Skip to content

Commit 9af7b5b

Browse files
vakohlvakohl
committed
AlertSchemaParsers
1 parent fc61be3 commit 9af7b5b

33 files changed

+1205
-59
lines changed

‎.github/workflows/convertKqlFunctionYamlToArmTemplate.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ on:
1515
- 'Parsers/ASimRegistryEvent/Parsers/**'
1616
- 'Parsers/ASimUserManagement/Parsers/**'
1717
- 'Parsers/ASimDhcpEvent/Parsers/**'
18+
- 'Parsers/ASimAlertEvent/Parsers/**'
1819

1920
env:
2021
GITHUB_APPS_ID: "${{ secrets.APPLICATION_ID }}"

‎.github/workflows/runAsimSchemaAndDataTesters.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ on:
1717
- 'Parsers/ASimRegistryEvent/Parsers/**'
1818
- 'Parsers/ASimUserManagement/Parsers/**'
1919
- 'Parsers/ASimDhcpEvent/Parsers/**'
20+
- 'Parsers/ASimAlertEvent/Parsers/**'
2021

2122
# Allows you to run this workflow manually from the Actions tab
2223
workflow_dispatch:

‎.script/getModifiedASimSchemas.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
function getModifiedAsimSchemas() {
2-
$schemas = ("ASimDns", "ASimWebSession", "ASimNetworkSession", "ASimProcessEvent", "ASimAuditEvent", "ASimAuthentication", "ASimFileEvent", "ASimRegistryEvent","ASimUserManagement","ASimDhcpEvent")
2+
$schemas = ("ASimDns", "ASimWebSession", "ASimNetworkSession", "ASimProcessEvent", "ASimAuditEvent", "ASimAuthentication", "ASimFileEvent", "ASimRegistryEvent","ASimUserManagement","ASimDhcpEvent","ASimAlertEvent")
33
$modifiedSchemas = @()
44
foreach ($schema in $schemas) {
55
$filesThatWereChanged= Invoke-Expression "git diff origin/master --name-only -- $($PSScriptRoot)/../Parsers/$($schema)/Parsers"

‎.script/tests/asimParsersTest/ASimFilteringTest.py

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -843,6 +843,20 @@ def send_query(self, query_str):
843843
"targetappname_has_any" : "TargetAppName",
844844
"username_has_any" : "User"
845845
},
846+
"AlertEvent" :
847+
{
848+
"disabled" : "",
849+
"endtime" : "EventEndTime",
850+
"starttime" : "EventStartTime",
851+
"ipaddr_has_any_prefix" : "DvcIpAddr",
852+
"hostname_has_any" : "DvcHostname",
853+
"username_has_any" : "Username",
854+
"attacktactics_has_any" : "AttackTactics",
855+
"attacktechniques_has_any" : "AttackTechniques",
856+
"threatcategory_has_any" : "ThreatCategory",
857+
"alertverdict_has_any" : "AlertVerdict",
858+
"eventseverity_has_any" : "EventSeverity",
859+
},
846860
"DhcpEvent" :
847861
{
848862
"disabled" : "",

‎ASIM/dev/Parser YAML templates/ASimAlertTemplate.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
Parser:
2+
Title: Alert event ASIM parser for <product name>
3+
Version: '0.1.0'
4+
LastUpdated: <MMM DD, YYYY>
5+
Product:
6+
Name: <product name>
7+
Normalization:
8+
Schema: AlertEvent
9+
Version: '<current schema version>'
10+
References:
11+
- Title: ASIM Alert Schema
12+
Link: https://aka.ms/ASimAlertEventDoc
13+
- Title: ASIM
14+
Link: https:/aka.ms/AboutASIM
15+
Description: |
16+
This ASIM parser supports normalizing the <product name> logs to the ASIM 'Alert' normalized schema.
17+
ParserName: <ASimAlertEventVendor+Product>
18+
EquivalentBuiltInParser: <_ASim_AlertEvent_Vendor+Product>
19+
ParserParams:
20+
- Name: disabled
21+
Type: bool
22+
Default: false
23+
ParserQuery: |
24+
let parser = (
25+
disabled:bool = false
26+
)
27+
{
28+
<parser query body>
29+
};
30+
parser (disabled = disabled)

