[ASIM Parsers] Generate deployable ARM templates from KQL function YAML files.
This commit is contained in:
github-actions[bot]
Родитель
918fd56879
Коммит
f51ec31d24
|
|
@ -35,7 +35,7 @@
|
|||
"displayName": "Authentication ASIM parser",
|
||||
"category": "ASIM",
|
||||
"FunctionAlias": "ASimAuthentication",
|
||||
"query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet ASimAuthenticationDisabled=toscalar('ExcludeASimAuthentication' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimAuthenticationEmpty, \n ASimAuthenticationAADManagedIdentitySignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADNonInteractiveUserSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADServicePrincipalSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAWSCloudTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAWSCloudTrail' in (DisabledParsers) )),\n ASimAuthenticationBarracudaWAF (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationBarracudaWAF' in (DisabledParsers) )),\n ASimAuthenticationCiscoASA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoASA' in (DisabledParsers) )), \n ASimAuthenticationCiscoISE (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISE' in (DisabledParsers) )),\n ASimAuthenticationCiscoMeraki (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMeraki' in (DisabledParsers) )),\n ASimAuthenticationM365Defender (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationM365Defender' in (DisabledParsers) )),\n ASimAuthenticationMD4IoT (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMD4IoT' in (DisabledParsers) )),\n ASimAuthenticationMicrosoftWindowsEvent (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )),\n ASimAuthenticationOktaSSO (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSSO' in (DisabledParsers) )),\n ASimAuthenticationPostgreSQL (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPostgreSQL' in (DisabledParsers) )),\n ASimAuthenticationSigninLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSigninLogs' in (DisabledParsers) )),\n ASimAuthenticationSshd (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSshd' in (DisabledParsers) )),\n ASimAuthenticationSu (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSu' in (DisabledParsers) )),\n ASimAuthenticationSalesforceSC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceSC' in (DisabledParsers) )),\n ASimAuthenticationVectraXDRAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVectraXDRAudit' in (DisabledParsers) )),\n ASimAuthenticationSentinelOne (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSentinelOne' in (DisabledParsers) )),\n ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalcon' in (DisabledParsers) ))\n",
|
||||
"query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet ASimAuthenticationDisabled=toscalar('ExcludeASimAuthentication' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimAuthenticationEmpty, \n ASimAuthenticationAADManagedIdentitySignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADNonInteractiveUserSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADServicePrincipalSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAWSCloudTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAWSCloudTrail' in (DisabledParsers) )),\n ASimAuthenticationBarracudaWAF (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationBarracudaWAF' in (DisabledParsers) )),\n ASimAuthenticationCiscoASA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoASA' in (DisabledParsers) )), \n ASimAuthenticationCiscoISE (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISE' in (DisabledParsers) )),\n ASimAuthenticationCiscoMeraki (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMeraki' in (DisabledParsers) )),\n ASimAuthenticationM365Defender (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationM365Defender' in (DisabledParsers) )),\n ASimAuthenticationMD4IoT (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMD4IoT' in (DisabledParsers) )),\n ASimAuthenticationMicrosoftWindowsEvent (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )),\n ASimAuthenticationOktaSSO (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSSO' in (DisabledParsers) )),\n ASimAuthenticationPostgreSQL (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPostgreSQL' in (DisabledParsers) )),\n ASimAuthenticationSigninLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSigninLogs' in (DisabledParsers) )),\n ASimAuthenticationSshd (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSshd' in (DisabledParsers) )),\n ASimAuthenticationSu (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSu' in (DisabledParsers) )),\n ASimAuthenticationSalesforceSC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceSC' in (DisabledParsers) )),\n ASimAuthenticationVectraXDRAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVectraXDRAudit' in (DisabledParsers) )),\n ASimAuthenticationSentinelOne (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSentinelOne' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoCortexDataLake (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )),\n ASimAuthenticationVMwareCarbonBlackCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )),\n ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalcon' in (DisabledParsers) ))\n",
|
||||
"version": 1,
|
||||
"functionParameters": "disabled:bool=False"
|
||||
}
|
||||
|
|
|
|||
Различия файлов скрыты, потому что одна или несколько строк слишком длинны
|
|
@ -0,0 +1,18 @@
|
|||
# Palo Alto Cortex Data Lake ASIM Authentication Normalization Parser
|
||||
|
||||
ARM template for ASIM Authentication schema parser for Palo Alto Cortex Data Lake.
