From ca1b14ed9d23ceeb224bb9826c822383f84965a8 Mon Sep 17 00:00:00 2001 From: Derrick Lee Date: Fri, 23 Oct 2026 15:54:44 -0700 Subject: [PATCH 1/3] Initial commit --- .../CrowdStrike_DNS_Events_CL.json | 4 + Parsers/ASimDns/ARM/ASimDns/ASimDns.json | 2 +- ...SimDnsCrowdStrikeFalconDataReplicator.json | 36 ++++ .../README.md | 17 ++ Parsers/ASimDns/ARM/FullDeploymentDns.json | 40 ++++ Parsers/ASimDns/ARM/imDns/imDns.json | 2 +- .../README.md | 18 ++ ...vimDnsCrowdStrikeFalconDataReplicator.json | 36 ++++ Parsers/ASimDns/CHANGELOG/ASimDns.md | 5 + .../ASimDnsCrowdStrikeFalconDataReplicator.md | 7 + Parsers/ASimDns/CHANGELOG/imDns.md | 5 + .../vimDnsCrowdStrikeFalconDataReplicator.md | 7 + Parsers/ASimDns/Parsers/ASimDns.yaml | 6 +- ...SimDnsCrowdStrikeFalconDataReplicator.yaml | 149 +++++++++++++ Parsers/ASimDns/Parsers/imDns.yaml | 6 +- ...vimDnsCrowdStrikeFalconDataReplicator.yaml | 202 ++++++++++++++++++ ...alcon Data Replicator_Dns_IngestedLogs.csv | 11 + 17 files changed, 547 insertions(+), 6 deletions(-) create mode 100644 Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/ASimDnsCrowdStrikeFalconDataReplicator.json create mode 100644 Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md create mode 100644 Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/README.md create mode 100644 Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/vimDnsCrowdStrikeFalconDataReplicator.json create mode 100644 Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md create mode 100644 Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md create mode 100644 Parsers/ASimDns/Parsers/ASimDnsCrowdStrikeFalconDataReplicator.yaml create mode 100644 Parsers/ASimDns/Parsers/vimDnsCrowdStrikeFalconDataReplicator.yaml create mode 100644 Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_Dns_IngestedLogs.csv diff --git a/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_DNS_Events_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_DNS_Events_CL.json index 5f07460dddd..3730f036e64 100644 --- a/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_DNS_Events_CL.json +++ b/.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_DNS_Events_CL.json @@ -144,6 +144,10 @@ { "name": "AdditionalFields", "type": "dynamic" + }, + { + "name": "Type", + "type": "string" } ] } \ No newline at end of file diff --git a/Parsers/ASimDns/ARM/ASimDns/ASimDns.json b/Parsers/ASimDns/ARM/ASimDns/ASimDns.json index bca2fbc5b3a..e04f382add0 100644 --- a/Parsers/ASimDns/ARM/ASimDns/ASimDns.json +++ b/Parsers/ASimDns/ARM/ASimDns/ASimDns.json @@ -27,7 +27,7 @@ "displayName": "DNS activity ASIM parser", "category": "ASIM", "FunctionAlias": "ASimDns", - "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimDns') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet imDnsBuiltInDisabled=toscalar('ExcludeASimDnsBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimDnsEmpty,\n ASimDnsAzureFirewall (imDnsBuiltInDisabled or ('ExcludeASimDnsAzureFirewall' in (DisabledParsers) )),\n ASimDnsCiscoUmbrella (imDnsBuiltInDisabled or ('ExcludeASimDnsCiscoUmbrella' in (DisabledParsers) )),\n ASimDnsCorelightZeek (imDnsBuiltInDisabled or ('ExcludeASimDnsCorelightZeek' in (DisabledParsers) )),\n ASimDnsFortinetFortiGate (imDnsBuiltInDisabled or ('ExcludeASimDnsFortinetFortiGate' in (DisabledParsers) )),\n ASimDnsGcp (imDnsBuiltInDisabled or ('ExcludeASimDnsGcp' in (DisabledParsers) )),\n ASimDnsInfobloxNIOS (imDnsBuiltInDisabled or ('ExcludeASimDnsInfobloxNIOS' in (DisabledParsers) )),\n ASimDnsMicrosoftNXlog (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftNXlog' in (DisabledParsers) )),\n ASimDnsMicrosoftOMS (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftOMS' in (DisabledParsers) )),\n ASimDnsMicrosoftSysmon (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftSysmon' in (DisabledParsers) )),\n ASimDnsMicrosoftSysmonWindowsEvent (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftSysmonWindowsEvent' in (DisabledParsers) )),\n ASimDnsNative (imDnsBuiltInDisabled or ('ExcludeASimDnsNative' in (DisabledParsers) )),\n ASimDnsSentinelOne (imDnsBuiltInDisabled or ('ExcludeASimDnsSentinelOne' in (DisabledParsers) )),\n ASimDnsVectraAI (imDnsBuiltInDisabled or ('ExcludeASimDnsVectraAI' in (DisabledParsers) )),\n ASimDnsZscalerZIA (imDnsBuiltInDisabled or ('ExcludeASimDnsZscalerZIA' in (DisabledParsers) )),\n ASimDnsInfobloxBloxOne (imDnsBuiltInDisabled or ('ExcludeASimDnsInfobloxBloxOne' in (DisabledParsers) )),\n ASimDnsHalcyon (imDnsBuiltInDisabled or ('ExcludeASimDnsHalcyon' in (DisabledParsers) )),\n ASimDnsGigamonVSeries (imDnsBuiltInDisabled or ('ExcludeASimDnsGigamonVSeries' in (DisabledParsers) ))", + "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimDns') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet imDnsBuiltInDisabled=toscalar('ExcludeASimDnsBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimDnsEmpty,\n ASimDnsAzureFirewall (imDnsBuiltInDisabled or ('ExcludeASimDnsAzureFirewall' in (DisabledParsers) )),\n ASimDnsCiscoUmbrella (imDnsBuiltInDisabled or ('ExcludeASimDnsCiscoUmbrella' in (DisabledParsers) )),\n ASimDnsCrowdStrikeFalconDataReplicator (disabled=(imDnsBuiltInDisabled or ('ExcludeASimDnsCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack),\n ASimDnsCorelightZeek (imDnsBuiltInDisabled or ('ExcludeASimDnsCorelightZeek' in (DisabledParsers) )),\n ASimDnsFortinetFortiGate (imDnsBuiltInDisabled or ('ExcludeASimDnsFortinetFortiGate' in (DisabledParsers) )),\n ASimDnsGcp (imDnsBuiltInDisabled or ('ExcludeASimDnsGcp' in (DisabledParsers) )),\n ASimDnsInfobloxNIOS (imDnsBuiltInDisabled or ('ExcludeASimDnsInfobloxNIOS' in (DisabledParsers) )),\n ASimDnsMicrosoftNXlog (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftNXlog' in (DisabledParsers) )),\n ASimDnsMicrosoftOMS (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftOMS' in (DisabledParsers) )),\n ASimDnsMicrosoftSysmon (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftSysmon' in (DisabledParsers) )),\n ASimDnsMicrosoftSysmonWindowsEvent (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftSysmonWindowsEvent' in (DisabledParsers) )),\n ASimDnsNative (imDnsBuiltInDisabled or ('ExcludeASimDnsNative' in (DisabledParsers) )),\n ASimDnsSentinelOne (imDnsBuiltInDisabled or ('ExcludeASimDnsSentinelOne' in (DisabledParsers) )),\n ASimDnsVectraAI (imDnsBuiltInDisabled or ('ExcludeASimDnsVectraAI' in (DisabledParsers) )),\n ASimDnsZscalerZIA (imDnsBuiltInDisabled or ('ExcludeASimDnsZscalerZIA' in (DisabledParsers) )),\n ASimDnsInfobloxBloxOne (imDnsBuiltInDisabled or ('ExcludeASimDnsInfobloxBloxOne' in (DisabledParsers) )),\n ASimDnsHalcyon (imDnsBuiltInDisabled or ('ExcludeASimDnsHalcyon' in (DisabledParsers) )),\n ASimDnsGigamonVSeries (imDnsBuiltInDisabled or ('ExcludeASimDnsGigamonVSeries' in (DisabledParsers) ))", "version": 1, "functionParameters": "pack:bool=False" } diff --git a/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/ASimDnsCrowdStrikeFalconDataReplicator.json b/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/ASimDnsCrowdStrikeFalconDataReplicator.json new file mode 100644 index 00000000000..fd4c26f7c8a --- /dev/null +++ b/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/ASimDnsCrowdStrikeFalconDataReplicator.