0 .. 65535), strcat("TYPE", DnsQueryType), + ""), + EventEndTime = EventStartTime, + EventCount = toint(1), + EventType = "Query", + EventSubType = iff(isnotempty(QueryStatus) or isnotempty(IP4Records) + or isnotempty(IP6Records) or isnotempty(CNAMERecords) + or isnotempty(FirstIP4Record) or isnotempty(FirstIP6Record), "response", "request"), + EventResult = case(_QueryStatus == 0, "Success", + isnotnull(_QueryStatus), "Failure", "NA"), + // Nonzero vendor statuses are not assumed to be DNS wire RCODEs. + EventResultDetails = iff(_QueryStatus == 0, "NOERROR", "NA"), + DnsResponseCode = iff(_QueryStatus == 0, toint(0), int(null)), + DnsResponseName = trim(@";+", strcat_delim(";", IP4Records, IP6Records, CNAMERecords, + FirstIP4Record, FirstIP6Record)), + EventVendor = "CrowdStrike", + EventProduct = "Falcon Data Replicator", + EventSchema = "Dns", + EventSchemaVersion = "1.0.0", + EventSeverity = iff(event_simpleName == "SuspiciousDnsRequest", "Low", "Informational"), + EventUid = CrowdStrikeId, + DvcOs = case(event_platform == "Win", "Windows", event_platform == "Lin", "Linux", + event_platform == "Mac", "macOS", event_platform), + DvcIdType = iff(isnotempty(aid), "Other", ""), + SrcDvcIdType = iff(isnotempty(aid), "Other", ""), + Dvc = coalesce(aid, aip), + Src = aid, + Dst = RespondingDnsServer, + SrcUsernameType = case(isempty(UserName), "", UserName contains "\\", "Windows", + UserName contains "@", "UPN", "Simple"), + DvcEntityKey = "", + SrcSystemEntityKey = "", + DstSystemEntityKey = "", + SrcProcessEntityKey = "", + SrcUserEntityKey = "", + SrcUserAdditionalIds = dynamic([]), + AdditionalEntities = dynamic([]), + // Preserve unverified fields rather than inventing normalized semantics. + AdditionalFields = iff(pack, bag_pack( + "ContextTimeStamp", ContextTimeStamp, + "ConfigBuild", ConfigBuild, + "ConfigStateHash", ConfigStateHash, + "ContextProcessId", ContextProcessId, + "ContextThreadId", ContextThreadId, + "BoundingLimitCount", BoundingLimitCount, + "BoundingLimitDuration", BoundingLimitDuration, + "Entitlements", Entitlements, + "EffectiveTransmissionClass", EffectiveTransmissionClass, + "OciContainerId", OciContainerId, + "TreeId", TreeId, + "RequestType", RequestType, + "IP4Records", IP4Records, + "IP6Records", IP6Records, + "CNAMERecords", CNAMERecords, + "FirstIP4Record", FirstIP4Record, + "FirstIP6Record", FirstIP6Record, + "DnsRequestCount", DnsRequestCount, + "DualRequest", DualRequest, + "DnsResponseType", DnsResponseType, + "EventOrigin", EventOrigin, + "QueryStatus", QueryStatus, + "OriginalAdditionalFields", AdditionalFields), dynamic({})) + | project-rename + EventOriginalType = event_simpleName, + EventOriginalSubType = name, + EventOriginalUid = CrowdStrikeId, + EventOriginalResultDetails = QueryStatus, + DvcIpAddr = aip, + DvcId = aid, + DvcScopeId = cid, + SrcUsername = UserName, + DvcInterface = InterfaceIndex, + DstIpAddr = RespondingDnsServer + | extend + Domain = DnsQuery, + DnsResponseCodeName = EventResultDetails, + User = SrcUsername, + SrcDvcId = DvcId, + SrcDvcScopeId = DvcScopeId, + DvcInterface = tostring(DvcInterface) + | project + TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, + EventType, EventSubType, EventResult, EventResultDetails, EventOriginalType, + EventOriginalSubType, EventOriginalUid, EventUid, EventOriginalResultDetails, + EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity, + Dvc, DvcIpAddr, DvcId, DvcIdType, DvcScopeId, DvcOs, DvcInterface, + Src, SrcDvcId, SrcDvcIdType, SrcDvcScopeId, SrcUsername, SrcUsernameType, User, + Dst, DstIpAddr, DnsQuery, Domain, DnsQueryType, DnsQueryTypeName, + DnsResponseName, DnsResponseCode, DnsResponseCodeName, + DvcEntityKey, SrcSystemEntityKey, DstSystemEntityKey, SrcProcessEntityKey, + SrcUserEntityKey, SrcUserAdditionalIds, AdditionalEntities, AdditionalFields + }; + parser(disabled=disabled, pack=pack) diff --git a/Parsers/ASimDns/Parsers/imDns.yaml