‎ASIM/dev/Parser YAML templates/ASimAuditEventTemplate.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Parser:
22
Title: ASIM Audit Event parser for <product name>
3-
Version: '<parser version>'
3+
Version: '0.1.0'
44
LastUpdated: <MMM DD, YYYY>
55
Product:
66
Name: <product name>
@@ -14,8 +14,8 @@ References:
1414
Link: https:/aka.ms/AboutASIM
1515
Description: |
1616
This ASIM parser supports normalizing the <product name> logs to the ASIM Audit Event normalized schema.
17-
ParserName: <parser function name>
18-
EquivalentBuiltInParser: <_ASim_AuditEvent_Product>
17+
ParserName: <ASimAuditEventVendor+Product>
18+
EquivalentBuiltInParser: <_ASim_AuditEvent_Vendor+Product>
1919
ParserParams:
2020
- Name: disabled
2121
Type: bool

‎ASIM/dev/Parser YAML templates/ASimAuthenticationTemplate.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Parser:
22
Title: ASIM Authentication parser for <product name>
3-
Version: '<parser version>'
3+
Version: '0.1.0'
44
LastUpdated: <MMM DD, YYYY>
55
Product:
66
Name: <product name>
@@ -14,8 +14,8 @@ References:
1414
Link: https:/aka.ms/AboutASIM
1515
Description: |
1616
This ASIM parser supports normalizing the <product name> logs to the ASIM Authentication normalized schema.
17-
ParserName: <parser function name>
18-
EquivalentBuiltInParser: <_ASim_Authentication_Product>
17+
ParserName: <ASimAuthenticationVendor+Product>
18+
EquivalentBuiltInParser: <_ASim_Authentication_Vendor+Product>
1919
ParserParams:
2020
- Name: disabled
2121
Type: bool

‎ASIM/dev/Parser YAML templates/ASimDhcpEventTemplate.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ References:
1414
Link: https:/aka.ms/AboutASIM
1515
Description: |
1616
This ASIM parser supports normalizing <product name> logs to the ASIM Dhcp normalized schema.
17-
ParserName: <ASimDhcpEventProduct>
18-
EquivalentBuiltInParser: <_ASim_DhcpEvent_Product>
17+
ParserName: <ASimDhcpEventVendor+Product>
18+
EquivalentBuiltInParser: <_ASim_DhcpEvent_Vendor+Product
1919
ParserParams:
2020
- Name: disabled
2121
Type: bool

‎ASIM/dev/Parser YAML templates/ASimDnsTemplate.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Parser:
22
Title: DNS activity ASIM parser for <product name>
3-
Version: '<parser version>'
3+
Version: '0.1.0'
44
LastUpdated: <MMM DD, YYYY>
55
Product:
66
Name: <product name>
@@ -14,8 +14,8 @@ References:
1414
Link: https://aka.ms/AboutASIM
1515
Description: |
1616
This ASIM parser supports normalizing the <product name> logs to the ASIM DNS activity normalized schema.
17-
ParserName: <parser function name>
18-
EquivalentBuiltInParser: <_ASim_Dns_Product>
17+
ParserName: <ASimDnsVendor+Product>
18+
EquivalentBuiltInParser: <_ASim_Dns_Vendor+Product>
1919
ParserParams:
2020
- Name: disabled
2121
Type: bool

‎ASIM/dev/Parser YAML templates/ASimFileEventTemplate.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Parser:
22
Title: File events ASIM parser for <product name>
3-
Version: '<parser version>'
3+
Version: '0.1.0'
44
LastUpdated: <MMM DD, YYYY>
55
Product:
66
Name: <product name>
@@ -14,8 +14,8 @@ References:
1414
Link: https://aka.ms/AboutASIM
1515
Description: |
1616
This ASIM parser supports normalizing the <product name> logs to the ASIM file activity normalized schema.
17-
ParserName: <parser function name>
18-
EquivalentBuiltInParser: <_ASim_FileEvent_Product>
17+
ParserName: <ASimFileEventVendor+Product>
18+
EquivalentBuiltInParser: <_ASim_FileEvent_Vendor+Product>
1919
ParserParams:
2020
- Name: disabled
2121
Type: bool

‎ASIM/dev/Parser YAML templates/ASimNetworkSessionTemplate.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Parser:
22
Title: Network Session ASIM parser for <product name>
3-
Version: '<parser version>'
3+
Version: '0.1.0'
44
LastUpdated: <MMM DD, YYYY>
55
Product:
66
Name: <product name>
@@ -14,8 +14,8 @@ References:
1414
Link: https:/aka.ms/AboutASIM
1515
Description: |
1616
This ASIM parser supports normalizing <product name> logs to the ASIM Network Session normalized schema.
17-
ParserName: <parser function name>
18-
EquivalentBuiltInParser: <_ASim_NetworkSession_Product>
17+
ParserName: <ASimNetworkSessionVendor+Product>
18+
EquivalentBuiltInParser: <_ASim_NetworkSession_Vendor+Product>
1919
ParserParams:
2020
- Name: disabled
2121
Type: bool