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/ASimDnsCrowdStrikeFalconDataReplicator')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "DNS ASIM parser for CrowdStrike Falcon Data Replicator", + "category": "ASIM", + "FunctionAlias": "ASimDnsCrowdStrikeFalconDataReplicator", + "query": "let parser = (disabled: bool = false, pack: bool = false) {\n let queryTypes = datatable(DnsQueryType: int, DnsQueryTypeName: string) [\n 1, \"A\", 2, \"NS\", 5, \"CNAME\", 6, \"SOA\", 10, \"NULL\", 12, \"PTR\",\n 13, \"HINFO\", 15, \"MX\", 16, \"TXT\", 17, \"RP\", 18, \"AFSDB\", 24, \"SIG\",\n 25, \"KEY\", 28, \"AAAA\", 29, \"LOC\", 33, \"SRV\", 35, \"NAPTR\", 36, \"KX\",\n 37, \"CERT\", 39, \"DNAME\", 41, \"OPT\", 43, \"DS\", 44, \"SSHFP\",\n 45, \"IPSECKEY\", 46, \"RRSIG\", 47, \"NSEC\", 48, \"DNSKEY\",\n 49, \"DHCID\", 50, \"NSEC3\", 51, \"NSEC3PARAM\", 52, \"TLSA\", 53, \"SMIMEA\",\n 55, \"HIP\", 59, \"CDS\", 60, \"CDNSKEY\", 61, \"OPENPGPKEY\", 62, \"CSYNC\",\n 63, \"ZONEMD\", 64, \"SVCB\", 65, \"HTTPS\", 99, \"SPF\", 108, \"EUI48\",\n 109, \"EUI64\", 249, \"TKEY\", 250, \"TSIG\", 251, \"IXFR\", 252, \"AXFR\",\n 253, \"MAILB\", 254, \"MAILA\", 255, \"ANY\", 256, \"URI\", 257, \"CAA\",\n 258, \"AVC\", 259, \"DOA\", 260, \"AMTRELAY\"\n ];\n CrowdStrike_DNS_Events_CL\n | where not(disabled)\n | where event_simpleName in (\"DnsRequest\", \"SuspiciousDnsRequest\")\n | extend\n EventStartTime = coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated),\n DnsQuery = trim_end(@\"\\.+\", DomainName),\n DnsQueryType = toint(RequestType),\n _QueryStatus = tolong(QueryStatus)\n | lookup kind=leftouter queryTypes on DnsQueryType\n | extend\n DnsQueryTypeName = case(\n isnotempty(DnsQueryTypeName), DnsQueryTypeName,\n DnsQueryType between (0 .. 65535), strcat(\"TYPE\", DnsQueryType),\n \"\"),\n EventEndTime = EventStartTime,\n EventCount = toint(1),\n EventType = \"Query\",\n EventSubType = iff(isnotempty(QueryStatus) or isnotempty(IP4Records)\n or isnotempty(IP6Records) or isnotempty(CNAMERecords)\n or isnotempty(FirstIP4Record) or isnotempty(FirstIP6Record), \"response\", \"request\"),\n EventResult = case(_QueryStatus == 0, \"Success\",\n isnotnull(_QueryStatus), \"Failure\", \"NA\"),\n // Nonzero vendor statuses are not assumed to be DNS wire RCODEs.\n EventResultDetails = iff(_QueryStatus == 0, \"NOERROR\", \"NA\"),\n DnsResponseCode = iff(_QueryStatus == 0, toint(0), int(null)),\n DnsResponseName = trim(@\";+\", strcat_delim(\";\", IP4Records, IP6Records, CNAMERecords,\n FirstIP4Record, FirstIP6Record)),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon Data Replicator\",\n EventSchema = \"Dns\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = iff(event_simpleName == \"SuspiciousDnsRequest\", \"Low\", \"Informational\"),\n EventUid = CrowdStrikeId,\n DvcOs = case(event_platform == \"Win\", \"Windows\", event_platform == \"Lin\", \"Linux\",\n event_platform == \"Mac\", \"macOS\", event_platform),\n DvcIdType = iff(isnotempty(aid), \"Other\", \"\"),\n SrcDvcIdType = iff(isnotempty(aid), \"Other\", \"\"),\n Dvc = coalesce(aid, aip),\n Src = aid,\n Dst = RespondingDnsServer,\n SrcUsernameType = case(isempty(UserName), \"\", UserName contains \"\\\\\", \"Windows\",\n UserName contains \"@\", \"UPN\", \"Simple\"),\n DvcEntityKey = \"\",\n SrcSystemEntityKey = \"\",\n DstSystemEntityKey = \"\",\n SrcProcessEntityKey = \"\",\n SrcUserEntityKey = \"\",\n SrcUserAdditionalIds = dynamic([]),\n AdditionalEntities = dynamic([]),\n // Preserve unverified fields rather than inventing normalized semantics.\n AdditionalFields = iff(pack, bag_pack(\n \"ContextTimeStamp\", ContextTimeStamp,\n \"ConfigBuild\", ConfigBuild,\n \"ConfigStateHash\", ConfigStateHash,\n \"ContextProcessId\", ContextProcessId,\n \"ContextThreadId\", ContextThreadId,\n \"BoundingLimitCount\", BoundingLimitCount,\n \"BoundingLimitDuration\", BoundingLimitDuration,\n \"Entitlements\", Entitlements,\n \"EffectiveTransmissionClass\", EffectiveTransmissionClass,\n \"OciContainerId\", OciContainerId,\n \"TreeId\", TreeId,\n \"RequestType\", RequestType,\n \"IP4Records\", IP4Records,\n \"IP6Records\", IP6Records,\n \"CNAMERecords\", CNAMERecords,\n \"FirstIP4Record\", FirstIP4Record,\n \"FirstIP6Record\", FirstIP6Record,\n \"DnsRequestCount\", DnsRequestCount,\n \"DualRequest\", DualRequest,\n \"DnsResponseType\", DnsResponseType,\n \"EventOrigin\", EventOrigin,\n \"QueryStatus\", QueryStatus,\n \"OriginalAdditionalFields\", AdditionalFields), dynamic({}))\n | project-rename\n EventOriginalType = event_simpleName,\n EventOriginalSubType = name,\n EventOriginalUid = CrowdStrikeId,\n EventOriginalResultDetails = QueryStatus,\n DvcIpAddr = aip,\n DvcId = aid,\n DvcScopeId = cid,\n SrcUsername = UserName,\n DvcInterface = InterfaceIndex,\n DstIpAddr = RespondingDnsServer\n | extend\n Domain = DnsQuery,\n DnsResponseCodeName = EventResultDetails,\n User = SrcUsername,\n SrcDvcId = DvcId,\n SrcDvcScopeId = DvcScopeId,\n DvcInterface = tostring(DvcInterface)\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventType, EventSubType, EventResult, EventResultDetails, EventOriginalType,\n EventOriginalSubType, EventOriginalUid, EventUid, EventOriginalResultDetails,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n Dvc, DvcIpAddr, DvcId, DvcIdType, DvcScopeId, DvcOs, DvcInterface,\n Src, SrcDvcId, SrcDvcIdType, SrcDvcScopeId, SrcUsername, SrcUsernameType, User,\n Dst, DstIpAddr, DnsQuery, Domain, DnsQueryType, DnsQueryTypeName,\n DnsResponseName, DnsResponseCode, DnsResponseCodeName,\n DvcEntityKey, SrcSystemEntityKey, DstSystemEntityKey, SrcProcessEntityKey,\n SrcUserEntityKey, SrcUserAdditionalIds, AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n", + "version": 1, + "functionParameters": "disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md b/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md new file mode 100644 index 00000000000..dc96c981405 --- /dev/null +++ b/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md @@ -0,0 +1,17 @@ +# CrowdStrike Falcon Data Replicator ASIM Dns Normalization Parser + +ARM template for ASIM Dns schema parser for CrowdStrike Falcon Data Replicator. +The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. + +For more information, see: + +- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) +- [Deploy all of ASIM](https://aka.ms/DeployASIM) +- [ASIM Dns normalization schema reference](https://aka.ms/ASimDnsDoc) + +For the changelog, see: +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md) + +
+ +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimDns%2FARM%2FASimDnsCrowdStrikeFalconDataReplicator%2FASimDnsCrowdStrikeFalconDataReplicator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimDns%2FARM%2FASimDnsCrowdStrikeFalconDataReplicator%2FASimDnsCrowdStrikeFalconDataReplicator.json) diff --git a/Parsers/ASimDns/ARM/FullDeploymentDns.json b/Parsers/ASimDns/ARM/FullDeploymentDns.json index 994103dcb98..64a30ef3795 100644 --- a/Parsers/ASimDns/ARM/FullDeploymentDns.json +++ b/Parsers/ASimDns/ARM/FullDeploymentDns.json @@ -98,6 +98,26 @@ } } }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "linkedASimDnsCrowdStrikeFalconDataReplicator", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/ASimDnsCrowdStrikeFalconDataReplicator.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "Workspace": { + "value": "[parameters('Workspace')]" + }, + "WorkspaceRegion": { + "value": "[parameters('WorkspaceRegion')]" + } + } + } + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", @@ -458,6 +478,26 @@ } } }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "linkedvimDnsCrowdStrikeFalconDataReplicator", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/vimDnsCrowdStrikeFalconDataReplicator.