|
||||
|
||||
This ASIM parser supports normalizing Palo Alto Cortex Data Lake logs to the ASIM Authentication normalized schema. These events are captured through the Palo Alto Networks CDL data connector that ingests CDL logs into Microsoft Sentinel.
|
||||
|
||||
|
||||
The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
|
||||
|
||||
For more information, see:
|
||||
|
||||
- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
|
||||
- [Deploy all of ASIM](https://aka.ms/DeployASIM)
|
||||
- [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc)
|
||||
|
||||
<br>
|
||||
|
||||
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationPaloAltoCortexDataLake%2FASimAuthenticationPaloAltoCortexDataLake.json) [](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationPaloAltoCortexDataLake%2FASimAuthenticationPaloAltoCortexDataLake.json)
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
{
|
||||
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
|
||||
"contentVersion": "1.0.0.0",
|
||||
"parameters": {
|
||||
"Workspace": {
|
||||
"type": "string",
|
||||
"metadata": {
|
||||
"description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group."
|
||||
}
|
||||
},
|
||||
"WorkspaceRegion": {
|
||||
"type": "string",
|
||||
"defaultValue": "[resourceGroup().location]",
|
||||
"metadata": {
|
||||
"description": "The region of the selected workspace. The default value will use the Region selection above."
|
||||
}
|
||||
}
|
||||
},
|
||||
"resources": [
|
||||
{
|
||||
"type": "Microsoft.OperationalInsights/workspaces",
|
||||
"apiVersion": "2017-03-15-preview",
|
||||
"name": "[parameters('Workspace')]",
|
||||
"location": "[parameters('WorkspaceRegion')]",
|
||||
"resources": [
|
||||
{
|
||||
"type": "savedSearches",
|
||||
"apiVersion": "2020-08-01",
|
||||
"name": "ASimAuthenticationVMwareCarbonBlackCloud",
|
||||
"dependsOn": [
|
||||
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('Workspace'))]"
|
||||
],
|
||||
"properties": {
|
||||
"etag": "*",
|
||||
"displayName": "ASIM Authentication parser for VMware Carbon Black Cloud",
|
||||
"category": "ASIM",
|
||||
"FunctionAlias": "ASimAuthenticationVMwareCarbonBlackCloud",
|
||||
"query": "let parser = (disabled: bool=false) {\n CarbonBlackAuditLogs_CL\n | where not(disabled)\n | where description_s has_any (\"logged in\", \"login\",\"second factor authentication\") and description_s !has \"connector\"\n | extend\n EventStartTime = unixtime_milliseconds_todatetime(eventTime_d),\n EventResult = iff(description_s has \"successfully\", \"Success\", \"Failure\"),\n AdditionalFields = bag_pack(\"flagged\", flagged_b),\n EventSeverity = iff(flagged_b == true, \"Low\", \"Informational\")\n | extend\n EventCount = int(1),\n EventProduct = \"Carbon Black Cloud\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.3\",\n EventVendor = \"VMware\",\n EventType = \"Logon\",\n EventResultDetails = case(\n EventResult == \"Failure\" and description_s has (\"locked\"),\n \"User locked\",\n EventResult == \"Failure\" and description_s has_any (\"logged in\", \"login\"),\n \"Incorrect password\",\n EventResult == \"Failure\" and description_s has (\"second factor authentication\"),\n \"MFA not satisfied\",\n \"\"\n ),\n EventOriginalResultDetails = iff(EventResult == \"Failure\", tostring(split(description_s, ';')[1]), \"\")\n | project-rename\n EventMessage = description_s,\n EventOriginalUid = eventId_g,\n TargetUsername = loginName_s,\n SrcIpAddr = clientIp_s,\n EventUid=_ItemId,\n EventOwner = orgName_s\n | extend\n IpAddr = SrcIpAddr,\n TargetUsernameType = _ASIM_GetUsernameType(TargetUsername),\n TargetUserType = _ASIM_GetUserType(TargetUsername, \"\"),\n Dvc = EventProduct,\n EventEndTime = EventStartTime,\n User = TargetUsername,\n Src = SrcIpAddr\n | project-away\n *_s,\n *_d,\n *_b,\n _ResourceId,\n Computer,\n MG,\n ManagementGroupName,\n RawData,\n SourceSystem,\n TenantId \n};\nparser(disabled=disabled)\n",
|
||||
"version": 1,
|
||||
"functionParameters": "disabled:bool=False"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
# VMware Carbon Black Cloud ASIM Authentication Normalization Parser
|
||||
|
||||
ARM template for ASIM Authentication schema parser for VMware Carbon Black Cloud.