‎ASIM/dev/Parser YAML templates/ASimProcessEventTemplate.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Parser:
22
Title: Process event ASIM parser for <product name>
3-
Version: '<parser version>'
3+
Version: '0.1.0'
44
LastUpdated: <MMM DD, YYYY>
55
Product:
66
Name: <product name>
@@ -14,8 +14,8 @@ references:
1414
Link: https:/aka.ms/AboutASIM
1515
Description:
1616
This ASIM parser supports normalizing the <product name> logs to the ASIM process event normalized schema.
17-
ParserName: <parser function name>
18-
EquivalentBuiltInParser: <_ASim_ProcessEvent_Product>
17+
ParserName: <ASimProcessEventVendor+Product>
18+
EquivalentBuiltInParser: <_ASim_ProcessEvent_Vendor+Product>
1919
ParserParams:
2020
- Name: disabled
2121
Type: bool

‎ASIM/dev/Parser YAML templates/ASimRegistryEventTemplate.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Parser:
22
Title: Registry Event ASIM parser for <product name>
3-
Version: '<parser version>'
3+
Version: '0.1.0'
44
LastUpdated: <MMM DD, YYYY>
55
Product:
66
Name: <product name>
@@ -14,8 +14,8 @@ References:
1414
Link: https:/aka.ms/AboutASIM
1515
Description: |
1616
This ASIM parser supports normalizing <product name> logs to the ASIM Registry event normalized schema.
17-
ParserName: <parser function name>
18-
EquivalentBuiltInParser: <_ASim_RegistryEvent_Product>
17+
ParserName: <ASimRegistryEventVendor+Product>
18+
EquivalentBuiltInParser: <_ASim_RegistryEvent_Vendor+Product>
1919
ParserParams:
2020
- Name: disabled
2121
Type: bool

‎ASIM/dev/Parser YAML templates/ASimUserManagementTemplate.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Parser:
22
Title: User Management activity ASIM parser for <product name>
3-
Version: '<parser version>'
3+
Version: '0.1.0'
44
LastUpdated: <MMM DD, YYYY>
55
Product:
66
Name: <product name>
@@ -14,8 +14,8 @@ References:
1414
Link: https://aka.ms/AboutASIM
1515
Description: |
1616
This ASIM parser supports normalizing the <product name> logs to the ASIM User Management activity normalized schema.
17-
ParserName: <parser function name>
18-
EquivalentBuiltInParser: <_ASim_UserManagement_Product>
17+
ParserName: <ASimUserManagementVendor+Product>
18+
EquivalentBuiltInParser: <_ASim_UserManagement_Vendor+Product>
1919
ParserParams:
2020
- Name: disabled
2121
Type: bool

‎ASIM/dev/Parser YAML templates/ASimWebSessionTemplate.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Parser:
22
Title: Web Session ASIM parser for <product name>
3-
Version: '<parser version>'
3+
Version: '0.1.0'
44
LastUpdated: <MMM DD, YYYY>
55
Product:
66
Name: <product name>
@@ -14,8 +14,8 @@ References:
1414
Link: https:/aka.ms/AboutASIM
1515
Description: |
1616
This ASIM parser supports normalizing <product name> logs to the ASIM Web Session normalized schema.
17-
ParserName: <parser function name>
18-
EquivalentBuiltInParser: <_ASim_WebSession_Product>
17+
ParserName: <ASimWebSessionVendor+Product>
18+
EquivalentBuiltInParser: <_ASim_WebSession_Vendor+Product
1919
ParserParams:
2020
- Name: disabled
2121
Type: bool

‎ASIM/dev/Parser YAML templates/vimAlertTemplate.yaml

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
Parser:
2+
Title: Alert Event ASIM filtering parser for <product name>
3+
Version: '0.1.0'
4+
LastUpdated: <MMM DD, YYYY>
5+
Product:
6+
Name: <product name>
7+
Normalization:
8+
Schema: AlertEvent
9+
Version: '<current schema version>'
10+
References:
11+
- Title: ASIM Alert Schema
12+
Link: https://aka.ms/ASimAlertEventDoc
13+
- Title: ASIM
14+
Link: https:/aka.ms/AboutASIM
15+
Description: |
16+
This ASIM filtering parser supports normalizing the <product name> logs to the ASIM Alert normalized schema.
17+
ParserName: <vimAlertEventVendor+Product>
18+
EquivalentBuiltInParser: <_Im_AlertEvent_Vendor+Product>
19+
ParserParams:
20+
- Name: starttime
21+
Type: datetime
22+
Default: datetime(null)
23+
- Name: endtime
24+
Type: datetime
25+
Default: datetime(null)
26+
- Name: ipaddr_has_any_prefix
27+
Type: dynamic
28+
Default: dynamic([])
29+
- Name: hostname_has_any
30+
Type: dynamic
31+
Default: dynamic([])
32+
- Name: username_has_any
33+
Type: dynamic
34+
Default: dynamic([])
35+
- Name: attacktactics_has_any
36+
Type: dynamic
37+
Default: dynamic([])
38+
- Name: attacktechniques_has_any
39+
Type: dynamic
40+
Default: dynamic([])
41+
- Name: threatcategory_has_any
42+
Type: dynamic
43+
Default: dynamic([])
44+
- Name: alertverdict_has_any
45+
Type: dynamic
46+
Default: dynamic([])
47+
- Name: eventseverity_has_any
48+
Type: dynamic
49+
Default: dynamic([])
50+
- Name: disabled
51+
Type: bool
52+
Default: false
53+
ParserQuery: |
54+
let parser = (
55+
starttime: datetime=datetime(null),
56+
endtime: datetime=datetime(null),
57+
ipaddr_has_any_prefix: dynamic=dynamic([]),
58+
hostname_has_any: dynamic=dynamic([]),
59+
username_has_any: dynamic=dynamic([]),
60+
attacktactics_has_any: dynamic=dynamic([]),
61+
attacktechniques_has_any: dynamic=dynamic([]),
62+
threatcategory_has_any: dynamic=dynamic([]),
63+
alertverdict_has_any: dynamic=dynamic([]),
64+
eventseverity_has_any: dynamic=dynamic([]),
65+
disabled:bool=false
66+
)
67+
{
68+
<parser query body>
69+
};
70+
parser (
71+
starttime = starttime,
72+
endtime = endtime,
73+
ipaddr_has_any_prefix = ipaddr_has_any_prefix,
74+
hostname_has_any = hostname_has_any,
75+
username_has_any = username_has_any,
76+
attacktactics_has_any = attacktactics_has_any,
77+
attacktechniques_has_any = attacktechniques_has_any,
78+
threatcategory_has_any = threatcategory_has_any,
79+
alertverdict_has_any = alertverdict_has_any,
80+
eventseverity_has_any = eventseverity_has_any,
81+
disabled = disabled
82+
)

‎ASIM/dev/Parser YAML templates/vimAuditEventTemplate.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Parser:
22
Title: Audit Event ASIM filtering parser for <product name>
3-
Version: '<parser version>'
3+
Version: '0.1.0'
44
LastUpdated: <MMM DD, YYYY>
55
Product:
66
Name: <product name>
@@ -14,8 +14,8 @@ References:
1414
Link: https:/aka.ms/AboutASIM
1515
Description: |
1616
This ASIM filtering parser supports normalizing the <product name> logs to the ASIM Audit Event normalized schema.
17-
ParserName: <parser function name>
18-
EquivalentBuiltInParser: <_Im_AuditEvent_Product>
17+
ParserName: <ASimAuditEventVendor+Product>
18+
EquivalentBuiltInParser: <_Im_AuditEvent_Vendor+Product>
1919
ParserParams:
2020
- Name: starttime
2121
Type: datetime

‎ASIM/dev/Parser YAML templates/vimAuthenticationTemplate.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Parser:
22
Title: Authentication ASIM filtering parser for <product name>
3-
Version: '<parser version>'
3+
Version: '0.1.0'
44
LastUpdated: <MMM DD, YYYY>
55
Product:
66
Name: <product name>
@@ -14,8 +14,8 @@ References:
1414
Link: https:/aka.ms/AboutASIM
1515
Description: |
1616
This ASIM filtering parser supports filtering and normalizing the <product name> logs to the ASIM authentication normalized schema.
17-
ParserName: <parser function name>
18-
EquivalentBuiltInParser: <_Im_Authentication_Product>
17+
ParserName: <ASimAuthenticationVendor+Product>
18+
EquivalentBuiltInParser: <_Im_Authentication_Vendor+Product>
1919
ParserParams:
2020
- Name: starttime
2121
Type: datetime

‎ASIM/dev/Parser YAML templates/vimDhcpEventTemplate.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ References:
1414
Link: https:/aka.ms/AboutASIM
1515
Description: |
1616
This ASIM filtering parser supports filtering and normalizing the <product name> logs to the ASIM authentication normalized schema.
17-
ParserName: <vimDhcpEventProduct>
18-
EquivalentBuiltInParser: <_Im_DhcpEvent_Product>
17+
ParserName: <ASimDhcpEventVendor+Product>
18+
EquivalentBuiltInParser: <_Im_DhcpEvent_Vendor+Product>
1919
ParserParams:
2020
- Name: starttime
2121
Type: datetime

0 commit comments

Comments
 (0)