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "Workspace": { + "value": "[parameters('Workspace')]" + }, + "WorkspaceRegion": { + "value": "[parameters('WorkspaceRegion')]" + } + } + } + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", diff --git a/Parsers/ASimDns/ARM/imDns/imDns.json b/Parsers/ASimDns/ARM/imDns/imDns.json index 4de9aa5a96e..4e4cb671a5a 100644 --- a/Parsers/ASimDns/ARM/imDns/imDns.json +++ b/Parsers/ASimDns/ARM/imDns/imDns.json @@ -27,7 +27,7 @@ "displayName": "DNS activity ASIM filtering parser.", "category": "ASIM", "FunctionAlias": "imDns", - "query": "let Generic=(starttime:datetime=datetime(null), endtime:datetime=datetime(null) , srcipaddr:string='*' , domain_has_any:dynamic=dynamic([]) , responsecodename:string='*', response_has_ipv4:string='*' , response_has_any_prefix:dynamic=dynamic([]) , eventtype:string='Query', pack:bool=false ){\nlet DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimDns') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet imDnsBuiltInDisabled=toscalar('ExcludeimDnsBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimDnsEmpty,\n vimDnsAzureFirewall ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsAzureFirewall' in (DisabledParsers) ))),\n vimDnsCiscoUmbrella ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsCiscoUmbrella' in (DisabledParsers) ))),\n vimDnsCorelightZeek ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsCorelightZeek' in (DisabledParsers) ))),\n vimDnsFortinetFortiGate ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsFortinetFortiGate' in (DisabledParsers) ))),\n vimDnsGcp ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsGcp' in (DisabledParsers) ))),\n vimDnsInfobloxNIOS ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsInfobloxNIOS' in (DisabledParsers) ))),\n vimDnsMicrosoftNXlog ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftNXlog' in (DisabledParsers) ))),\n vimDnsMicrosoftOMS ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftOMS' in (DisabledParsers) ))),\n vimDnsMicrosoftSysmon ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftSysmon' in (DisabledParsers) ))),\n vimDnsMicrosoftSysmonWindowsEvent ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftSysmonWindowsEvent' in (DisabledParsers) ))),\n vimDnsNative ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsNative' in (DisabledParsers) ))),\n vimDnsSentinelOne ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsSentinelOne' in (DisabledParsers) ))),\n vimDnsVectraAI ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsVectraAI' in (DisabledParsers) ))),\n vimDnsZscalerZIA ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsZscalerZIA' in (DisabledParsers) ))),\n vimDnsInfobloxBloxOne ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsInfobloxBloxOne' in (DisabledParsers) ))),\n vimDnsHalcyon ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsHalcyon' in (DisabledParsers) ))),\n vimDnsGigamonVSeries ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, pack, (imDnsBuiltInDisabled or('ExcludevimDnsGigamonVSeries' in (DisabledParsers) )))\n };\nGeneric( starttime=starttime, endtime=endtime, srcipaddr=srcipaddr, domain_has_any=domain_has_any, responsecodename=responsecodename, response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix, eventtype=eventtype, pack=pack)\n", + "query": "let Generic=(starttime:datetime=datetime(null), endtime:datetime=datetime(null) , srcipaddr:string='*' , domain_has_any:dynamic=dynamic([]) , responsecodename:string='*', response_has_ipv4:string='*' , response_has_any_prefix:dynamic=dynamic([]) , eventtype:string='Query', pack:bool=false ){\nlet DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimDns') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet imDnsBuiltInDisabled=toscalar('ExcludeimDnsBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimDnsEmpty,\n vimDnsAzureFirewall ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsAzureFirewall' in (DisabledParsers) ))),\n vimDnsCiscoUmbrella ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsCiscoUmbrella' in (DisabledParsers) ))),\n vimDnsCrowdStrikeFalconDataReplicator (starttime=starttime, endtime=endtime, srcipaddr=srcipaddr, domain_has_any=domain_has_any, responsecodename=responsecodename, response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix, eventtype=eventtype, disabled=(imDnsBuiltInDisabled or ('ExcludevimDnsCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack),\n vimDnsCorelightZeek ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsCorelightZeek' in (DisabledParsers) ))),\n vimDnsFortinetFortiGate ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsFortinetFortiGate' in (DisabledParsers) ))),\n vimDnsGcp ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsGcp' in (DisabledParsers) ))),\n vimDnsInfobloxNIOS ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsInfobloxNIOS' in (DisabledParsers) ))),\n vimDnsMicrosoftNXlog ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftNXlog' in (DisabledParsers) ))),\n vimDnsMicrosoftOMS ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftOMS' in (DisabledParsers) ))),\n vimDnsMicrosoftSysmon ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftSysmon' in (DisabledParsers) ))),\n vimDnsMicrosoftSysmonWindowsEvent ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsMicrosoftSysmonWindowsEvent' in (DisabledParsers) ))),\n vimDnsNative ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsNative' in (DisabledParsers) ))),\n vimDnsSentinelOne ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsSentinelOne' in (DisabledParsers) ))),\n vimDnsVectraAI ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsVectraAI' in (DisabledParsers) ))),\n vimDnsZscalerZIA ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsZscalerZIA' in (DisabledParsers) ))),\n vimDnsInfobloxBloxOne ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsInfobloxBloxOne' in (DisabledParsers) ))),\n vimDnsHalcyon ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsHalcyon' in (DisabledParsers) ))),\n vimDnsGigamonVSeries ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, pack, (imDnsBuiltInDisabled or('ExcludevimDnsGigamonVSeries' in (DisabledParsers) )))\n };\nGeneric( starttime=starttime, endtime=endtime, srcipaddr=srcipaddr, domain_has_any=domain_has_any, responsecodename=responsecodename, response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix, eventtype=eventtype, pack=pack)\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr:string='*',domain_has_any:dynamic=dynamic([]),responsecodename:string='*',response_has_ipv4:string='*',response_has_any_prefix:dynamic=dynamic([]),eventtype:string='Query',pack:bool=False" } diff --git a/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/README.md b/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/README.md new file mode 100644 index 00000000000..86aaae328cf --- /dev/null +++ b/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/README.md @@ -0,0 +1,18 @@ +# CrowdStrike Falcon Data Replicator ASIM Dns Normalization Parser + +ARM template for ASIM Dns schema parser for CrowdStrike Falcon Data Replicator. + +The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. + +For more information, see: + +- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) +- [Deploy all of ASIM](https://aka.ms/DeployASIM) +- [ASIM Dns normalization schema reference](https://aka.ms/ASimDnsDoc) + +For the changelog, see: +- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md) + +