b/Parsers/ASimDns/Parsers/imDns.yaml index 20cdb081818..9d4921fa60a 100644 --- a/Parsers/ASimDns/Parsers/imDns.yaml +++ b/Parsers/ASimDns/Parsers/imDns.yaml @@ -1,7 +1,7 @@ Parser: Title: DNS activity ASIM filtering parser. - Version: '0.5.6' - LastUpdated: Oct 08, 2026 + Version: '0.5.7' + LastUpdated: Oct 23, 2026 Product: Name: Source agnostic Normalization: @@ -51,6 +51,7 @@ ParserQuery: | vimDnsEmpty, vimDnsAzureFirewall ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsAzureFirewall' in (DisabledParsers) ))), vimDnsCiscoUmbrella ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsCiscoUmbrella' in (DisabledParsers) ))), + vimDnsCrowdStrikeFalconDataReplicator (starttime=starttime, endtime=endtime, srcipaddr=srcipaddr, domain_has_any=domain_has_any, responsecodename=responsecodename, response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix, eventtype=eventtype, disabled=(imDnsBuiltInDisabled or ('ExcludevimDnsCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack), vimDnsCorelightZeek ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsCorelightZeek' in (DisabledParsers) ))), vimDnsFortinetFortiGate ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsFortinetFortiGate' in (DisabledParsers) ))), vimDnsGcp ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsGcp' in (DisabledParsers) ))), @@ -73,6 +74,7 @@ Parsers: - _Im_Dns_Empty - _Im_Dns_AzureFirewall - _Im_Dns_CiscoUmbrella + - _Im_Dns_CrowdStrikeFalconDataReplicator - _Im_Dns_CorelightZeek - _Im_Dns_FortinetFortiGate - _Im_Dns_Gcp diff --git a/Parsers/ASimDns/Parsers/vimDnsCrowdStrikeFalconDataReplicator.yaml b/Parsers/ASimDns/Parsers/vimDnsCrowdStrikeFalconDataReplicator.yaml new file mode 100644 index 00000000000..cbabc1bd9b3 --- /dev/null +++ b/Parsers/ASimDns/Parsers/vimDnsCrowdStrikeFalconDataReplicator.yaml @@ -0,0 +1,202 @@ +Parser: + Title: DNS ASIM filtering parser for CrowdStrike Falcon Data Replicator + Version: '0.1.0' + LastUpdated: Oct 23, 2026 +Product: + Name: CrowdStrike Falcon Data Replicator +Normalization: + Schema: Dns + Version: '1.0.0' +References: +- Title: ASIM Dns Schema + Link: https://aka.ms/ASimDnsDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: CrowdStrike Falcon Data Replicator connector + Link: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/CrowdStrikeS3FDR_ccp/DataConnectorDefinition.json +Description: | + Filters and normalizes DnsRequest and SuspiciousDnsRequest records from + CrowdStrike_DNS_Events_CL to the ASIM DNS schema. + This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. +ParserName: vimDnsCrowdStrikeFalconDataReplicator +EquivalentBuiltInParser: _Im_Dns_CrowdStrikeFalconDataReplicator +ParserParams: + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: srcipaddr + Type: string + Default: '*' + - Name: domain_has_any + Type: dynamic + Default: dynamic([]) + - Name: responsecodename + Type: string + Default: '*' + - Name: response_has_ipv4 + Type: string + Default: '*' + - Name: response_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: eventtype + Type: string + Default: 'Query' + - Name: disabled + Type: bool + Default: false + - Name: pack + Type: bool + Default: false +ParserQuery: | + let parser = ( + starttime: datetime = datetime(null), + endtime: datetime = datetime(null), + srcipaddr: string = "", + domain_has_any: dynamic = dynamic([]), + responsecodename: string = "", + response_has_ipv4: string = "", + response_has_any_prefix: dynamic = dynamic([]), + eventtype: string = "Query", + disabled: bool = false, + pack: bool = false + ) { + let responsePrefixes = iff(isnull(response_has_any_prefix), dynamic([]), response_has_any_prefix); + let queryTypes = datatable(DnsQueryType: int, DnsQueryTypeName: string) [ + 1, "A", 2, "NS", 5, "CNAME", 6, "SOA", 10, "NULL", 12, "PTR", + 13, "HINFO", 15, "MX", 16, "TXT", 17, "RP", 18, "AFSDB", 24, "SIG", + 25, "KEY", 28, "AAAA", 29, "LOC", 