Azure-Sentinel/ASIM/schemas/ASimUserManagement.yaml

113 строки
2.2 KiB
YAML

Schema:
Schema: User Management
Version: '0.1.1'
Last Updated: Sept 12 2023
References:
- Title: ASIM Authentication Schema
Link: https://aka.ms/ASimUserManagementDoc
- Title: ASIM
Link: https://aka.ms/AboutASIM
Include:
# Metadata
- Name: Enumerations
File: common/ASimEnumerations.yaml
# Common fields
- Name: Event Fields
File: common/ASimEventFields.yaml
- Name: Inspection fields
File: common/ASimInspectionFields.yaml
# Entities
- Name: Dvc
File: entities/ASimDvc.yaml
- Name: Actor entity
File: entities/ASimActor.yaml
- Name: Acting application entity
File: entities/ASimApp.yaml
Role: Acting
- Name: Source system entity
File: entities/ASimSystem.yaml
Role: Src
- Name: Target user entity
File: entities/ASimUser.yaml
Role: Target
- Name: Target Group
File: entities/ASimGroup.yaml
Role: Target
Fields:
# Common fields overrides and additions
- Name: EventType
Type: string
Class: Mandatory
Logical type: Enumerated
List of values: [
'UserCreated',
'UserDeleted',
'UserModified',
'UserLocked',
'UserUnlocked',
'UserDisabled',
'UserEnabled',
'PasswordChanged',
'PasswordReset',
'GroupCreated',
'GroupDeleted',
'GroupModified',
'UserAddedToGroup',
'UserRemovedFromGroup',
'GroupEnumerated',
'UserRead',
'GroupRead'
]
- Name: EventResultDetails
Type: string
Class: Recommended
Logical type: Enumerated
List of values: [
'NotAuthorized',
'Other'
]
- Name: EventSubType
Type: string
Class: Optional
Logical type: Enumerated
List of values: [
'Password',
'Hash',
]
- Name: EventSchema
Type: string
Class: Mandatory
Logical type: Enumerated
List of values: [ UserManagement ]
# Aliases
- Name: UpdatedPropertyName
Type: string
Class: Alias
Description: Alias to EventSubType
Aliases: EventSubType
- Name: Hostname
Type: string
Class: Alias
Description: Alias to DvcHostname
Aliases: DvcHostname
# Updated property fields
- Name: PreviousPropertyValue
Class: Optional
Type: string
Description: The previous value that was stored in the specified property.
- Name: NewPropertyValue
Class: Optional
Type: string
Description: The new value stored in the specified property.