+ +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimDns%2FARM%2FvimDnsCrowdStrikeFalconDataReplicator%2FvimDnsCrowdStrikeFalconDataReplicator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimDns%2FARM%2FvimDnsCrowdStrikeFalconDataReplicator%2FvimDnsCrowdStrikeFalconDataReplicator.json) diff --git a/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/vimDnsCrowdStrikeFalconDataReplicator.json b/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/vimDnsCrowdStrikeFalconDataReplicator.json new file mode 100644 index 00000000000..59f221efb8b --- /dev/null +++ b/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/vimDnsCrowdStrikeFalconDataReplicator.json @@ -0,0 +1,36 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "Workspace": { + "type": "string", + "metadata": { + "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." + } + }, + "WorkspaceRegion": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "The region of the selected workspace. The default value will use the Region selection above." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('Workspace'), '/vimDnsCrowdStrikeFalconDataReplicator')]", + "location": "[parameters('WorkspaceRegion')]", + "properties": { + "etag": "*", + "displayName": "DNS ASIM filtering parser for CrowdStrike Falcon Data Replicator", + "category": "ASIM", + "FunctionAlias": "vimDnsCrowdStrikeFalconDataReplicator", + "query": "let parser = (\n starttime: datetime = datetime(null),\n endtime: datetime = datetime(null),\n srcipaddr: string = \"\",\n domain_has_any: dynamic = dynamic([]),\n responsecodename: string = \"\",\n response_has_ipv4: string = \"\",\n response_has_any_prefix: dynamic = dynamic([]),\n eventtype: string = \"Query\",\n disabled: bool = false,\n pack: bool = false\n) {\n let responsePrefixes = iff(isnull(response_has_any_prefix), dynamic([]), response_has_any_prefix);\n let queryTypes = datatable(DnsQueryType: int, DnsQueryTypeName: string) [\n 1, \"A\", 2, \"NS\", 5, \"CNAME\", 6, \"SOA\", 10, \"NULL\", 12, \"PTR\",\n 13, \"HINFO\", 15, \"MX\", 16, \"TXT\", 17, \"RP\", 18, \"AFSDB\", 24, \"SIG\",\n 25, \"KEY\", 28, \"AAAA\", 29, \"LOC\", 33, \"SRV\", 35, \"NAPTR\", 36, \"KX\",\n 37, \"CERT\", 39, \"DNAME\", 41, \"OPT\", 43, \"DS\", 44, \"SSHFP\",\n 45, \"IPSECKEY\", 46, \"RRSIG\", 47, \"NSEC\", 48, \"DNSKEY\",\n 49, \"DHCID\", 50, \"NSEC3\", 51, \"NSEC3PARAM\", 52, \"TLSA\", 53, \"SMIMEA\",\n 55, \"HIP\", 59, \"CDS\", 60, \"CDNSKEY\", 61, \"OPENPGPKEY\", 62, \"CSYNC\",\n 63, \"ZONEMD\", 64, \"SVCB\", 65, \"HTTPS\", 99, \"SPF\", 108, \"EUI48\",\n 109, \"EUI64\", 249, \"TKEY\", 250, \"TSIG\", 251, \"IXFR\", 252, \"AXFR\",\n 253, \"MAILB\", 254, \"MAILA\", 255, \"ANY\", 256, \"URI\", 257, \"CAA\",\n 258, \"AVC\", 259, \"DOA\", 260, \"AMTRELAY\"\n ];\n CrowdStrike_DNS_Events_CL\n | where not(disabled)\n | where event_simpleName in (\"DnsRequest\", \"SuspiciousDnsRequest\")\n | where isnull(starttime) or TimeGenerated >= starttime\n | where isnull(endtime) or TimeGenerated <= endtime\n | where isempty(eventtype) or eventtype =~ \"Query\"\n // aip is the reporting agent's address, not a proven DNS client address.\n | where isempty(srcipaddr) or srcipaddr == \"*\"\n | where array_length(domain_has_any) == 0 or isempty(tostring(domain_has_any))\n or DomainName has_any (domain_has_any)\n | extend\n EventStartTime = coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated),\n DnsQuery = trim_end(@\"\\.+\", DomainName),\n DnsQueryType = toint(RequestType),\n _QueryStatus = tolong(QueryStatus),\n DnsResponseName = trim(@\";+\", strcat_delim(\";\", IP4Records, IP6Records, CNAMERecords,\n FirstIP4Record, FirstIP6Record))\n | where isempty(response_has_ipv4) or response_has_ipv4 == \"*\"\n or has_ipv4(DnsResponseName, response_has_ipv4)\n or has_ipv4_prefix(DnsResponseName, response_has_ipv4)\n | where array_length(responsePrefixes) == 0\n or has_any_ipv4(DnsResponseName, responsePrefixes)\n or has_any_ipv4_prefix(DnsResponseName, responsePrefixes)\n | lookup kind=leftouter queryTypes on DnsQueryType\n | extend\n DnsQueryTypeName = case(\n isnotempty(DnsQueryTypeName), DnsQueryTypeName,\n DnsQueryType between (0 .. 65535), strcat(\"TYPE\", DnsQueryType),\n \"\"),\n EventEndTime = EventStartTime,\n EventCount = toint(1),\n EventType = \"Query\",\n EventSubType = iff(isnotempty(QueryStatus) or isnotempty(IP4Records)\n or isnotempty(IP6Records) or isnotempty(CNAMERecords)\n or isnotempty(FirstIP4Record) or isnotempty(FirstIP6Record), \"response\", \"request\"),\n EventResult = case(_QueryStatus == 0, \"Success\",\n isnotnull(_QueryStatus), \"Failure\", \"NA\"),\n // Nonzero vendor statuses are not assumed to be DNS wire RCODEs.\n EventResultDetails = iff(_QueryStatus == 0, \"NOERROR\", \"NA\"),\n DnsResponseCode = iff(_QueryStatus == 0, toint(0), int(null)),\n EventVendor = \"CrowdStrike\",\n EventProduct = \"Falcon Data Replicator\",\n EventSchema = \"Dns\",\n EventSchemaVersion = \"1.0.0\",\n EventSeverity = iff(event_simpleName == \"SuspiciousDnsRequest\", \"Low\", \"Informational\"),\n EventUid = CrowdStrikeId,\n DvcOs = case(event_platform == \"Win\", \"Windows\", event_platform == \"Lin\", \"Linux\",\n event_platform == \"Mac\", \"macOS\", event_platform),\n DvcIdType = iff(isnotempty(aid), \"Other\", \"\"),\n SrcDvcIdType = iff(isnotempty(aid), \"Other\", \"\"),\n Dvc = coalesce(aid, aip),\n Src = aid,\n Dst = RespondingDnsServer,\n SrcUsernameType = case(isempty(UserName), \"\", UserName contains \"\\\\\", \"Windows\",\n UserName contains \"@\", \"UPN\", \"Simple\"),\n DvcEntityKey = \"\",\n SrcSystemEntityKey = \"\",\n DstSystemEntityKey = \"\",\n SrcProcessEntityKey = \"\",\n SrcUserEntityKey = \"\",\n SrcUserAdditionalIds = dynamic([]),\n AdditionalEntities = dynamic([]),\n // Preserve unverified fields rather than inventing normalized semantics.\n AdditionalFields = iff(pack, bag_pack(\n \"ContextTimeStamp\", ContextTimeStamp,\n \"ConfigBuild\", ConfigBuild,\n \"ConfigStateHash\", ConfigStateHash,\n \"ContextProcessId\", ContextProcessId,\n \"ContextThreadId\", ContextThreadId,\n \"BoundingLimitCount\", BoundingLimitCount,\n \"BoundingLimitDuration\", BoundingLimitDuration,\n \"Entitlements\", Entitlements,\n \"EffectiveTransmissionClass\", EffectiveTransmissionClass,\n \"OciContainerId\", OciContainerId,\n \"TreeId\", TreeId,\n \"RequestType\", RequestType,\n \"IP4Records\", IP4Records,\n \"IP6Records\", IP6Records,\n \"CNAMERecords\", CNAMERecords,\n \"FirstIP4Record\", FirstIP4Record,\n \"FirstIP6Record\", FirstIP6Record,\n \"DnsRequestCount\", DnsRequestCount,\n \"DualRequest\", DualRequest,\n \"DnsResponseType\", DnsResponseType,\n \"EventOrigin\", EventOrigin,\n \"QueryStatus\", QueryStatus,\n \"OriginalAdditionalFields\", AdditionalFields), dynamic({}))\n | where isempty(responsecodename) or responsecodename == \"*\" or EventResultDetails =~ responsecodename\n | project-rename\n EventOriginalType = event_simpleName,\n EventOriginalSubType = name,\n EventOriginalUid = CrowdStrikeId,\n EventOriginalResultDetails = QueryStatus,\n DvcIpAddr = aip,\n DvcId = aid,\n DvcScopeId = cid,\n SrcUsername = UserName,\n DvcInterface = InterfaceIndex,\n DstIpAddr = RespondingDnsServer\n | extend\n Domain = DnsQuery,\n DnsResponseCodeName = EventResultDetails,\n User = SrcUsername,\n SrcDvcId = DvcId,\n SrcDvcScopeId = DvcScopeId,\n DvcInterface = tostring(DvcInterface)\n | project\n TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n EventType, EventSubType, EventResult, EventResultDetails, EventOriginalType,\n EventOriginalSubType, EventOriginalUid, EventUid, EventOriginalResultDetails,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n Dvc, DvcIpAddr, DvcId, DvcIdType, DvcScopeId, DvcOs, DvcInterface,\n Src, SrcDvcId, SrcDvcIdType, SrcDvcScopeId, SrcUsername, SrcUsernameType, User,\n Dst, DstIpAddr, DnsQuery, Domain, DnsQueryType, DnsQueryTypeName,\n DnsResponseName, DnsResponseCode, DnsResponseCodeName,\n DvcEntityKey, SrcSystemEntityKey, DstSystemEntityKey, SrcProcessEntityKey,\n SrcUserEntityKey, SrcUserAdditionalIds, AdditionalEntities, AdditionalFields\n};\nparser(starttime=starttime, endtime=endtime, srcipaddr=srcipaddr,\n domain_has_any=domain_has_any, responsecodename=responsecodename,\n response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix,\n eventtype=eventtype, disabled=disabled, pack=pack)\n", + "version": 1, + "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr:string='*',domain_has_any:dynamic=dynamic([]),responsecodename:string='*',response_has_ipv4:string='*',response_has_any_prefix:dynamic=dynamic([]),eventtype:string='Query',disabled:bool=False,pack:bool=False" + } + } + ] +} \ No newline at end of file diff --git