33, "SRV", 35, "NAPTR", 36, "KX", + 37, "CERT", 39, "DNAME", 41, "OPT", 43, "DS", 44, "SSHFP", + 45, "IPSECKEY", 46, "RRSIG", 47, "NSEC", 48, "DNSKEY", + 49, "DHCID", 50, "NSEC3", 51, "NSEC3PARAM", 52, "TLSA", 53, "SMIMEA", + 55, "HIP", 59, "CDS", 60, "CDNSKEY", 61, "OPENPGPKEY", 62, "CSYNC", + 63, "ZONEMD", 64, "SVCB", 65, "HTTPS", 99, "SPF", 108, "EUI48", + 109, "EUI64", 249, "TKEY", 250, "TSIG", 251, "IXFR", 252, "AXFR", + 253, "MAILB", 254, "MAILA", 255, "ANY", 256, "URI", 257, "CAA", + 258, "AVC", 259, "DOA", 260, "AMTRELAY" + ]; + CrowdStrike_DNS_Events_CL + | where not(disabled) + | where event_simpleName in ("DnsRequest", "SuspiciousDnsRequest") + | where isnull(starttime) or TimeGenerated >= starttime + | where isnull(endtime) or TimeGenerated <= endtime + | where isempty(eventtype) or eventtype =~ "Query" + // aip is the reporting agent's address, not a proven DNS client address. + | where isempty(srcipaddr) or srcipaddr == "*" + | where array_length(domain_has_any) == 0 or isempty(tostring(domain_has_any)) + or DomainName has_any (domain_has_any) + | extend + EventStartTime = coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated), + DnsQuery = trim_end(@"\.+", DomainName), + DnsQueryType = toint(RequestType), + _QueryStatus = tolong(QueryStatus), + DnsResponseName = trim(@";+", strcat_delim(";", IP4Records, IP6Records, CNAMERecords, + FirstIP4Record, FirstIP6Record)) + | where isempty(response_has_ipv4) or response_has_ipv4 == "*" + or has_ipv4(DnsResponseName, response_has_ipv4) + or has_ipv4_prefix(DnsResponseName, response_has_ipv4) + | where array_length(responsePrefixes) == 0 + or has_any_ipv4(DnsResponseName, responsePrefixes) + or has_any_ipv4_prefix(DnsResponseName, responsePrefixes) + | lookup kind=leftouter queryTypes on DnsQueryType + | extend + DnsQueryTypeName = case( + isnotempty(DnsQueryTypeName), DnsQueryTypeName, + DnsQueryType between (0 .. 65535), strcat("TYPE", DnsQueryType), + ""), + EventEndTime = EventStartTime, + EventCount = toint(1), + EventType = "Query", + EventSubType = iff(isnotempty(QueryStatus) or isnotempty(IP4Records) + or isnotempty(IP6Records) or isnotempty(CNAMERecords) + or isnotempty(FirstIP4Record) or isnotempty(FirstIP6Record), "response", "request"), + EventResult = case(_QueryStatus == 0, "Success", + isnotnull(_QueryStatus), "Failure", "NA"), + // Nonzero vendor statuses are not assumed to be DNS wire RCODEs. + EventResultDetails = iff(_QueryStatus == 0, "NOERROR", "NA"), + DnsResponseCode = iff(_QueryStatus == 0, toint(0), int(null)), + EventVendor = "CrowdStrike", + EventProduct = "Falcon Data Replicator", + EventSchema = "Dns", + EventSchemaVersion = "1.0.0", + EventSeverity = iff(event_simpleName == "SuspiciousDnsRequest", "Low", "Informational"), + EventUid = CrowdStrikeId, + DvcOs = case(event_platform == "Win", "Windows", event_platform == "Lin", "Linux", + event_platform == "Mac", "macOS", event_platform), + DvcIdType = iff(isnotempty(aid), "Other", ""), + SrcDvcIdType = iff(isnotempty(aid), "Other", ""), + Dvc = coalesce(aid, aip), + Src = aid, + Dst = RespondingDnsServer, + SrcUsernameType = case(isempty(UserName), "", UserName contains "\\", "Windows", + UserName contains "@", "UPN", "Simple"), + DvcEntityKey = "", + SrcSystemEntityKey = "", + DstSystemEntityKey = "", + SrcProcessEntityKey = "", + SrcUserEntityKey = "", + SrcUserAdditionalIds = dynamic([]), + AdditionalEntities = dynamic([]), + // Preserve unverified fields rather than inventing normalized semantics. + AdditionalFields = iff(pack, bag_pack( + "ContextTimeStamp", ContextTimeStamp, + "ConfigBuild", ConfigBuild, + "ConfigStateHash", ConfigStateHash, + "ContextProcessId", ContextProcessId, + "ContextThreadId", ContextThreadId, + "BoundingLimitCount", BoundingLimitCount, + "BoundingLimitDuration", BoundingLimitDuration, + "Entitlements", Entitlements, + "EffectiveTransmissionClass", EffectiveTransmissionClass, + "OciContainerId", OciContainerId, + "TreeId", TreeId, + "RequestType", RequestType, + "IP4Records", IP4Records, + "IP6Records", IP6Records, + "CNAMERecords", CNAMERecords, + "FirstIP4Record", FirstIP4Record, + "FirstIP6Record", FirstIP6Record, + "DnsRequestCount", DnsRequestCount, + "DualRequest", DualRequest, + "DnsResponseType", DnsResponseType, + "EventOrigin", EventOrigin, + "QueryStatus", QueryStatus, + "OriginalAdditionalFields", AdditionalFields), dynamic({})) + | where isempty(responsecodename) or responsecodename == "*" or EventResultDetails =~ responsecodename + | project-rename + EventOriginalType = event_simpleName, + EventOriginalSubType = name, + EventOriginalUid = CrowdStrikeId, + EventOriginalResultDetails = QueryStatus, + DvcIpAddr = aip, + DvcId = aid, + DvcScopeId = cid, + SrcUsername = UserName, + DvcInterface = InterfaceIndex, + DstIpAddr = RespondingDnsServer + | extend + Domain = DnsQuery, + DnsResponseCodeName = EventResultDetails, + User = SrcUsername, + SrcDvcId = DvcId, + SrcDvcScopeId = DvcScopeId, + DvcInterface = tostring(DvcInterface) + | project + TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, + EventType, EventSubType, EventResult, EventResultDetails, EventOriginalType, + EventOriginalSubType, EventOriginalUid, EventUid, EventOriginalResultDetails, + EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity, + Dvc, DvcIpAddr, DvcId, DvcIdType, DvcScopeId, DvcOs, DvcInterface, + Src, SrcDvcId, SrcDvcIdType, SrcDvcScopeId, SrcUsername, SrcUsernameType, User, + Dst, DstIpAddr, DnsQuery, Domain, DnsQueryType, DnsQueryTypeName, + DnsResponseName, DnsResponseCode, DnsResponseCodeName, + DvcEntityKey, SrcSystemEntityKey, DstSystemEntityKey, SrcProcessEntityKey, + SrcUserEntityKey, SrcUserAdditionalIds, AdditionalEntities, AdditionalFields + }; + parser(starttime=starttime, endtime=endtime, srcipaddr=srcipaddr, + domain_has_any=domain_has_any, responsecodename=responsecodename, + response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix, + eventtype=eventtype, disabled=disabled, pack=pack) diff --git a/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_Dns_IngestedLogs.csv b/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_Dns_IngestedLogs.csv new file mode 100644 index 00000000000..79eae619d17 --- /dev/null +++ b/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_Dns_IngestedLogs.csv @@ -0,0 +1,11 @@ +"TimeGenerated","event_simpleName","timestamp","aip","aid","UserName","event_platform","ContextTimeStamp","name","ConfigBuild","CrowdStrikeId","ConfigStateHash","ContextProcessId","ContextThreadId","BoundingLimitCount","BoundingLimitDuration","Entitlements","EffectiveTransmissionClass","cid","OciContainerId","TreeId","DomainName","RequestType","IP4Records","QueryStatus","FirstIP4Record","DnsRequestCount","IP6Records","InterfaceIndex","DualRequest","DnsResponseType","EventOrigin","RespondingDnsServer","CNAMERecords","FirstIP6Record","AdditionalFields","Type" +"2026-10-20T00:00:00Z","DnsRequest","1792454400000","192.0.2.10","00000000000000000000000000000001","EXAMPLE\alice","Win","1792454400","DnsRequestV5","config-1","00000000-0000-4000-8000-000000000001","hash-1","123456789012345","10","20","60","15","2","00000000000000000000000000000010","container-1","tree-1","www.example.com.","1","203.0.113.10;203.0.113.11","0","203.0.113.10","1","","1","0","1","sensor","192.0.2.53","edge.example.com","","{""fixture"":""ipv4-success""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T01:00:00Z","SuspiciousDnsRequest","1792458000000","192.0.2.11","00000000000000000000000000000002","bob@example.net","Lin","1792458000","SuspiciousDnsRequestLinV3","config-2","00000000-0000-4000-8000-000000000002","hash-2","123456789012346","11","20","60","15","2","00000000000000000000000000000010","container-2","tree-2","bad.example.net","28","","9003","","1","2001:db8::11","2","1","2","sensor","192.0.2.53","","2001:db8::11","{""fixture