[ASIM] Create DNS CrowdStrike Falcon parser

.script/tests/KqlvalidationsTests/CustomTables/CrowdStrike_DNS_Events_CL.json

@@ -144,6 +144,10 @@
     {
       "name": "AdditionalFields",
       "type": "dynamic"
+    },
+    {
+      "name": "Type",
+      "type": "string"
     }
 ]
 }

Parsers/ASimDns/ARM/ASimDns/ASimDns.json

@@ -27,7 +27,7 @@
         "displayName": "DNS activity ASIM parser",
         "category": "ASIM",
         "FunctionAlias": "ASimDns",
-        "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimDns') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet imDnsBuiltInDisabled=toscalar('ExcludeASimDnsBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n  vimDnsEmpty,\n  ASimDnsAzureFirewall               (imDnsBuiltInDisabled or ('ExcludeASimDnsAzureFirewall'               in (DisabledParsers) )),\n  ASimDnsCiscoUmbrella               (imDnsBuiltInDisabled or ('ExcludeASimDnsCiscoUmbrella'               in (DisabledParsers) )),\n  ASimDnsCorelightZeek               (imDnsBuiltInDisabled or ('ExcludeASimDnsCorelightZeek'               in (DisabledParsers) )),\n  ASimDnsFortinetFortiGate           (imDnsBuiltInDisabled or ('ExcludeASimDnsFortinetFortiGate'           in (DisabledParsers) )),\n  ASimDnsGcp                         (imDnsBuiltInDisabled or ('ExcludeASimDnsGcp'                          in (DisabledParsers) )),\n  ASimDnsInfobloxNIOS                (imDnsBuiltInDisabled or ('ExcludeASimDnsInfobloxNIOS'                in (DisabledParsers) )),\n  ASimDnsMicrosoftNXlog              (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftNXlog'              in (DisabledParsers) )),\n  ASimDnsMicrosoftOMS                (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftOMS'                in (DisabledParsers) )),\n  ASimDnsMicrosoftSysmon             (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftSysmon'             in (DisabledParsers) )),\n  ASimDnsMicrosoftSysmonWindowsEvent (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftSysmonWindowsEvent' in (DisabledParsers) )),\n  ASimDnsNative                      (imDnsBuiltInDisabled or ('ExcludeASimDnsNative'                      in (DisabledParsers) )),\n  ASimDnsSentinelOne                 (imDnsBuiltInDisabled or ('ExcludeASimDnsSentinelOne'                 in (DisabledParsers) )),\n  ASimDnsVectraAI                    (imDnsBuiltInDisabled or ('ExcludeASimDnsVectraAI'                    in (DisabledParsers) )),\n  ASimDnsZscalerZIA                  (imDnsBuiltInDisabled or ('ExcludeASimDnsZscalerZIA'                  in (DisabledParsers) )),\n  ASimDnsInfobloxBloxOne             (imDnsBuiltInDisabled or ('ExcludeASimDnsInfobloxBloxOne'             in (DisabledParsers) )),\n  ASimDnsHalcyon                     (imDnsBuiltInDisabled or ('ExcludeASimDnsHalcyon'                     in (DisabledParsers) )),\n  ASimDnsGigamonVSeries              (imDnsBuiltInDisabled or ('ExcludeASimDnsGigamonVSeries'             in (DisabledParsers) ))",
+        "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimDns') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet imDnsBuiltInDisabled=toscalar('ExcludeASimDnsBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n  vimDnsEmpty,\n  ASimDnsAzureFirewall               (imDnsBuiltInDisabled or ('ExcludeASimDnsAzureFirewall'               in (DisabledParsers) )),\n  ASimDnsCiscoUmbrella               (imDnsBuiltInDisabled or ('ExcludeASimDnsCiscoUmbrella'               in (DisabledParsers) )),\n  ASimDnsCrowdStrikeFalconDataReplicator (disabled=(imDnsBuiltInDisabled or ('ExcludeASimDnsCrowdStrikeFalconDataReplicator' in (DisabledParsers))), pack=pack),\n  ASimDnsCorelightZeek               (imDnsBuiltInDisabled or ('ExcludeASimDnsCorelightZeek'               in (DisabledParsers) )),\n  ASimDnsFortinetFortiGate           (imDnsBuiltInDisabled or ('ExcludeASimDnsFortinetFortiGate'           in (DisabledParsers) )),\n  ASimDnsGcp                         (imDnsBuiltInDisabled or ('ExcludeASimDnsGcp'                          in (DisabledParsers) )),\n  ASimDnsInfobloxNIOS                (imDnsBuiltInDisabled or ('ExcludeASimDnsInfobloxNIOS'                in (DisabledParsers) )),\n  ASimDnsMicrosoftNXlog              (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftNXlog'              in (DisabledParsers) )),\n  ASimDnsMicrosoftOMS                (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftOMS'                in (DisabledParsers) )),\n  ASimDnsMicrosoftSysmon             (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftSysmon'             in (DisabledParsers) )),\n  ASimDnsMicrosoftSysmonWindowsEvent (imDnsBuiltInDisabled or ('ExcludeASimDnsMicrosoftSysmonWindowsEvent' in (DisabledParsers) )),\n  ASimDnsNative                      (imDnsBuiltInDisabled or ('ExcludeASimDnsNative'                      in (DisabledParsers) )),\n  ASimDnsSentinelOne                 (imDnsBuiltInDisabled or ('ExcludeASimDnsSentinelOne'                 in (DisabledParsers) )),\n  ASimDnsVectraAI                    (imDnsBuiltInDisabled or ('ExcludeASimDnsVectraAI'                    in (DisabledParsers) )),\n  ASimDnsZscalerZIA                  (imDnsBuiltInDisabled or ('ExcludeASimDnsZscalerZIA'                  in (DisabledParsers) )),\n  ASimDnsInfobloxBloxOne             (imDnsBuiltInDisabled or ('ExcludeASimDnsInfobloxBloxOne'             in (DisabledParsers) )),\n  ASimDnsHalcyon                     (imDnsBuiltInDisabled or ('ExcludeASimDnsHalcyon'                     in (DisabledParsers) )),\n  ASimDnsGigamonVSeries              (imDnsBuiltInDisabled or ('ExcludeASimDnsGigamonVSeries'             in (DisabledParsers) ))",
         "version": 1,
         "functionParameters": "pack:bool=False"
       }

Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/ASimDnsCrowdStrikeFalconDataReplicator.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "Workspace": {
+      "type": "string",
+      "metadata": {
+        "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group."
+      }
+    },
+    "WorkspaceRegion": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "The region of the selected workspace. The default value will use the Region selection above."
+      }
+    }
+  },
+  "resources": [
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+      "apiVersion": "2020-08-01",
+      "name": "[concat(parameters('Workspace'), '/ASimDnsCrowdStrikeFalconDataReplicator')]",
+      "location": "[parameters('WorkspaceRegion')]",
+      "properties": {
+        "etag": "*",
+        "displayName": "DNS ASIM parser for CrowdStrike Falcon Data Replicator",
+        "category": "ASIM",
+        "FunctionAlias": "ASimDnsCrowdStrikeFalconDataReplicator",
+        "query": "let parser = (disabled: bool = false, pack: bool = false) {\n    let queryTypes = datatable(DnsQueryType: int, DnsQueryTypeName: string) [\n        1, \"A\", 2, \"NS\", 5, \"CNAME\", 6, \"SOA\", 10, \"NULL\", 12, \"PTR\",\n        13, \"HINFO\", 15, \"MX\", 16, \"TXT\", 17, \"RP\", 18, \"AFSDB\", 24, \"SIG\",\n        25, \"KEY\", 28, \"AAAA\", 29, \"LOC\", 33, \"SRV\", 35, \"NAPTR\", 36, \"KX\",\n        37, \"CERT\", 39, \"DNAME\", 41, \"OPT\", 43, \"DS\", 44, \"SSHFP\",\n        45, \"IPSECKEY\", 46, \"RRSIG\", 47, \"NSEC\", 48, \"DNSKEY\",\n        49, \"DHCID\", 50, \"NSEC3\", 51, \"NSEC3PARAM\", 52, \"TLSA\", 53, \"SMIMEA\",\n        55, \"HIP\", 59, \"CDS\", 60, \"CDNSKEY\", 61, \"OPENPGPKEY\", 62, \"CSYNC\",\n        63, \"ZONEMD\", 64, \"SVCB\", 65, \"HTTPS\", 99, \"SPF\", 108, \"EUI48\",\n        109, \"EUI64\", 249, \"TKEY\", 250, \"TSIG\", 251, \"IXFR\", 252, \"AXFR\",\n        253, \"MAILB\", 254, \"MAILA\", 255, \"ANY\", 256, \"URI\", 257, \"CAA\",\n        258, \"AVC\", 259, \"DOA\", 260, \"AMTRELAY\"\n    ];\n    CrowdStrike_DNS_Events_CL\n    | where not(disabled)\n    | where event_simpleName in (\"DnsRequest\", \"SuspiciousDnsRequest\")\n    | extend\n        EventStartTime = coalesce(unixtime_milliseconds_todatetime(timestamp), TimeGenerated),\n        DnsQuery = trim_end(@\"\\.+\", DomainName),\n        DnsQueryType = toint(RequestType),\n        _QueryStatus = tolong(QueryStatus)\n    | lookup kind=leftouter queryTypes on DnsQueryType\n    | extend\n        DnsQueryTypeName = case(\n            isnotempty(DnsQueryTypeName), DnsQueryTypeName,\n            DnsQueryType between (0 .. 65535), strcat(\"TYPE\", DnsQueryType),\n            \"\"),\n        EventEndTime = EventStartTime,\n        EventCount = toint(1),\n        EventType = \"Query\",\n        EventSubType = iff(isnotempty(QueryStatus) or isnotempty(IP4Records)\n            or isnotempty(IP6Records) or isnotempty(CNAMERecords)\n            or isnotempty(FirstIP4Record) or isnotempty(FirstIP6Record), \"response\", \"request\"),\n        EventResult = case(_QueryStatus == 0, \"Success\",\n            isnotnull(_QueryStatus), \"Failure\", \"NA\"),\n        // Nonzero vendor statuses are not assumed to be DNS wire RCODEs.\n        EventResultDetails = iff(_QueryStatus == 0, \"NOERROR\", \"NA\"),\n        DnsResponseCode = iff(_QueryStatus == 0, toint(0), int(null)),\n        DnsResponseName = trim(@\";+\", strcat_delim(\";\", IP4Records, IP6Records, CNAMERecords,\n            FirstIP4Record, FirstIP6Record)),\n        EventVendor = \"CrowdStrike\",\n        EventProduct = \"Falcon Data Replicator\",\n        EventSchema = \"Dns\",\n        EventSchemaVersion = \"1.0.0\",\n        EventSeverity = iff(event_simpleName == \"SuspiciousDnsRequest\", \"Low\", \"Informational\"),\n        EventUid = CrowdStrikeId,\n        DvcOs = case(event_platform == \"Win\", \"Windows\", event_platform == \"Lin\", \"Linux\",\n            event_platform == \"Mac\", \"macOS\", event_platform),\n        DvcIdType = iff(isnotempty(aid), \"Other\", \"\"),\n        SrcDvcIdType = iff(isnotempty(aid), \"Other\", \"\"),\n        Dvc = coalesce(aid, aip),\n        Src = aid,\n        Dst = RespondingDnsServer,\n        SrcUsernameType = case(isempty(UserName), \"\", UserName contains \"\\\\\", \"Windows\",\n            UserName contains \"@\", \"UPN\", \"Simple\"),\n        DvcEntityKey = \"\",\n        SrcSystemEntityKey = \"\",\n        DstSystemEntityKey = \"\",\n        SrcProcessEntityKey = \"\",\n        SrcUserEntityKey = \"\",\n        SrcUserAdditionalIds = dynamic([]),\n        AdditionalEntities = dynamic([]),\n        // Preserve unverified fields rather than inventing normalized semantics.\n        AdditionalFields = iff(pack, bag_pack(\n                \"ContextTimeStamp\", ContextTimeStamp,\n                \"ConfigBuild\", ConfigBuild,\n                \"ConfigStateHash\", ConfigStateHash,\n                \"ContextProcessId\", ContextProcessId,\n                \"ContextThreadId\", ContextThreadId,\n                \"BoundingLimitCount\", BoundingLimitCount,\n                \"BoundingLimitDuration\", BoundingLimitDuration,\n                \"Entitlements\", Entitlements,\n                \"EffectiveTransmissionClass\", EffectiveTransmissionClass,\n                \"OciContainerId\", OciContainerId,\n                \"TreeId\", TreeId,\n                \"RequestType\", RequestType,\n                \"IP4Records\", IP4Records,\n                \"IP6Records\", IP6Records,\n                \"CNAMERecords\", CNAMERecords,\n                \"FirstIP4Record\", FirstIP4Record,\n                \"FirstIP6Record\", FirstIP6Record,\n                \"DnsRequestCount\", DnsRequestCount,\n                \"DualRequest\", DualRequest,\n                \"DnsResponseType\", DnsResponseType,\n                \"EventOrigin\", EventOrigin,\n                \"QueryStatus\", QueryStatus,\n                \"OriginalAdditionalFields\", AdditionalFields), dynamic({}))\n    | project-rename\n        EventOriginalType = event_simpleName,\n        EventOriginalSubType = name,\n        EventOriginalUid = CrowdStrikeId,\n        EventOriginalResultDetails = QueryStatus,\n        DvcIpAddr = aip,\n        DvcId = aid,\n        DvcScopeId = cid,\n        SrcUsername = UserName,\n        DvcInterface = InterfaceIndex,\n        DstIpAddr = RespondingDnsServer\n    | extend\n        Domain = DnsQuery,\n        DnsResponseCodeName = EventResultDetails,\n        User = SrcUsername,\n        SrcDvcId = DvcId,\n        SrcDvcScopeId = DvcScopeId,\n        DvcInterface = tostring(DvcInterface)\n    | project\n        TimeGenerated, Type, EventStartTime, EventEndTime, EventCount,\n        EventType, EventSubType, EventResult, EventResultDetails, EventOriginalType,\n        EventOriginalSubType, EventOriginalUid, EventUid, EventOriginalResultDetails,\n        EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,\n        Dvc, DvcIpAddr, DvcId, DvcIdType, DvcScopeId, DvcOs, DvcInterface,\n        Src, SrcDvcId, SrcDvcIdType, SrcDvcScopeId, SrcUsername, SrcUsernameType, User,\n        Dst, DstIpAddr, DnsQuery, Domain, DnsQueryType, DnsQueryTypeName,\n        DnsResponseName, DnsResponseCode, DnsResponseCodeName,\n        DvcEntityKey, SrcSystemEntityKey, DstSystemEntityKey, SrcProcessEntityKey,\n        SrcUserEntityKey, SrcUserAdditionalIds, AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n",
+        "version": 1,
+        "functionParameters": "disabled:bool=False,pack:bool=False"
+      }
+    }
+  ]
+}

Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/README.md

@@ -0,0 +1,23 @@
+# CrowdStrike Falcon Data Replicator ASIM Dns Normalization Parser
+
+ARM template for ASIM Dns schema parser for CrowdStrike Falcon Data Replicator.
+
+Normalizes DnsRequest and SuspiciousDnsRequest records from CrowdStrike_DNS_Events_CL
+to the ASIM DNS schema.
+This parser was created using the agentic ASIM parser creation tool, powered by Skills in GitHub.
+
+
+The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
+
+For more information, see:
+
+- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
+- [Deploy all of ASIM](https://aka.ms/DeployASIM)
+- [ASIM Dns normalization schema reference](https://aka.ms/ASimDnsDoc)
+
+For the changelog, see:
+- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimDns/CHANGELOG/ASimDnsCrowdStrikeFalconDataReplicator.md)
+
+<br>
+
+[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimDns%2FARM%2FASimDnsCrowdStrikeFalconDataReplicator%2FASimDnsCrowdStrikeFalconDataReplicator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimDns%2FARM%2FASimDnsCrowdStrikeFalconDataReplicator%2FASimDnsCrowdStrikeFalconDataReplicator.json)

Parsers/ASimDns/ARM/FullDeploymentDns.json

@@ -98,6 +98,26 @@
         }
       }
     },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "linkedASimDnsCrowdStrikeFalconDataReplicator",
+      "properties": {
+        "mode": "Incremental",
+        "templateLink": {
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimDns/ARM/ASimDnsCrowdStrikeFalconDataReplicator/ASimDnsCrowdStrikeFalconDataReplicator.json",
+          "contentVersion": "1.0.0.0"
+        },
+        "parameters": {
+          "Workspace": {
+            "value": "[parameters('Workspace')]"
+          },
+          "WorkspaceRegion": {
+            "value": "[parameters('WorkspaceRegion')]"
+          }
+        }
+      }
+    },
     {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2020-10-01",
@@ -458,6 +478,26 @@
         }
       }
     },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "linkedvimDnsCrowdStrikeFalconDataReplicator",
+      "properties": {
+        "mode": "Incremental",
+        "templateLink": {
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimDns/ARM/vimDnsCrowdStrikeFalconDataReplicator/vimDnsCrowdStrikeFalconDataReplicator.json",
+          "contentVersion": "1.0.0.0"
+        },
+        "parameters": {
+          "Workspace": {
+            "value": "[parameters('Workspace')]"
+          },
+          "WorkspaceRegion": {
+            "value": "[parameters('WorkspaceRegion')]"
+          }
+        }
+      }
+    },
     {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2020-10-01",