a/Parsers/ASimDns/CHANGELOG/ASimDns.md b/Parsers/ASimDns/CHANGELOG/ASimDns.md index ed2d4f83e76..6e3a9f91241 100644 --- a/Parsers/ASimDns/CHANGELOG/ASimDns.md +++ b/Parsers/ASimDns/CHANGELOG/ASimDns.md @@ -1,4 +1,9 @@ # Changelog for ASimDns.yaml + +## Version 0.5.6 + +- (2026-10-23) Added the CrowdStrike Falcon Data Replicator DNS parser with disable-watchlist and `pack` parameter support. + ## Version 0.5.5 - (2026-10-08) Corrected the Azure Firewall and GCP parser disable watchlist keys - [PR #15291](https://github.com/Azure/Azure-Sentinel/pull/15291) diff --git a/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md b/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md new file mode 100644 index 00000000000..526cb545fa1 --- /dev/null +++ b/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md @@ -0,0 +1,7 @@ +# Changelog for ASimDnsCrowdStrikeFalconDataReplicator.yaml + +## Version 0.1.0 + +- (2026-10-23) Initial DNS parser for CrowdStrike Falcon Data Replicator events in `CrowdStrike_DNS_Events_CL`. +- Uses populated `event_simpleName` values to select DNS events and includes mappings for currently empty columns. +- Preserves unverified vendor metadata with `pack=true`, without event enrichment or row expansion. \ No newline at end of file diff --git a/Parsers/ASimDns/CHANGELOG/imDns.md b/Parsers/ASimDns/CHANGELOG/imDns.md index 911db15cf21..245d67c8003 100644 --- a/Parsers/ASimDns/CHANGELOG/imDns.md +++ b/Parsers/ASimDns/CHANGELOG/imDns.md @@ -1,4 +1,9 @@ # Changelog for imDns.yaml + +## Version 0.5.7 + +- (2026-10-23) Added the CrowdStrike Falcon Data Replicator DNS filtering parser, forwarding all DNS filters, the disable-watchlist setting, and `pack`. + ## Version 0.5.6 - (2026-10-08) Corrected the GCP and Microsoft Sysmon Windows Event parser disable watchlist keys - [PR #15291](https://github.com/Azure/Azure-Sentinel/pull/15291) diff --git a/Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md b/Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md new file mode 100644 index 00000000000..a87ff9d003a --- /dev/null +++ b/Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md @@ -0,0 +1,7 @@ +# Changelog for vimDnsCrowdStrikeFalconDataReplicator.yaml + +## Version 0.1.0 + +- (2026-10-23) Initial filtering DNS parser for CrowdStrike Falcon Data Replicator. +- Supports inclusive `TimeGenerated` boundaries, domain matching, IPv4 answer and prefix filters, response codes, event types, disabling, and optional vendor metadata packing. +- Retains the same record-local mappings and normalization boundaries as the parameterless parser. diff --git a/Parsers/ASimDns/Parsers/ASimDns.yaml b/Parsers/ASimDns/Parsers/ASimDns.yaml index ef9ddc8de3a..e77181e11d7 100644 --- a/Parsers/ASimDns/Parsers/ASimDns.yaml +++ b/Parsers/ASimDns/Parsers/ASimDns.yaml @@ -1,7 +1,7 @@ Parser: Title: DNS activity ASIM parser - Version: '0.5.5' - LastUpdated: Oct 08, 2026 + Version: '0.5.6' + LastUpdated: Oct 23, 2026 Product: Name: Source agnostic Normalization: @@ -20,6 +20,7 @@ Parsers: - _Im_Dns_Empty - _ASim_Dns_AzureFirewall - _ASim_Dns_CiscoUmbrella + - _ASim_Dns_CrowdStrikeFalconDataReplicator - _ASim_Dns_CorelightZeek - _ASim_Dns_FortinetFortiGate - _ASim_Dns_Gcp @@ -46,6 +47,7 @@ ParserQuery: | vimDnsEmpty, ASimDnsAzureFirewall (imDnsBuiltInDisabled or ('ExcludeASimDnsAzureFirewall' in (DisabledParsers) )), ASimDnsCiscoUmbrella (imDnsBuiltInDisabled or ('ExcludeASimDnsCiscoUmbrella' in (DisabledParsers) )), + ASimDnsCrowdStrikeFalconDataReplicator (disabled=(imDnsBuiltInDisabled or ('ExcludeASimDnsCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack), ASimDnsCorelightZeek (imDnsBuiltInDisabled or ('ExcludeASimDnsCorelightZeek' in (DisabledParsers) )), ASimDnsFortinetFortiGate (imDnsBuiltInDisabled or ('ExcludeASimDnsFortinetFortiGate' in (DisabledParsers) )), ASimDnsGcp (imDnsBuiltInDisabled or ('ExcludeASimDnsGcp' in (DisabledParsers) )), diff --git a/Parsers/ASimDns/Parsers/ASimDnsCrowdStrikeFalconDataReplicator.yaml b/Parsers/ASimDns/Parsers/ASimDnsCrowdStrikeFalconDataReplicator.yaml new file mode 100644 index 00000000000..958469a5700 --- /dev/null +++ b/Parsers/ASimDns/Parsers/ASimDnsCrowdStrikeFalconDataReplicator.yaml @@ -0,0 +1,149 @@ +Parser: + Title: DNS ASIM parser for CrowdStrike Falcon Data Replicator + Version: '0.1.0' + LastUpdated: Oct 23, 2026 +Product: + Name: CrowdStrike Falcon Data Replicator +Normalization: + Schema: Dns + Version: '1.0.0' +References: +- Title: ASIM Dns Schema + Link: https://aka.ms/ASimDnsDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: CrowdStrike Falcon Data Replicator connector + Link: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/CrowdStrikeS3FDR_ccp/DataConnectorDefinition.json +Description: | + Normalizes DnsRequest and SuspiciousDnsRequest records from CrowdStrike_DNS_Events_CL + to the ASIM DNS schema. + This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. +ParserName: ASimDnsCrowdStrikeFalconDataReplicator +EquivalentBuiltInParser: _ASim_Dns_CrowdStrikeFalconDataReplicator +ParserParams: + - Name: disabled + Type: bool + Default: false + - Name: pack + Type: bool + Default: false +ParserQuery: | + let parser = (disabled: bool = false, pack: bool = false) { + let queryTypes = datatable(DnsQueryType: int, DnsQueryTypeName: string) [ + 1, "A", 2, "NS", 5, "CNAME", 6, "SOA", 10, "NULL", 12, "PTR", + 13, "HINFO", 15, "MX", 16, "TXT", 17, "RP", 18, "AFSDB", 24, "SIG", + 25, "KEY", 28, "AAAA", 29, "LOC", 33, "SRV", 35, "NAPTR", 36, "KX", + 37, "CERT", 39, "DNAME", 41, "OPT", 43, "DS", 44, "SSHFP", + 45, "IPSECKEY", 46, "RRSIG", 47, "NSEC", 48, "DNSKEY", + 49, "DHCID", 50, "NSEC3", 51, "NSEC3PARAM", 52, "TLSA", 53, "SMIMEA", + 55, "HIP", 59, "CDS", 60, "CDNSKEY", 61, "OPENPGPKEY", 62, "CSYNC", + 63, "ZONEMD", 64, "SVCB", 65, "HTTPS", 99, "SPF", 108, "EUI48", + 109, "EUI64", 249, "TKEY", 250, "TSIG", 251, "IXFR", 252, "AXFR", + 253, "MAILB", 254, "MAILA", 255, "ANY", 256, "URI", 257, "CAA", + 258, "AVC", 259, "DOA", 260, "AMTRELAY" + ]; + CrowdStrike_DNS_Events_CL + | where not(disabled) + | where event_simpleName in ("DnsRequest", "SuspiciousDnsRequest") + | extend + EventStartTime = coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated), + DnsQuery = trim_end(@"\.+", DomainName), + DnsQueryType = toint(RequestType), + _QueryStatus = tolong(QueryStatus) + | lookup kind=leftouter queryTypes on DnsQueryType + | extend + DnsQueryTypeName = case( + isnotempty(DnsQueryTypeName), DnsQueryTypeName, + DnsQueryType between (0 .. 65535), strcat("TYPE", DnsQueryType), + ""), + EventEndTime = EventStartTime, + EventCount = toint(1), + EventType = "Query", + EventSubType = iff(isnotempty(QueryStatus) or isnotempty(IP4Records) + or isnotempty(IP6Records) or isnotempty(CNAMERecords) + or isnotempty(FirstIP4Record) or isnotempty(FirstIP6Record), "response", "request"), + EventResult = case(_QueryStatus == 0, "Success", + isnotnull(_QueryStatus), "Failure", "NA"), + // Nonzero vendor statuses are not assumed to be DNS wire RCODEs. + EventResultDetails = iff(_QueryStatus == 0, "NOERROR", "NA"), + DnsResponseCode = iff(_QueryStatus == 0, toint(0), int(null)), + DnsResponseName = trim(@";+", strcat_delim(";", IP4Records, IP6Records, CNAMERecords, + FirstIP4Record, FirstIP6Record)), + EventVendor = "CrowdStrike", + EventProduct = "Falcon Data Replicator", + EventSchema = "Dns", + EventSchemaVersion = "1.0.0", + EventSeverity = iff(event_simpleName == "SuspiciousDnsRequest", "Low", "Informational"), + EventUid = CrowdStrikeId, + DvcOs = case(event_platform == "Win", "Windows", event_platform == "Lin", "Linux", + event_platform == "Mac", "macOS", event_platform), + DvcIdType = iff(isnotempty(aid), "Other", ""), + SrcDvcIdType = iff(isnotempty(aid), "Other", ""), + Dvc = coalesce(aid, aip), + Src = aid, + Dst = RespondingDnsServer, + SrcUsernameType = case(isempty(UserName), "", UserName contains "\\", "Windows", + UserName contains "@", "UPN", "Simple"), + DvcEntityKey = "", + SrcSystemEntityKey = "", + DstSystemEntityKey = "", + SrcProcessEntityKey = "", + SrcUserEntityKey = "", + SrcUserAdditionalIds = dynamic([]), + AdditionalEntities = dynamic([]), + // Preserve unverified fields rather than inventing normalized semantics. + AdditionalFields = iff(pack, bag_pack( + "ContextTimeStamp", ContextTimeStamp, + "ConfigBuild", ConfigBuild, + "ConfigStateHash", ConfigStateHash, + "ContextProcessId", ContextProcessId, + "ContextThreadId", ContextThreadId, + "BoundingLimitCount", BoundingLimitCount, + "BoundingLimitDuration", BoundingLimitDuration, + "Entitlements", Entitlements, + "EffectiveTransmissionClass", EffectiveTransmissionClass, + "OciContainerId", OciContainerId, + "TreeId", TreeId, + "RequestType", RequestType, + "IP4Records", IP4Records, + "IP6Records", IP6Records, + "CNAMERecords", CNAMERecords, + "FirstIP4Record", FirstIP4Record, + "FirstIP6Record", FirstIP6Record, + "DnsRequestCount", DnsRequestCount, + "DualRequest", DualRequest, + "DnsResponseType", DnsResponseType, + "EventOrigin", EventOrigin, + "QueryStatus", QueryStatus, + "OriginalAdditionalFields", AdditionalFields), dynamic({})) + | project-rename + EventOriginalType = event_simpleName, + EventOriginalSubType = name, + EventOriginalUid = CrowdStrikeId, + EventOriginalResultDetails = QueryStatus, + DvcIpAddr = aip, + DvcId = aid, + DvcScopeId = cid, + SrcUsername = UserName, + DvcInterface = InterfaceIndex, + DstIpAddr = RespondingDnsServer + | extend + Domain = DnsQuery, + DnsResponseCodeName = EventResultDetails, + User = SrcUsername, + SrcDvcId = DvcId, + SrcDvcScopeId = DvcScopeId, + DvcInterface = tostring(DvcInterface) + | project + TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, + EventType, EventSubType, EventResult, EventResultDetails, EventOriginalType, + EventOriginalSubType, EventOriginalUid, EventUid, EventOriginalResultDetails, + EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity, + Dvc, DvcIpAddr, DvcId, DvcIdType, DvcScopeId, DvcOs, DvcInterface, + Src, SrcDvcId, SrcDvcIdType, SrcDvcScopeId, SrcUsername, SrcUsernameType, User, + Dst, DstIpAddr, DnsQuery, Domain, DnsQueryType, DnsQueryTypeName, + DnsResponseName, DnsResponseCode, DnsResponseCodeName, + DvcEntityKey, SrcSystemEntityKey, DstSystemEntityKey, SrcProcessEntityKey, + SrcUserEntityKey, SrcUserAdditionalIds, AdditionalEntities, AdditionalFields + }; + parser(disabled=disabled, pack=pack) diff --git a/Parsers/ASimDns/Parsers/imDns.yaml b/Parsers/ASimDns/Parsers/imDns.yaml index 20cdb081818..9d4921fa60a 100644 --- a/Parsers/ASimDns/Parsers/imDns.yaml +++ b/Parsers/ASimDns/Parsers/imDns.yaml @@ -1,7 +1,7 @@ Parser: Title: DNS activity ASIM filtering parser. - Version: '0.5.6' - LastUpdated: Oct 08, 2026 + Version: '0.5.7' + LastUpdated: Oct 23, 2026 Product: Name: Source agnostic Normalization: @@ -51,6 +51,7 @@ ParserQuery: | vimDnsEmpty, vimDnsAzureFirewall ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsAzureFirewall' in (DisabledParsers) ))), vimDnsCiscoUmbrella ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsCiscoUmbrella' in (DisabledParsers) ))), + vimDnsCrowdStrikeFalconDataReplicator (starttime=starttime, endtime=endtime, srcipaddr=srcipaddr, domain_has_any=domain_has_any, responsecodename=responsecodename, response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix, eventtype=eventtype, disabled=(imDnsBuiltInDisabled or ('ExcludevimDnsCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack), vimDnsCorelightZeek ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsCorelightZeek' in (DisabledParsers) ))), vimDnsFortinetFortiGate ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsFortinetFortiGate' in (DisabledParsers) ))), vimDnsGcp ( starttime, endtime, srcipaddr, domain_has_any, responsecodename, response_has_ipv4, response_has_any_prefix, eventtype, (imDnsBuiltInDisabled or('ExcludevimDnsGcp' in (DisabledParsers) ))), @@ -73,6 +74,7 @@ Parsers: - _Im_Dns_Empty - _Im_Dns_AzureFirewall - _Im_Dns_CiscoUmbrella + - _Im_Dns_CrowdStrikeFalconDataReplicator - _Im_Dns_CorelightZeek - _Im_Dns_FortinetFortiGate - _Im_Dns_Gcp diff --git a/Parsers/ASimDns/Parsers/vimDnsCrowdStrikeFalconDataReplicator.yaml b/Parsers/ASimDns/Parsers/vimDnsCrowdStrikeFalconDataReplicator.yaml new file mode 100644 index 00000000000..cbabc1bd9b3 --- /dev/null +++ b/Parsers/ASimDns/Parsers/vimDnsCrowdStrikeFalconDataReplicator.yaml @@ -0,0 +1,202 @@ +Parser: + Title: DNS ASIM filtering parser for CrowdStrike Falcon Data Replicator + Version: '0.1.0' + LastUpdated: Oct 23, 2026 +Product: + Name: CrowdStrike Falcon Data Replicator +Normalization: + Schema: Dns + Version: '1.0.0' +References: +- Title: ASIM Dns Schema + Link: https://aka.ms/ASimDnsDoc +- Title: ASIM + Link: https://aka.ms/AboutASIM +- Title: CrowdStrike Falcon Data Replicator connector + Link: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/CrowdStrikeS3FDR_ccp/DataConnectorDefinition.json +Description: | + Filters and normalizes DnsRequest and SuspiciousDnsRequest records from + CrowdStrike_DNS_Events_CL to the ASIM DNS schema. + This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. +ParserName: vimDnsCrowdStrikeFalconDataReplicator +EquivalentBuiltInParser: _Im_Dns_CrowdStrikeFalconDataReplicator +ParserParams: + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: srcipaddr + Type: string + Default: '*' + - Name: domain_has_any + Type: dynamic + Default: dynamic([]) + - Name: responsecodename + Type: string + Default: '*' + - Name: response_has_ipv4 + Type: string + Default: '*' + - Name: response_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: eventtype + Type: string + Default: 'Query' + - Name: disabled + Type: bool + Default: false + - Name: pack + Type: bool + Default: false +ParserQuery: | + let parser = ( + starttime: datetime = datetime(null), + endtime: datetime = datetime(null), + srcipaddr: string = "", + domain_has_any: dynamic = dynamic([]), + responsecodename: string = "", + response_has_ipv4: string = "", + response_has_any_prefix: dynamic = dynamic([]), + eventtype: string = "Query", + disabled: bool = false, + pack: bool = false + ) { + let responsePrefixes = iff(isnull(response_has_any_prefix), dynamic([]), response_has_any_prefix); + let queryTypes = datatable(DnsQueryType: int, DnsQueryTypeName: string) [ + 1, "A", 2, "NS", 5, "CNAME", 6, "SOA", 10, "NULL", 12, "PTR", + 13, "HINFO", 15, "MX", 16, "TXT", 17, "RP", 18, "AFSDB", 24, "SIG", + 25, "KEY", 28, "AAAA", 29, "LOC", 33, "SRV", 35, "NAPTR", 36, "KX", + 37, "CERT", 39, "DNAME", 41, "OPT", 43, "DS", 44, "SSHFP", + 45, "IPSECKEY", 46, "RRSIG", 47, "NSEC", 48, "DNSKEY", + 49, "DHCID", 50, "NSEC3", 51, "NSEC3PARAM", 52, "TLSA", 53, "SMIMEA", + 55, "HIP", 59, "CDS", 60, "CDNSKEY", 61, "OPENPGPKEY", 62, "CSYNC", + 63, "ZONEMD", 64, "SVCB", 65, "HTTPS", 99, "SPF", 108, "EUI48", + 109, "EUI64", 249, "TKEY", 250, "TSIG", 251, "IXFR", 252, "AXFR", + 253, "MAILB", 254, "MAILA", 255, "ANY", 256, "URI", 257, "CAA", + 258, "AVC", 259, "DOA", 260, "AMTRELAY" + ]; + CrowdStrike_DNS_Events_CL + | where not(disabled) + | where event_simpleName in ("DnsRequest", "SuspiciousDnsRequest") + | where isnull(starttime) or TimeGenerated >= starttime + | where isnull(endtime) or TimeGenerated <= endtime + | where isempty(eventtype) or eventtype =~ "Query" + // aip is the reporting agent's address, not a proven DNS client address. + | where isempty(srcipaddr) or srcipaddr == "*" + | where array_length(domain_has_any) == 0 or isempty(tostring(domain_has_any)) + or DomainName has_any (domain_has_any) + | extend + EventStartTime = coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated), + DnsQuery = trim_end(@"\.