|
||||
|
||||
This ASIM parser supports normalizing VMware Carbon Black Cloud logs to the ASIM Authentication normalized schema. VMware Carbon Black Cloud events are captured through VMware Carbon Black Cloud data connector which ingests Carbon Black Audit, Notification and Event data into Microsoft Sentinel through the REST API.
|
||||
|
||||
|
||||
The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
|
||||
|
||||
For more information, see:
|
||||
|
||||
- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
|
||||
- [Deploy all of ASIM](https://aka.ms/DeployASIM)
|
||||
- [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc)
|
||||
|
||||
<br>
|
||||
|
||||
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationVMwareCarbonBlackCloud%2FASimAuthenticationVMwareCarbonBlackCloud.json) [](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationVMwareCarbonBlackCloud%2FASimAuthenticationVMwareCarbonBlackCloud.json)
|
||||
|
|
@ -318,6 +318,26 @@
|
|||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Resources/deployments",
|
||||
"apiVersion": "2020-10-01",
|
||||
"name": "linkedASimAuthenticationPaloAltoCortexDataLake",
|
||||
"properties": {
|
||||
"mode": "Incremental",
|
||||
"templateLink": {
|
||||
"uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/ASimAuthenticationPaloAltoCortexDataLake/ASimAuthenticationPaloAltoCortexDataLake.json",
|
||||
"contentVersion": "1.0.0.0"
|
||||
},
|
||||
"parameters": {
|
||||
"Workspace": {
|
||||
"value": "[parameters('Workspace')]"
|
||||
},
|
||||
"WorkspaceRegion": {
|
||||
"value": "[parameters('WorkspaceRegion')]"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Resources/deployments",
|
||||
"apiVersion": "2020-10-01",
|
||||
|
|
@ -438,6 +458,26 @@
|
|||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Resources/deployments",
|
||||
"apiVersion": "2020-10-01",
|
||||
"name": "linkedASimAuthenticationVMwareCarbonBlackCloud",
|
||||
"properties": {
|
||||
"mode": "Incremental",
|
||||
"templateLink": {
|
||||
"uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/ASimAuthenticationVMwareCarbonBlackCloud/ASimAuthenticationVMwareCarbonBlackCloud.json",
|
||||
"contentVersion": "1.0.0.0"
|
||||
},
|
||||
"parameters": {
|
||||
"Workspace": {
|
||||
"value": "[parameters('Workspace')]"
|
||||
},
|
||||
"WorkspaceRegion": {
|
||||
"value": "[parameters('WorkspaceRegion')]"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Resources/deployments",
|
||||
"apiVersion": "2020-10-01",
|
||||
|
|
@ -778,6 +818,26 @@
|
|||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Resources/deployments",
|
||||
"apiVersion": "2020-10-01",
|
||||
"name": "linkedvimAuthenticationPaloAltoCortexDataLake",
|
||||
"properties": {
|
||||
"mode": "Incremental",
|
||||
"templateLink": {
|
||||
"uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/vimAuthenticationPaloAltoCortexDataLake/vimAuthenticationPaloAltoCortexDataLake.json",
|
||||
"contentVersion": "1.0.0.0"
|
||||
},
|
||||
"parameters": {
|
||||
"Workspace": {
|
||||
"value": "[parameters('Workspace')]"
|
||||
},
|
||||
"WorkspaceRegion": {
|
||||
"value": "[parameters('WorkspaceRegion')]"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Resources/deployments",
|
||||
"apiVersion": "2020-10-01",
|
||||
|
|
@ -878,6 +938,26 @@
|
|||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Resources/deployments",
|
||||
"apiVersion": "2020-10-01",
|
||||
"name": "linkedvimAuthenticationVMwareCarbonBlackCloud",
|
||||
"properties": {
|
||||
"mode": "Incremental",
|
||||
"templateLink": {
|
||||
"uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/vimAuthenticationVMwareCarbonBlackCloud/vimAuthenticationVMwareCarbonBlackCloud.json",
|
||||
"contentVersion": "1.0.0.0"
|
||||
},
|
||||
"parameters": {
|
||||
"Workspace": {
|
||||
"value": "[parameters('Workspace')]"
|
||||
},
|
||||
"WorkspaceRegion": {
|
||||
"value": "[parameters('WorkspaceRegion')]"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Resources/deployments",
|
||||
"apiVersion": "2020-10-01",
|
||||
|
|
|
|||
Различия файлов скрыты, потому что одна или несколько строк слишком длинны
|
|
@ -0,0 +1,18 @@
|
|||
# Palo Alto Cortex Data Lake ASIM Authentication Normalization Parser
|
||||
|
||||
ARM template for ASIM Authentication schema parser for Palo Alto Cortex Data Lake.
|
||||
|
||||
This ASIM parser supports normalizing Palo Alto Cortex Data Lake logs to the ASIM Authentication normalized schema. These events are captured through the Palo Alto Networks CDL data connector that ingests CDL logs into Microsoft Sentinel.
|
||||
|
||||
|
||||
The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
|
||||
|
||||
For more information, see:
|
||||
|
||||
- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
|
||||
- [Deploy all of ASIM](https://aka.ms/DeployASIM)
|
||||
- [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc)
|
||||
|
||||
<br>
|
||||
|
||||
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationPaloAltoCortexDataLake%2FvimAuthenticationPaloAltoCortexDataLake.json) [](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationPaloAltoCortexDataLake%2FvimAuthenticationPaloAltoCortexDataLake.json)
|
||||
Различия файлов скрыты, потому что одна или несколько строк слишком длинны
|
|
@ -0,0 +1,18 @@
|
|||
# VMware Carbon Black Cloud ASIM Authentication Normalization Parser
|
||||
|
||||
ARM template for ASIM Authentication schema parser for VMware Carbon Black Cloud.
|
||||
|
||||
This ASIM parser supports normalizing VMware Carbon Black Cloud logs to the ASIM Authentication normalized schema. VMware Carbon Black Cloud events are captured through VMware Carbon Black Cloud data connector which ingests Carbon Black Audit, Notification and Event data into Microsoft Sentinel through the REST API.
|
||||
|
||||
|
||||
The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
|
||||
|
||||
For more information, see:
|
||||
|
||||
- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
|
||||
- [Deploy all of ASIM](https://aka.ms/DeployASIM)
|
||||
- [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc)
|
||||
|
||||
<br>
|
||||
|
||||
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationVMwareCarbonBlackCloud%2FvimAuthenticationVMwareCarbonBlackCloud.json) [](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationVMwareCarbonBlackCloud%2FvimAuthenticationVMwareCarbonBlackCloud.json)
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
{
|
||||
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
|
||||
"contentVersion": "1.0.0.0",
|
||||
"parameters": {
|
||||
"Workspace": {
|
||||
"type": "string",
|
||||
"metadata": {
|
||||
"description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group."
|
||||
}
|
||||
},
|
||||
"WorkspaceRegion": {
|
||||
"type": "string",
|
||||
"defaultValue": "[resourceGroup().location]",
|
||||
"metadata": {
|
||||
"description": "The region of the selected workspace. The default value will use the Region selection above."
|
||||
}
|
||||
}
|
||||
},
|
||||
"resources": [
|
||||
{
|
||||
"type": "Microsoft.OperationalInsights/workspaces",
|
||||
"apiVersion": "2017-03-15-preview",
|
||||
"name": "[parameters('Workspace')]",
|
||||
"location": "[parameters('WorkspaceRegion')]",
|
||||
"resources": [
|
||||
{
|
||||
"type": "savedSearches",
|
||||
"apiVersion": "2020-08-01",
|
||||
"name": "vimAuthenticationVMwareCarbonBlackCloud",
|
||||
"dependsOn": [
|
||||
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('Workspace'))]"
|
||||
],
|
||||
"properties": {
|
||||
"etag": "*",
|
||||
"displayName": "ASIM Authentication parser for VMware Carbon Black Cloud",
|
||||
"category": "ASIM",
|
||||
"FunctionAlias": "vimAuthenticationVMwareCarbonBlackCloud",
|
||||