"":""unverified-status""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T02:00:00Z","DnsRequest","1792461600000","192.0.2.12","00000000000000000000000000000003","carol","Mac","1792461600","DnsRequestMacV6","config-3","00000000-0000-4000-8000-000000000003","hash-3","123456789012347","12","20","60","15","2","00000000000000000000000000000010","container-3","tree-3","alias.example.org.","5","","","","1","","3","0","1","sensor","192.0.2.53","target.example.org","","{""fixture"":""cname""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T03:00:00Z","DnsRequest","1792465200000","192.0.2.13","00000000000000000000000000000004","EXAMPLE\dana","Win","1792465200","DnsRequestV5","config-4","00000000-0000-4000-8000-000000000004","hash-4","123456789012348","13","20","60","15","2","00000000000000000000000000000010","container-4","tree-4","mail.example.com","15","","0","","1","","4","0","1","sensor","192.0.2.53","mx.example.com","","{""fixture"":""mx""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T04:00:00Z","SuspiciousDnsRequest","1792468800000","192.0.2.14","00000000000000000000000000000005","erin@example.net","Lin","1792468800","SuspiciousDnsRequestLinV3","config-5","00000000-0000-4000-8000-000000000005","hash-5","123456789012349","14","20","60","15","2","00000000000000000000000000000010","container-5","tree-5","txt.example.net","16","","9002","","1","","5","0","2","sensor","192.0.2.53","","","{""fixture"":""nonzero-status""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T05:00:00Z","DnsRequest","1792472400000","192.0.2.15","00000000000000000000000000000006","frank","Mac","1792472400","DnsRequestMacV6","config-6","00000000-0000-4000-8000-000000000006","hash-6","123456789012350","15","20","60","15","2","00000000000000000000000000000010","container-6","tree-6","_service._tcp.example.org","33","","0","","1","","6","0","1","sensor","192.0.2.53","service.example.org","","{""fixture"":""srv""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T06:00:00Z","DnsRequest","1792476000000","192.0.2.16","00000000000000000000000000000007","EXAMPLE\grace","Win","1792476000","DnsRequestV5","config-7","00000000-0000-4000-8000-000000000007","hash-7","123456789012351","16","20","60","15","2","00000000000000000000000000000010","container-7","tree-7","https.example.com","65","","","","1","","7","0","1","sensor","192.0.2.53","","","{""fixture"":""request-only""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T07:00:00Z","DnsRequest","1792479600000","192.0.2.17","00000000000000000000000000000008","heidi@example.net","Lin","1792479600","DnsRequestLinV8","config-8","00000000-0000-4000-8000-000000000008","hash-8","123456789012352","17","20","60","15","2","00000000000000000000000000000010","container-8","tree-8","private.example.net","65280","","0","198.51.100.17","7","","8","0","1","sensor","192.0.2.53","","","{""fixture"":""unknown-rr-type""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T08:00:00Z","DnsRequest","1792483200000","192.0.2.18","00000000000000000000000000000009","ivan","Mac","1792483200","DnsRequestMacV6","config-9","00000000-0000-4000-8000-000000000009","hash-9","123456789012353","18","20","60","15","2","00000000000000000000000000000010","container-9","tree-9","18.2.0.192.in-addr.arpa.","12","","0","","1","","9","0","1","sensor","192.0.2.53","host.example.org","","{""fixture"":""ptr""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T09:00:00Z","DnsRequest","","192.0.2.19","0000000000000000000000000000000a","judy@example.org","Win","1792486800","DnsRequestV5","config-10","00000000-0000-4000-8000-00000000000a","hash-10","123456789012354","19","20","60","15","2","00000000000000000000000000000010","container-10","tree-10","any.example.org","255","203.0.113.19","0","203.0.113.19","1","2001:db8::19","10","1","1","sensor","192.0.2.53","dual.example.org","2001:db8::19","{""fixture"":""dual-stack-and-time-fallback""}","CrowdStrike_DNS_Events_CL"