+", DomainName), + DnsQueryType = toint(RequestType), + _QueryStatus = tolong(QueryStatus), + DnsResponseName = trim(@";+", strcat_delim(";", IP4Records, IP6Records, CNAMERecords, + FirstIP4Record, FirstIP6Record)) + | where isempty(response_has_ipv4) or response_has_ipv4 == "*" + or has_ipv4(DnsResponseName, response_has_ipv4) + or has_ipv4_prefix(DnsResponseName, response_has_ipv4) + | where array_length(responsePrefixes) == 0 + or has_any_ipv4(DnsResponseName, responsePrefixes) + or has_any_ipv4_prefix(DnsResponseName, responsePrefixes) + | lookup kind=leftouter queryTypes on DnsQueryType + | extend + DnsQueryTypeName = case( + isnotempty(DnsQueryTypeName), DnsQueryTypeName, + DnsQueryType between (0 .. 65535), strcat("TYPE", DnsQueryType), + ""), + EventEndTime = EventStartTime, + EventCount = toint(1), + EventType = "Query", + EventSubType = iff(isnotempty(QueryStatus) or isnotempty(IP4Records) + or isnotempty(IP6Records) or isnotempty(CNAMERecords) + or isnotempty(FirstIP4Record) or isnotempty(FirstIP6Record), "response", "request"), + EventResult = case(_QueryStatus == 0, "Success", + isnotnull(_QueryStatus), "Failure", "NA"), + // Nonzero vendor statuses are not assumed to be DNS wire RCODEs. + EventResultDetails = iff(_QueryStatus == 0, "NOERROR", "NA"), + DnsResponseCode = iff(_QueryStatus == 0, toint(0), int(null)), + EventVendor = "CrowdStrike", + EventProduct = "Falcon Data Replicator", + EventSchema = "Dns", + EventSchemaVersion = "1.0.0", + EventSeverity = iff(event_simpleName == "SuspiciousDnsRequest", "Low", "Informational"), + EventUid = CrowdStrikeId, + DvcOs = case(event_platform == "Win", "Windows", event_platform == "Lin", "Linux", + event_platform == "Mac", "macOS", event_platform), + DvcIdType = iff(isnotempty(aid), "Other", ""), + SrcDvcIdType = iff(isnotempty(aid), "Other", ""), + Dvc = coalesce(aid, aip), + Src = aid, + Dst = RespondingDnsServer, + SrcUsernameType = case(isempty(UserName), "", UserName contains "\\", "Windows", + UserName contains "@", "UPN", "Simple"), + DvcEntityKey = "", + SrcSystemEntityKey = "", + DstSystemEntityKey = "", + SrcProcessEntityKey = "", + SrcUserEntityKey = "", + SrcUserAdditionalIds = dynamic([]), + AdditionalEntities = dynamic([]), + // Preserve unverified fields rather than inventing normalized semantics. + AdditionalFields = iff(pack, bag_pack( + "ContextTimeStamp", ContextTimeStamp, + "ConfigBuild", ConfigBuild, + "ConfigStateHash", ConfigStateHash, + "ContextProcessId", ContextProcessId, + "ContextThreadId", ContextThreadId, + "BoundingLimitCount", BoundingLimitCount, + "BoundingLimitDuration", BoundingLimitDuration, + "Entitlements", Entitlements, + "EffectiveTransmissionClass", EffectiveTransmissionClass, + "OciContainerId", OciContainerId, + "TreeId", TreeId, + "RequestType", RequestType, + "IP4Records", IP4Records, + "IP6Records", IP6Records, + "CNAMERecords", CNAMERecords, + "FirstIP4Record", FirstIP4Record, + "FirstIP6Record", FirstIP6Record, + "DnsRequestCount", DnsRequestCount, + "DualRequest", DualRequest, + "DnsResponseType", DnsResponseType, + "EventOrigin", EventOrigin, + "QueryStatus", QueryStatus, + "OriginalAdditionalFields", AdditionalFields), dynamic({})) + | where isempty(responsecodename) or responsecodename == "*" or EventResultDetails =~ responsecodename + | project-rename + EventOriginalType = event_simpleName, + EventOriginalSubType = name, + EventOriginalUid = CrowdStrikeId, + EventOriginalResultDetails = QueryStatus, + DvcIpAddr = aip, + DvcId = aid, + DvcScopeId = cid, + SrcUsername = UserName, + DvcInterface = InterfaceIndex, + DstIpAddr = RespondingDnsServer + | extend + Domain = DnsQuery, + DnsResponseCodeName = EventResultDetails, + User = SrcUsername, + SrcDvcId = DvcId, + SrcDvcScopeId = DvcScopeId, + DvcInterface = tostring(DvcInterface) + | project + TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, + EventType, EventSubType, EventResult, EventResultDetails, EventOriginalType, + EventOriginalSubType, EventOriginalUid, EventUid, EventOriginalResultDetails, + EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity, + Dvc, DvcIpAddr, DvcId, DvcIdType, DvcScopeId, DvcOs, DvcInterface, + Src, SrcDvcId, SrcDvcIdType, SrcDvcScopeId, SrcUsername, SrcUsernameType, User, + Dst, DstIpAddr, DnsQuery, Domain, DnsQueryType, DnsQueryTypeName, + DnsResponseName, DnsResponseCode, DnsResponseCodeName, + DvcEntityKey, SrcSystemEntityKey, DstSystemEntityKey, SrcProcessEntityKey, + SrcUserEntityKey, SrcUserAdditionalIds, AdditionalEntities, AdditionalFields + }; + parser(starttime=starttime, endtime=endtime, srcipaddr=srcipaddr, + domain_has_any=domain_has_any, responsecodename=responsecodename, + response_has_ipv4=response_has_ipv4, response_has_any_prefix=response_has_any_prefix, + eventtype=eventtype, disabled=disabled, pack=pack) diff --git a/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_Dns_IngestedLogs.csv b/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_Dns_IngestedLogs.csv new file mode 100644 index 00000000000..79eae619d17 --- /dev/null +++ b/Sample Data/ASIM/CrowdStrike_Falcon Data Replicator_Dns_IngestedLogs.csv @@ -0,0 +1,11 @@ +"TimeGenerated","event_simpleName","timestamp","aip","aid","UserName","event_platform","ContextTimeStamp","name","ConfigBuild","CrowdStrikeId","ConfigStateHash","ContextProcessId","ContextThreadId","BoundingLimitCount","BoundingLimitDuration","Entitlements","EffectiveTransmissionClass","cid","OciContainerId","TreeId","DomainName","RequestType","IP4Records","QueryStatus","FirstIP4Record","DnsRequestCount","IP6Records","InterfaceIndex","DualRequest","DnsResponseType","EventOrigin","RespondingDnsServer","CNAMERecords","FirstIP6Record","AdditionalFields","Type" +"2026-10-20T00:00:00Z","DnsRequest","1792454400000","192.0.2.10","00000000000000000000000000000001","EXAMPLE\alice","Win","1792454400","DnsRequestV5","config-1","00000000-0000-4000-8000-000000000001","hash-1","123456789012345","10","20","60","15","2","00000000000000000000000000000010","container-1","tree-1","www.example.com.","1","203.0.113.10;203.0.113.11","0","203.0.113.10","1","","1","0","1","sensor","192.0.2.53","edge.example.com","","{""fixture"":""ipv4-success""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T01:00:00Z","SuspiciousDnsRequest","1792458000000","192.0.2.11","00000000000000000000000000000002","bob@example.net","Lin","1792458000","SuspiciousDnsRequestLinV3","config-2","00000000-0000-4000-8000-000000000002","hash-2","123456789012346","11","20","60","15","2","00000000000000000000000000000010","container-2","tree-2","bad.example.net","28","","9003","","1","2001:db8::11","2","1","2","sensor","192.0.2.53","","2001:db8::11","{""fixture"":""unverified-status""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T02:00:00Z","DnsRequest","1792461600000","192.0.2.12","00000000000000000000000000000003","carol","Mac","1792461600","DnsRequestMacV6","config-3","00000000-0000-4000-8000-000000000003","hash-3","123456789012347","12","20","60","15","2","00000000000000000000000000000010","container-3","tree-3","alias.example.org.","5","","","","1","","3","0","1","sensor","192.0.2.53","target.example.org","","{""fixture"":""cname""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T03:00:00Z","DnsRequest","1792465200000","192.0.2.13","00000000000000000000000000000004","EXAMPLE\dana","Win","1792465200","DnsRequestV5","config-4","00000000-0000-4000-8000-000000000004","hash-4","123456789012348","13","20","60","15","2","00000000000000000000000000000010","container-4","tree-4","mail.example.com","15","","0","","1","","4","0","1","sensor","192.0.2.53","mx.example.com","","{""fixture"":""mx""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T04:00:00Z","SuspiciousDnsRequest","1792468800000","192.0.2.14","00000000000000000000000000000005","erin@example