"query": "let parser = (\n starttime: datetime=datetime(null), \n endtime: datetime=datetime(null), \n eventtype_in: dynamic=dynamic([]), \n eventresultdetails_in: dynamic=dynamic([]), \n eventresult: string='*', \n targetusername_has_any: dynamic=dynamic([]), \n targetappname_has_any: dynamic=dynamic([]), \n actorusername_has_any: dynamic=dynamic([]), \n srcipaddr_has_any_prefix: dynamic=dynamic([]), \n srchostname_has_any: dynamic=dynamic([]), \n targetipaddr_has_any_prefix: dynamic=dynamic([]), \n dvcipaddr_has_any_prefix: dynamic=dynamic([]), \n dvchostname_has_any: dynamic=dynamic([]), \n disabled: bool = false\n ) {\n CarbonBlackAuditLogs_CL\n | where not(disabled)\n | where (isnull(starttime) or TimeGenerated >= starttime)\n and (isnull(endtime) or TimeGenerated <= endtime)\n and (description_s has_any (\"logged in\", \"login\",\"second factor authentication\") and description_s !has \"connector\")\n and array_length(targetappname_has_any) == 0\n and array_length(actorusername_has_any) == 0\n and array_length(srchostname_has_any) == 0\n and array_length(targetipaddr_has_any_prefix) == 0\n and array_length(dvcipaddr_has_any_prefix) == 0\n and array_length(dvchostname_has_any) == 0\n and (array_length(targetusername_has_any) == 0 or loginName_s has_any(targetusername_has_any))\n and (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(clientIp_s, srcipaddr_has_any_prefix))\n | extend\n EventResult = iff(description_s has \"successfully\", \"Success\", \"Failure\"),\n EventType = \"Logon\"\n | where (array_length(eventtype_in) == 0 or EventType has_any (eventtype_in))\n and (eventresult == '*' or EventResult has eventresult)\n | extend EventResultDetails = case(\n EventResult == \"Failure\" and description_s has (\"locked\"),\n \"User locked\",\n EventResult == \"Failure\" and description_s has_any (\"logged in\", \"login\"),\n \"Incorrect password\",\n EventResult == \"Failure\" and description_s has (\"second factor authentication\"),\n \"MFA not satisfied\",\n \"\"\n )\n | where (array_length(eventresultdetails_in) == 0 or EventResultDetails has_any (eventresultdetails_in))\n | extend\n EventStartTime = unixtime_milliseconds_todatetime(eventTime_d),\n AdditionalFields = bag_pack(\"flagged\", flagged_b),\n EventSeverity = iff(flagged_b == true, \"Low\", \"Informational\"),\n EventCount = int(1),\n EventProduct = \"Carbon Black Cloud\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.3\",\n EventVendor = \"VMware\",\n EventOriginalResultDetails = iff(EventResult == \"Failure\", tostring(split(description_s, ';')[1]), \"\")\n | project-rename\n EventMessage = description_s,\n EventOriginalUid = eventId_g,\n TargetUsername = loginName_s,\n SrcIpAddr = clientIp_s,\n EventUid=_ItemId,\n EventOwner = orgName_s\n | extend\n IpAddr = SrcIpAddr,\n TargetUsernameType = _ASIM_GetUsernameType(TargetUsername),\n TargetUserType = _ASIM_GetUserType(TargetUsername, \"\"),\n Dvc = EventProduct,\n EventEndTime = EventStartTime,\n User = TargetUsername,\n Src = SrcIpAddr\n | project-away\n *_s,\n *_d,\n *_b,\n _ResourceId,\n Computer,\n MG,\n ManagementGroupName,\n RawData,\n SourceSystem,\n TenantId \n};\nparser(\n starttime=starttime, \n endtime=endtime, \n eventtype_in=eventtype_in, \n eventresultdetails_in=eventresultdetails_in, \n eventresult=eventresult, \n targetusername_has_any=targetusername_has_any, \n targetappname_has_any=targetappname_has_any, \n actorusername_has_any=actorusername_has_any, \n srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, \n srchostname_has_any=srchostname_has_any, \n targetipaddr_has_any_prefix=targetipaddr_has_any_prefix, \n dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, \n dvchostname_has_any=dvchostname_has_any, \n disabled=disabled\n)\n",
|
||||
"version": 1,
|
||||
"functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),eventtype_in:dynamic=dynamic([]),eventresultdetails_in:dynamic=dynamic([]),eventresult:string='*',targetusername_has_any:dynamic=dynamic([]),targetappname_has_any:dynamic=dynamic([]),actorusername_has_any:dynamic=dynamic([]),srcipaddr_has_any_prefix:dynamic=dynamic([]),srchostname_has_any:dynamic=dynamic([]),targetipaddr_has_any_prefix:dynamic=dynamic([]),dvcipaddr_has_any_prefix:dynamic=dynamic([]),dvchostname_has_any:dynamic=dynamic([]),disabled:bool=False"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Загрузка…
Ссылка в новой задаче