.net","Lin","1792468800","SuspiciousDnsRequestLinV3","config-5","00000000-0000-4000-8000-000000000005","hash-5","123456789012349","14","20","60","15","2","00000000000000000000000000000010","container-5","tree-5","txt.example.net","16","","9002","","1","","5","0","2","sensor","192.0.2.53","","","{""fixture"":""nonzero-status""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T05:00:00Z","DnsRequest","1792472400000","192.0.2.15","00000000000000000000000000000006","frank","Mac","1792472400","DnsRequestMacV6","config-6","00000000-0000-4000-8000-000000000006","hash-6","123456789012350","15","20","60","15","2","00000000000000000000000000000010","container-6","tree-6","_service._tcp.example.org","33","","0","","1","","6","0","1","sensor","192.0.2.53","service.example.org","","{""fixture"":""srv""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T06:00:00Z","DnsRequest","1792476000000","192.0.2.16","00000000000000000000000000000007","EXAMPLE\grace","Win","1792476000","DnsRequestV5","config-7","00000000-0000-4000-8000-000000000007","hash-7","123456789012351","16","20","60","15","2","00000000000000000000000000000010","container-7","tree-7","https.example.com","65","","","","1","","7","0","1","sensor","192.0.2.53","","","{""fixture"":""request-only""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T07:00:00Z","DnsRequest","1792479600000","192.0.2.17","00000000000000000000000000000008","heidi@example.net","Lin","1792479600","DnsRequestLinV8","config-8","00000000-0000-4000-8000-000000000008","hash-8","123456789012352","17","20","60","15","2","00000000000000000000000000000010","container-8","tree-8","private.example.net","65280","","0","198.51.100.17","7","","8","0","1","sensor","192.0.2.53","","","{""fixture"":""unknown-rr-type""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T08:00:00Z","DnsRequest","1792483200000","192.0.2.18","00000000000000000000000000000009","ivan","Mac","1792483200","DnsRequestMacV6","config-9","00000000-0000-4000-8000-000000000009","hash-9","123456789012353","18","20","60","15","2","00000000000000000000000000000010","container-9","tree-9","18.2.0.192.in-addr.arpa.","12","","0","","1","","9","0","1","sensor","192.0.2.53","host.example.org","","{""fixture"":""ptr""}","CrowdStrike_DNS_Events_CL" +"2026-10-20T09:00:00Z","DnsRequest","","192.0.2.19","0000000000000000000000000000000a","judy@example.org","Win","1792486800","DnsRequestV5","config-10","00000000-0000-4000-8000-00000000000a","hash-10","123456789012354","19","20","60","15","2","00000000000000000000000000000010","container-10","tree-10","any.example.org","255","203.0.113.19","0","203.0.113.19","1","2001:db8::19","10","1","1","sensor","192.0.2.53","dual.example.org","2001:db8::19","{""fixture"":""dual-stack-and-time-fallback""}","CrowdStrike_DNS_Events_CL" From c2dba5ea7f13d6f5219b7e5d2931f7c68964293f Mon Sep 17 00:00:00 2001 From: Derrick Lee Date: Fri, 23 Oct 2026 15:56:42 -0700 Subject: [PATCH 2/3] Update changelog --- Parsers/ASimDns/CHANGELOG/ASimDns.md | 2 +- .../ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md | 2 +- Parsers/ASimDns/CHANGELOG/imDns.md | 2 +- .../ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Parsers/ASimDns/CHANGELOG/ASimDns.md b/Parsers/ASimDns/CHANGELOG/ASimDns.md index 6e3a9f91241..49a54bd9b03 100644 --- a/Parsers/ASimDns/CHANGELOG/ASimDns.md +++ b/Parsers/ASimDns/CHANGELOG/ASimDns.md @@ -2,7 +2,7 @@ ## Version 0.5.6 -- (2026-10-23) Added the CrowdStrike Falcon Data Replicator DNS parser with disable-watchlist and `pack` parameter support. +- (2026-10-23) Added the CrowdStrike Falcon Data Replicator DNS parser with disable-watchlist and `pack` parameter support - [PR #15417](https://github.com/Azure/Azure-Sentinel/pull/15417) ## Version 0.5.5 diff --git a/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md b/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md index 526cb545fa1..1f113a950ba 100644 --- a/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md +++ b/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md @@ -2,6 +2,6 @@ ## Version 0.1.0 -- (2026-10-23) Initial DNS parser for CrowdStrike Falcon Data Replicator events in `CrowdStrike_DNS_Events_CL`. +- (2026-10-23) Initial DNS parser for CrowdStrike Falcon Data Replicator events in `CrowdStrike_DNS_Events_CL` - [PR #15417](https://github.com/Azure/Azure-Sentinel/pull/15417) - Uses populated `event_simpleName` values to select DNS events and includes mappings for currently empty columns. - Preserves unverified vendor metadata with `pack=true`, without event enrichment or row expansion. \ No newline at end of file diff --git a/Parsers/ASimDns/CHANGELOG/imDns.md b/Parsers/ASimDns/CHANGELOG/imDns.md index 245d67c8003..07de22be337 100644 --- a/Parsers/ASimDns/CHANGELOG/imDns.md +++ b/Parsers/ASimDns/CHANGELOG/imDns.md @@ -2,7 +2,7 @@ ## Version 0.5.7 -- (2026-10-23) Added the CrowdStrike Falcon Data Replicator DNS filtering parser, forwarding all DNS filters, the disable-watchlist setting, and `pack`. +- (2026-10-23) Added the CrowdStrike Falcon Data Replicator DNS filtering parser, forwarding all DNS filters, the disable-watchlist setting, and `pack` - [PR #15417](https://github.com/Azure/Azure-Sentinel/pull/15417) ## Version 0.5.6 diff --git a/Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md b/Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md index a87ff9d003a..df591e39e11 100644 --- a/Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md +++ b/Parsers/ASimDns/CHANGELOG/vimDnsCrowdStrikeFalconDataReplicator.md @@ -2,6 +2,6 @@ ## Version 0.1.0 -- (2026-10-23) Initial filtering DNS parser for CrowdStrike Falcon Data Replicator. +- (2026-10-23) Initial filtering DNS parser for CrowdStrike Falcon Data Replicator - [PR #15417](https://github.com/Azure/Azure-Sentinel/pull/15417) - Supports inclusive `TimeGenerated` boundaries, domain matching, IPv4 answer and prefix filters, response codes, event types, disabling, and optional vendor metadata packing. - Retains the same record-local mappings and normalization boundaries as the parameterless parser. From 005bf84a2b37cceb7ff5a1f799cf4ef46cab91cd Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <> Date: Fri, 23 Oct 2026 23:00:48 +0000 Subject: [PATCH 3/3] [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. --- .../ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md | 6 ++++++ .../ARM/vimDnsCrowdStrikeFalconDataReplicator/README.md | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md b/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md index dc96c981405..01242fb4b8a 100644 --- a/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md +++ b/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md @@ -1,6 +1,12 @@ # CrowdStrike Falcon Data Replicator ASIM Dns Normalization Parser ARM template for ASIM Dns schema parser for CrowdStrike Falcon Data Replicator. + +Normalizes DnsRequest and SuspiciousDnsRequest records from CrowdStrike_DNS_Events_CL +to the ASIM DNS schema. +This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. + + The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. For more information, see: diff --git a/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/README.md b/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/README.md index 86aaae328cf..62669414214 100644 --- a/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/README.md +++ b/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/README.md @@ -2,6 +2,11 @@ ARM template for ASIM Dns schema parser for CrowdStrike Falcon Data Replicator. +Filters and normalizes DnsRequest and SuspiciousDnsRequest records from +CrowdStrike_DNS_Events_CL to the ASIM DNS schema. +This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub. + + The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. For more information, see: