diff --git a/Parsers/ASimProcessEvent/ARM/ASimProcessEventMD4IoT/ASimProcessEventMD4IoT.json b/Parsers/ASimProcessEvent/ARM/ASimProcessEventMD4IoT/ASimProcessEventMD4IoT.json index 486861db715..d552cecfe85 100644 --- a/Parsers/ASimProcessEvent/ARM/ASimProcessEventMD4IoT/ASimProcessEventMD4IoT.json +++ b/Parsers/ASimProcessEvent/ARM/ASimProcessEventMD4IoT/ASimProcessEventMD4IoT.json @@ -27,7 +27,7 @@ "displayName": "Process Create Event ASIM parser for Microsoft Defender for IoT", "category": "ASIM", "FunctionAlias": "ASimProcessEventMD4IoT", - "query": "let ProcessEvents_MD4IoT=()\n{\n SecurityIoTRawEvent | where not(disabled)\n | where RawEventName == \"Process\"\n | extend\n EventDetails = todynamic(EventDetails)\n | extend \n DvcOs = iif (EventDetails.MessageSource == \"Linux\", \"Linux\", \"Windows\") // Intermediate fix\n | extend \n EventOriginalUid = tostring(EventDetails.OriginalEventId), \n EventCount = toint(EventDetails.HitCount), \n EventProduct = 'Azure Defender for IoT', \n EventVendor = 'Microsoft', \n EventSchemaVersion = '0.1.0', \n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(EventDetails.TimestampUTC), \n EventEndTime = todatetime(TimeGenerated), \n EventType = iff (EventDetails.EventType == 'EXIT', 'ProcessTerminate', 'ProcessCreated'), \n EventSubType = tostring(EventDetails.EventType),\n EventResult = 'Success', \n TargetProcessId = tostring(EventDetails.ProcessId), \n TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), \n TargetProcessName = coalesce (tostring(EventDetails.Executable), split(EventDetails.Commandline,\" \")[0]),\n TargetUsernameType = iif (DvcOs == \"Windows\", \"Windows\", \"Simple\"), \n TargetUsername = iff (DvcOs == \"Windows\", tostring(EventDetails.UserName), \"\"), \n ActingProcessId = iff (DvcOs == \"Windows\", tostring(EventDetails.ParentProcessId), \"\") \n | project-rename\n DvcHostname = DeviceId,\n EventProductVersion = AgentVersion, // Not available in Windows\n _ResourceId = AssociatedResourceId, \n _SubscriptionId = AzureSubscriptionId \n | extend \n // -- aliases\n User = TargetUsername, \n CommandLine = TargetProcessCommandLine, \n Process = TargetProcessName, \n Dvc = DvcHostname \n };\n ProcessEvents_MD4IoT\n", + "query": "let ProcessEvents_MD4IoT=()\n{\n SecurityIoTRawEvent | where not(disabled)\n | where RawEventName == \"Process\"\n | extend\n EventDetails = todynamic(EventDetails)\n | extend \n DvcOs = iif (EventDetails.MessageSource == \"Linux\", \"Linux\", \"Windows\") // Intermediate fix\n | extend \n EventOriginalUid = tostring(EventDetails.OriginalEventId), \n EventCount = toint(EventDetails.HitCount), \n EventProduct = 'Azure Defender for IoT', \n EventVendor = 'Microsoft', \n EventSchemaVersion = '0.1.0', \n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(EventDetails.TimestampUTC), \n EventEndTime = todatetime(TimeGenerated), \n EventType = iff (EventDetails.EventType == 'EXIT', 'ProcessTerminate', 'ProcessCreated'), \n EventSubType = tostring(EventDetails.EventType),\n EventResult = 'Success', \n TargetProcessId = tostring(EventDetails.ProcessId), \n TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), \n TargetProcessName = coalesce (tostring(EventDetails.Executable), tostring(split(EventDetails.Commandline,\" \")[0])),\n TargetUsernameType = iif (DvcOs == \"Windows\", \"Windows\", \"Simple\"), \n TargetUsername = iff (DvcOs == \"Windows\", tostring(EventDetails.UserName), \"\"), \n ActingProcessId = iff (DvcOs == \"Windows\", tostring(EventDetails.ParentProcessId), \"\") \n | project-rename\n DvcHostname = DeviceId,\n EventProductVersion = AgentVersion, // Not available in Windows\n _ResourceId = AssociatedResourceId, \n _SubscriptionId = AzureSubscriptionId \n | extend \n // -- aliases\n User = TargetUsername, \n CommandLine = TargetProcessCommandLine, \n Process = TargetProcessName, \n Dvc = DvcHostname \n };\n ProcessEvents_MD4IoT\n", "version": 1, "functionParameters": "disabled:bool=False" } diff --git a/Parsers/ASimProcessEvent/ARM/ASimProcessEventMicrosoft365D/ASimProcessEventMicrosoft365D.json b/Parsers/ASimProcessEvent/ARM/ASimProcessEventMicrosoft365D/ASimProcessEventMicrosoft365D.json index 269abe2dfb8..826f53aa793 100644 --- a/Parsers/ASimProcessEvent/ARM/ASimProcessEventMicrosoft365D/ASimProcessEventMicrosoft365D.json +++ b/Parsers/ASimProcessEvent/ARM/ASimProcessEventMicrosoft365D/ASimProcessEventMicrosoft365D.json @@ -27,7 +27,7 @@ "displayName": "Process Create Event ASIM parser for Microsoft 365 Defender for endpoint", "category": "ASIM", "FunctionAlias": "ASimProcessEventMicrosoft365D", - "query": "let parser=(disabled:boolean=false)\n {\n DeviceProcessEvents \n | where not(disabled)\n | extend\n Type = \"DeviceProcessEvents\",\n EventOriginalUid = tostring(ReportId),\n EventCount = int(1),\n EventProduct = 'M365 Defender for Endpoint',\n EventVendor = 'Microsoft',\n EventSchemaVersion = '0.1.4',\n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(Timestamp),\n EventEndTime = todatetime(Timestamp),\n EventResult = 'Success'\n | extend\n EventUid = EventOriginalUid,\n ActorUsername = iff (InitiatingProcessAccountDomain == '', InitiatingProcessAccountName, strcat(InitiatingProcessAccountDomain, '\\\\', InitiatingProcessAccountName)),\n TargetUsername = iff (AccountDomain == '', AccountName, strcat(AccountDomain, '\\\\', AccountName)),\n TargetUsernameType = iff(AccountDomain == '','Simple', 'Windows'),\n ActorUsernameType = iff(InitiatingProcessAccountDomain == '','Simple', 'Windows'),\n ActorUserIdType = 'SID',\n TargetUserIdType = 'SID',\n ActorSessionId = tostring(InitiatingProcessLogonId),\n TargetUserSessionId = tostring(LogonId),\n Hash = coalesce (SHA256, SHA1, MD5, \"\"),\n TargetProcessId = tostring(ProcessId),\n ActingProcessId = tostring(InitiatingProcessId),\n ParentProcessId = tostring(InitiatingProcessParentId),\n DvcOs = iff (AdditionalFields has \"ProcessPosixProcessGroupId\", \"Linux\", \"Windows\"),\n TargetProcessFileSize = iif(FileSize != 0, FileSize, dynamic(null)),\n ActingProcessFileSize = iif(InitiatingProcessFileSize != 0, InitiatingProcessFileSize, dynamic(null))\n | extend\n HashType = tostring(dynamic([\"SHA256\", \"SHA1\", \"MD5\"])[array_index_of(pack_array(SHA256, SHA1, MD5),Hash)])\n | invoke _ASIM_ResolveDvcFQDN('DeviceName')\n | project-rename\n DvcId = DeviceId,\n EventType = ActionType,\n ActorUserId = InitiatingProcessAccountSid,\n ActorUserAadId = InitiatingProcessAccountObjectId,\n ActorUserUpn = InitiatingProcessAccountUpn,\n TargetUserId = AccountSid,\n TargetUserAadId = AccountObjectId,\n TargetUserUpn = AccountUpn,\n ParentProcessName = InitiatingProcessParentFileName,\n TargetProcessFilename = FileName,\n TargetProcessFileCompany = ProcessVersionInfoCompanyName,\n TargetProcessFileDescription = ProcessVersionInfoFileDescription,\n TargetProcessFileProduct = ProcessVersionInfoProductName,\n TargetProcessFileVersion = ProcessVersionInfoProductVersion,\n TargetProcessFileInternalName = ProcessVersionInfoInternalFileName,\n TargetProcessFileOriginalName = ProcessVersionInfoOriginalFileName,\n ParentProcessCreationTime = InitiatingProcessParentCreationTime,\n TargetProcessName = FolderPath,\n TargetProcessCommandLine = ProcessCommandLine,\n TargetProcessMD5 = MD5,\n TargetProcessSHA1 = SHA1,\n TargetProcessSHA256 = SHA256,\n TargetProcessIntegrityLevel = ProcessIntegrityLevel,\n TargetProcessTokenElevation = ProcessTokenElevation,\n TargetProcessCreationTime = ProcessCreationTime,\n ActingProcessName = InitiatingProcessFolderPath, \n ActingProcessFilename = InitiatingProcessFileName,\n ActingProcessFileCompany = InitiatingProcessVersionInfoCompanyName,\n ActingProcessFileDescription = InitiatingProcessVersionInfoFileDescription,\n ActingProcessFileProduct = InitiatingProcessVersionInfoProductName,\n ActingProcessFileVersion = InitiatingProcessVersionInfoProductVersion,\n ActingProcessFileInternalName = InitiatingProcessVersionInfoInternalFileName,\n ActingProcessFileOriginalName = InitiatingProcessVersionInfoOriginalFileName,\n ActingProcessCommandLine = InitiatingProcessCommandLine, \n ActingProcessMD5 = InitiatingProcessMD5, \n ActingProcessSHA1 = InitiatingProcessSHA1, \n ActingProcessSHA256 = InitiatingProcessSHA256, \n ActingProcessIntegrityLevel = InitiatingProcessIntegrityLevel,\n ActingProcessTokenElevation = InitiatingProcessTokenElevation,\n ActingProcessCreationTime = InitiatingProcessCreationTime\n | extend\n ActorUsernameType = _ASIM_GetUsernameType(ActorUsername),\n TargetUsernameType = _ASIM_GetUsernameType(TargetUsername)\n | extend // -- aliases\n User = coalesce(TargetUsername, ActorUsername),\n CommandLine = TargetProcessCommandLine,\n Process = TargetProcessName,\n Dvc = DvcHostname\n | project\n TimeGenerated,\n Type,\n EventUid,\n EventOriginalUid,\n EventCount,\n EventProduct,\n EventVendor,\n EventSchemaVersion,\n EventSchema,\n EventStartTime,\n EventEndTime,\n EventResult,\n ActorUsername,\n ActorUserIdType,\n TargetUserIdType,\n ActorUsernameType,\n TargetUsername,\n TargetUsernameType,\n ActorSessionId,\n TargetUserSessionId,\n Hash,\n TargetProcessId,\n ActingProcessId,\n ParentProcessId,\n DvcOs,\n HashType,\n DvcId,\n DvcHostname,\n DvcDomain,\n DvcDomainType,\n EventType,\n ActorUserId,\n ActorUserAadId,\n ActorUserUpn,\n TargetUserId,\n TargetUserAadId,\n TargetUserUpn,\n ParentProcessName,\n TargetProcessFilename,\n ParentProcessCreationTime,\n TargetProcessName,\n TargetProcessCommandLine,\n TargetProcessMD5,\n TargetProcessSHA1,\n TargetProcessSHA256,\n TargetProcessIntegrityLevel,\n TargetProcessTokenElevation,\n TargetProcessCreationTime,\n TargetProcessFileCompany,\n TargetProcessFileDescription,\n TargetProcessFileProduct,\n TargetProcessFileVersion,\n TargetProcessFileInternalName,\n TargetProcessFileOriginalName,\n TargetProcessFileSize,\n ActingProcessName,\n ActingProcessFilename,\n ActingProcessCommandLine,\n ActingProcessMD5,\n ActingProcessSHA1,\n ActingProcessSHA256,\n ActingProcessIntegrityLevel,\n ActingProcessTokenElevation,\n ActingProcessCreationTime,\n ActingProcessFileCompany,\n ActingProcessFileDescription,\n ActingProcessFileProduct,\n ActingProcessFileVersion,\n ActingProcessFileInternalName,\n ActingProcessFileOriginalName,\n ActingProcessFileSize,\n User,\n CommandLine,\n Process,\n Dvc,\n AdditionalFields\n };\n parser (disabled = disabled)", + "query": "let parser=(disabled:boolean=false)\n {\n DeviceProcessEvents \n | where not(disabled)\n | extend\n Type = \"DeviceProcessEvents\",\n EventOriginalUid = tostring(ReportId),\n EventCount = int(1),\n EventProduct = 'M365 Defender for Endpoint',\n EventVendor = 'Microsoft',\n EventSchemaVersion = '0.1.4',\n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(Timestamp),\n EventEndTime = todatetime(Timestamp),\n EventResult = 'Success'\n | extend\n EventUid = EventOriginalUid,\n ActorUsername = iff (InitiatingProcessAccountDomain == '', InitiatingProcessAccountName, strcat(InitiatingProcessAccountDomain, '\\\\', InitiatingProcessAccountName)),\n TargetUsername = iff (AccountDomain == '', AccountName, strcat(AccountDomain, '\\\\', AccountName)),\n TargetUsernameType = iff(AccountDomain == '','Simple', 'Windows'),\n ActorUsernameType = iff(InitiatingProcessAccountDomain == '','Simple', 'Windows'),\n ActorUserIdType = 'SID',\n TargetUserIdType = 'SID',\n ActorSessionId = tostring(InitiatingProcessLogonId),\n TargetUserSessionId = tostring(LogonId),\n Hash = coalesce (SHA256, SHA1, MD5, \"\"),\n TargetProcessId = tostring(ProcessId),\n ActingProcessId = tostring(InitiatingProcessId),\n ParentProcessId = tostring(InitiatingProcessParentId),\n DvcOs = iff (AdditionalFields has \"ProcessPosixProcessGroupId\", \"Linux\", \"Windows\"),\n TargetProcessFileSize = iif(FileSize != 0, FileSize, dynamic(null)),\n ActingProcessFileSize = iif(InitiatingProcessFileSize != 0, InitiatingProcessFileSize, dynamic(null))\n | extend\n HashType = tostring(dynamic([\"SHA256\", \"SHA1\", \"MD5\"])[array_index_of(pack_array(SHA256, SHA1, MD5),Hash)])\n | invoke _ASIM_ResolveDvcFQDN('DeviceName')\n | project-rename\n DvcId = DeviceId,\n EventType = ActionType,\n ActorUserId = InitiatingProcessAccountSid,\n ActorUserAadId = InitiatingProcessAccountObjectId,\n ActorUserUpn = InitiatingProcessAccountUpn,\n TargetUserId = AccountSid,\n TargetUserAadId = AccountObjectId,\n TargetUserUpn = AccountUpn,\n ParentProcessName = InitiatingProcessParentFileName,\n TargetProcessFilename = FileName,\n TargetProcessFileCompany = ProcessVersionInfoCompanyName,\n TargetProcessFileDescription = ProcessVersionInfoFileDescription,\n TargetProcessFileProduct = ProcessVersionInfoProductName,\n TargetProcessFileVersion = ProcessVersionInfoProductVersion,\n TargetProcessFileInternalName = ProcessVersionInfoInternalFileName,\n TargetProcessFileOriginalName = ProcessVersionInfoOriginalFileName,\n ParentProcessCreationTime = InitiatingProcessParentCreationTime,\n TargetProcessName = FolderPath,\n TargetProcessCommandLine = ProcessCommandLine,\n TargetProcessMD5 = MD5,\n TargetProcessSHA1 = SHA1,\n TargetProcessSHA256 = SHA256,\n TargetProcessIntegrityLevel = ProcessIntegrityLevel,\n TargetProcessTokenElevation = ProcessTokenElevation,\n TargetProcessCreationTime = ProcessCreationTime,\n ActingProcessName = InitiatingProcessFolderPath, \n ActingProcessFilename = InitiatingProcessFileName,\n ActingProcessFileCompany = InitiatingProcessVersionInfoCompanyName,\n ActingProcessFileDescription = InitiatingProcessVersionInfoFileDescription,\n ActingProcessFileProduct = InitiatingProcessVersionInfoProductName,\n ActingProcessFileVersion = InitiatingProcessVersionInfoProductVersion,\n ActingProcessFileInternalName = InitiatingProcessVersionInfoInternalFileName,\n ActingProcessFileOriginalName = InitiatingProcessVersionInfoOriginalFileName,\n ActingProcessCommandLine = InitiatingProcessCommandLine, \n ActingProcessMD5 = InitiatingProcessMD5, \n ActingProcessSHA1 = InitiatingProcessSHA1, \n ActingProcessSHA256 = InitiatingProcessSHA256, \n ActingProcessIntegrityLevel = InitiatingProcessIntegrityLevel,\n ActingProcessTokenElevation = InitiatingProcessTokenElevation,\n ActingProcessCreationTime = InitiatingProcessCreationTime\n | extend\n ActorUsernameType = _ASIM_GetUsernameType(ActorUsername),\n TargetUsernameType = _ASIM_GetUsernameType(TargetUsername)\n | extend // -- aliases\n User = coalesce(TargetUsername, ActorUsername),\n CommandLine = TargetProcessCommandLine,\n Process = TargetProcessName,\n Dvc = DvcHostname,\n AdditionalFields = todynamic(AdditionalFields)\n | project\n TimeGenerated,\n Type,\n EventUid,\n EventOriginalUid,\n EventCount,\n EventProduct,\n EventVendor,\n EventSchemaVersion,\n EventSchema,\n EventStartTime,\n EventEndTime,\n EventResult,\n ActorUsername,\n ActorUserIdType,\n TargetUserIdType,\n ActorUsernameType,\n TargetUsername,\n TargetUsernameType,\n ActorSessionId,\n TargetUserSessionId,\n Hash,\n TargetProcessId,\n ActingProcessId,\n ParentProcessId,\n DvcOs,\n HashType,\n DvcId,\n DvcHostname,\n DvcDomain,\n DvcDomainType,\n EventType,\n ActorUserId,\n ActorUserAadId,\n ActorUserUpn,\n TargetUserId,\n TargetUserAadId,\n TargetUserUpn,\n ParentProcessName,\n TargetProcessFilename,\n ParentProcessCreationTime,\n TargetProcessName,\n TargetProcessCommandLine,\n TargetProcessMD5,\n TargetProcessSHA1,\n TargetProcessSHA256,\n TargetProcessIntegrityLevel,\n TargetProcessTokenElevation,\n TargetProcessCreationTime,\n TargetProcessFileCompany,\n TargetProcessFileDescription,\n TargetProcessFileProduct,\n TargetProcessFileVersion,\n TargetProcessFileInternalName,\n TargetProcessFileOriginalName,\n TargetProcessFileSize,\n ActingProcessName,\n ActingProcessFilename,\n ActingProcessCommandLine,\n ActingProcessMD5,\n ActingProcessSHA1,\n ActingProcessSHA256,\n ActingProcessIntegrityLevel,\n ActingProcessTokenElevation,\n ActingProcessCreationTime,\n ActingProcessFileCompany,\n ActingProcessFileDescription,\n ActingProcessFileProduct,\n ActingProcessFileVersion,\n ActingProcessFileInternalName,\n ActingProcessFileOriginalName,\n ActingProcessFileSize,\n User,\n CommandLine,\n Process,\n Dvc,\n AdditionalFields\n };\n parser (disabled = disabled)", "version": 1, "functionParameters": "disabled:bool=False" } diff --git a/Parsers/ASimProcessEvent/ARM/ASimProcessEventNative/ASimProcessEventNative.json b/Parsers/ASimProcessEvent/ARM/ASimProcessEventNative/ASimProcessEventNative.json index 751593b4856..5a7ae9a1887 100644 --- a/Parsers/ASimProcessEvent/ARM/ASimProcessEventNative/ASimProcessEventNative.json +++ b/Parsers/ASimProcessEvent/ARM/ASimProcessEventNative/ASimProcessEventNative.json @@ -27,7 +27,7 @@ "displayName": "Process Event ASIM parser for Microsoft Sentinel native Process Event table", "category": "ASIM", "FunctionAlias": "ASimProcessEventNative", - "query": "let parser=(disabled: bool=false) {\n ASimProcessEventLogs \n | where not(disabled)\n | project-rename\n EventUid = _ItemId\n | extend \n EventSchema = \"ProcessEvent\",\n DvcScopeId = iff(isempty(DvcScopeId), _SubscriptionId, DvcScopeId)\n // -- Aliases\n | extend\n EventEndTime = iff (isnull(EventEndTime), TimeGenerated, EventEndTime),\n EventStartTime = iff (isnull(EventEndTime), TimeGenerated, EventStartTime),\n Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId),\n Rule = coalesce(RuleName, tostring(RuleNumber)),\n User = TargetUsername,\n Process = TargetProcessName,\n CommandLine = TargetProcessCommandLine,\n Hash = coalesce(TargetProcessSHA512, TargetProcessSHA256, TargetProcessMD5, TargetProcessSHA1, TargetProcessIMPHASH)\n | project-away\n TenantId,\n SourceSystem,\n _SubscriptionId,\n _ResourceId\n};\nparser (disabled=disabled)\n", + "query": "let parser=(disabled: bool=false) {\n ASimProcessEventLogs \n | where not(disabled)\n | project-rename\n EventUid = _ItemId\n | extend \n EventSchema = \"ProcessEvent\",\n RuleNumber = toint(RuleNumber),\n DvcScopeId = iff(isempty(DvcScopeId), _SubscriptionId, DvcScopeId)\n // -- Aliases\n | extend\n EventEndTime = iff (isnull(EventEndTime), TimeGenerated, EventEndTime),\n EventStartTime = iff (isnull(EventEndTime), TimeGenerated, EventStartTime),\n Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId),\n Rule = coalesce(RuleName, tostring(RuleNumber)),\n User = TargetUsername,\n Process = TargetProcessName,\n CommandLine = TargetProcessCommandLine,\n Hash = coalesce(TargetProcessSHA512, TargetProcessSHA256, TargetProcessMD5, TargetProcessSHA1, TargetProcessIMPHASH)\n | project-away\n TenantId,\n SourceSystem,\n _SubscriptionId,\n _ResourceId\n};\nparser (disabled=disabled)\n", "version": 1, "functionParameters": "disabled:bool=False" } diff --git a/Parsers/ASimProcessEvent/ARM/FullDeploymentProcessEvent.json b/Parsers/ASimProcessEvent/ARM/FullDeploymentProcessEvent.json index d4d8c82d8f6..0811caa3d4b 100644 --- a/Parsers/ASimProcessEvent/ARM/FullDeploymentProcessEvent.json +++ b/Parsers/ASimProcessEvent/ARM/FullDeploymentProcessEvent.json @@ -718,26 +718,6 @@ } } }, - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2020-10-01", - "name": "linkedvimProcessEventMD4IoT", - "properties": { - "mode": "Incremental", - "templateLink": { - "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimProcessEvent/ARM/vimProcessEventMD4IoT/vimProcessEventMD4IoT.json", - "contentVersion": "1.0.0.0" - }, - "parameters": { - "Workspace": { - "value": "[parameters('Workspace')]" - }, - "WorkspaceRegion": { - "value": "[parameters('WorkspaceRegion')]" - } - } - } - }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", diff --git a/Parsers/ASimProcessEvent/ARM/imProcessEvent/imProcessEvent.json b/Parsers/ASimProcessEvent/ARM/imProcessEvent/imProcessEvent.json index dcae1234192..21e169be661 100644 --- a/Parsers/ASimProcessEvent/ARM/imProcessEvent/imProcessEvent.json +++ b/Parsers/ASimProcessEvent/ARM/imProcessEvent/imProcessEvent.json @@ -27,7 +27,7 @@ "displayName": "Process Event filtering parser", "category": "ASIM", "FunctionAlias": "imProcessEvent", - "query": "let Generic=(starttime:datetime=datetime(null), endtime:datetime=datetime(null), commandline_has_any:dynamic=dynamic([]), commandline_has_all:dynamic=dynamic([]), commandline_has_any_ip_prefix:dynamic=dynamic([]), actingprocess_has_any:dynamic=dynamic([]), targetprocess_has_any:dynamic=dynamic([]), parentprocess_has_any:dynamic=dynamic([]), actorusername_has:string='*', targetusername_has:string='*', dvcipaddr_has_any_prefix:dynamic=dynamic([]), dvchostname_has_any:dynamic=dynamic([]), hashes_has_any:dynamic=dynamic([]), eventtype:string='*'){\nlet DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimProcess') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet imBuiltInDisabled=toscalar('ExcludevimProcessEventBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimProcessEmpty,\n vimProcessEventMicrosoft365D (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, (imBuiltInDisabled or ('ExcludevimProcessEventMicrosoft365D' in (DisabledParsers)))),\n vimProcessEventCreateMicrosoftSysmon (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessEventCreateMicrosoftSysmon' in (DisabledParsers)))),\n vimProcessEventCreateMicrosoftSysmonWindowsEvent (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessEventCreateMicrosoftSysmonWindowsEvent' in (DisabledParsers)))),\n vimProcessEventTerminateMicrosoftSysmon (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessEventTerminateMicrosoftSysmon' in (DisabledParsers)))),\n vimProcessEventTerminateMicrosoftSysmonWindowsEvent (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessEventTerminateMicrosoftSysmonWindowsEvent' in (DisabledParsers)))),\n vimProcessCreateMicrosoftSecurityEvents (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessCreateMicrosoftSecurityEvents' in (DisabledParsers)))),\n vimProcessTerminateMicrosoftSecurityEvents (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessTerminateMicrosoftSecurityEvents' in (DisabledParsers)))),\n vimProcessCreateLinuxSysmon (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessCreateLinuxSysmon' in (DisabledParsers)))),\n vimProcessTerminateLinuxSysmon (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessTerminateLinuxSysmon' in (DisabledParsers)))),\n vimProcessTerminateMicrosoftWindowsEvents (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessTerminateMicrosoftWindowsEvents' in (DisabledParsers)))),\n vimProcessCreateMicrosoftWindowsEvents (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, (imBuiltInDisabled or ('ExcludevimProcessCreateMicrosoftWindowsEvents' in (DisabledParsers)))),\n vimProcessCreateSentinelOne (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessCreateSentinelOne' in (DisabledParsers)))),\n vimProcessCreateMD4IoT (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessCreateMD4IoT' in (DisabledParsers)))),\n vimProcessTerminateMD4IoT (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessTerminateMD4IoT' in (DisabledParsers)))),\n vimProcessEventNative (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, actorusername_has=actorusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, (imBuiltInDisabled or ('ExcludevimProcessEventNative' in (DisabledParsers)))),\n vimProcessCreateSentinelOne (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, (imBuiltInDisabled or ('ExcludevimProcessCreateSentinelOne' in (DisabledParsers)))),\n vimProcessCreateVMwareCarbonBlackCloud (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessCreateVMwareCarbonBlackCloud' in (DisabledParsers)))),\n vimProcessTerminateVMwareCarbonBlackCloud (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessTerminateVMwareCarbonBlackCloud' in (DisabledParsers)))),\n vimProcessCreateTrendMicroVisionOne (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessCreateTrendMicroVisionOne' in (DisabledParsers)))),\n vimProcessEventCrowdStrikeFalconEndpointProtection (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, actorusername_has=actorusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, hashes_has_any=hashes_has_any, eventtype=eventtype, disabled=(imBuiltInDisabled or ('ExcludevimProcessEventCrowdStrikeFalconEndpointProtection' in (DisabledParsers))))\n};\nGeneric(starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any,actorusername_has=actorusername_has, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, hashes_has_any=hashes_has_any, eventtype=eventtype)\n", + "query": "let Generic=(starttime:datetime=datetime(null), endtime:datetime=datetime(null), commandline_has_any:dynamic=dynamic([]), commandline_has_all:dynamic=dynamic([]), commandline_has_any_ip_prefix:dynamic=dynamic([]), actingprocess_has_any:dynamic=dynamic([]), targetprocess_has_any:dynamic=dynamic([]), parentprocess_has_any:dynamic=dynamic([]), actorusername_has:string='*', targetusername_has:string='*', dvcipaddr_has_any_prefix:dynamic=dynamic([]), dvchostname_has_any:dynamic=dynamic([]), hashes_has_any:dynamic=dynamic([]), eventtype:string='*'){\nlet DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimProcess') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet imBuiltInDisabled=toscalar('ExcludevimProcessEventBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimProcessEmpty,\n vimProcessEventMicrosoft365D (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, actorusername_has=actorusername_has, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, (imBuiltInDisabled or ('ExcludevimProcessEventMicrosoft365D' in (DisabledParsers)))),\n vimProcessEventCreateMicrosoftSysmon (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessEventCreateMicrosoftSysmon' in (DisabledParsers)))),\n vimProcessEventCreateMicrosoftSysmonWindowsEvent (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessEventCreateMicrosoftSysmonWindowsEvent' in (DisabledParsers)))),\n vimProcessEventTerminateMicrosoftSysmon (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessEventTerminateMicrosoftSysmon' in (DisabledParsers)))),\n vimProcessEventTerminateMicrosoftSysmonWindowsEvent (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessEventTerminateMicrosoftSysmonWindowsEvent' in (DisabledParsers)))),\n vimProcessCreateMicrosoftSecurityEvents (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessCreateMicrosoftSecurityEvents' in (DisabledParsers)))),\n vimProcessTerminateMicrosoftSecurityEvents (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessTerminateMicrosoftSecurityEvents' in (DisabledParsers)))),\n vimProcessCreateLinuxSysmon (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessCreateLinuxSysmon' in (DisabledParsers)))),\n vimProcessTerminateLinuxSysmon (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessTerminateLinuxSysmon' in (DisabledParsers)))),\n vimProcessTerminateMicrosoftWindowsEvents (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessTerminateMicrosoftWindowsEvents' in (DisabledParsers)))),\n vimProcessCreateMicrosoftWindowsEvents (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, (imBuiltInDisabled or ('ExcludevimProcessCreateMicrosoftWindowsEvents' in (DisabledParsers)))),\n vimProcessCreateSentinelOne (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessCreateSentinelOne' in (DisabledParsers)))),\n vimProcessCreateMD4IoT (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessCreateMD4IoT' in (DisabledParsers)))),\n vimProcessTerminateMD4IoT (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessTerminateMD4IoT' in (DisabledParsers)))),\n vimProcessEventNative (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, actorusername_has=actorusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, (imBuiltInDisabled or ('ExcludevimProcessEventNative' in (DisabledParsers)))),\n vimProcessCreateSentinelOne (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, (imBuiltInDisabled or ('ExcludevimProcessCreateSentinelOne' in (DisabledParsers)))),\n vimProcessCreateVMwareCarbonBlackCloud (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessCreateVMwareCarbonBlackCloud' in (DisabledParsers)))),\n vimProcessTerminateVMwareCarbonBlackCloud (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessTerminateVMwareCarbonBlackCloud' in (DisabledParsers)))),\n vimProcessCreateTrendMicroVisionOne (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessCreateTrendMicroVisionOne' in (DisabledParsers)))),\n vimProcessEventCrowdStrikeFalconEndpointProtection (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, actorusername_has=actorusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, hashes_has_any=hashes_has_any, eventtype=eventtype, disabled=(imBuiltInDisabled or ('ExcludevimProcessEventCrowdStrikeFalconEndpointProtection' in (DisabledParsers))))\n};\nGeneric(starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any,actorusername_has=actorusername_has, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, hashes_has_any=hashes_has_any, eventtype=eventtype)\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),commandline_has_any:dynamic=dynamic([]),commandline_has_all:dynamic=dynamic([]),commandline_has_any_ip_prefix:dynamic=dynamic([]),actingprocess_has_any:dynamic=dynamic([]),targetprocess_has_any:dynamic=dynamic([]),parentprocess_has_any:dynamic=dynamic([]),actorusername_has:string='*',targetusername_has:string='*',dvcipaddr_has_any_prefix:dynamic=dynamic([]),dvchostname_has_any:dynamic=dynamic([]),hashes_has_any:dynamic=dynamic([]),eventtype:string='*'" } diff --git a/Parsers/ASimProcessEvent/ARM/vimProcessCreateMD4IoT/vimProcessCreateMD4IoT.json b/Parsers/ASimProcessEvent/ARM/vimProcessCreateMD4IoT/vimProcessCreateMD4IoT.json index 3efdeae7a31..a766535b0b3 100644 --- a/Parsers/ASimProcessEvent/ARM/vimProcessCreateMD4IoT/vimProcessCreateMD4IoT.json +++ b/Parsers/ASimProcessEvent/ARM/vimProcessCreateMD4IoT/vimProcessCreateMD4IoT.json @@ -27,7 +27,7 @@ "displayName": "Process Create Event ASIM parser for Microsoft Defender for IoT", "category": "ASIM", "FunctionAlias": "vimProcessCreateMD4IoT", - "query": "let ProcessEvents_MD4IoT=()\n{\n SecurityIoTRawEvent \n | where RawEventName == \"Process\" // TODO: exclude entries where segment EventType is \"EXIT\" by full segment structure\n // --------------------------------------------------------------------------------------\n | where\n (isnull(starttime) or TimeGenerated >= starttime )\n and (isnull(endtime) or TimeGenerated <= endtime )\n and not(disabled)\n and (array_length(dvcipaddr_has_any_prefix)==0)\n and (array_length(actingprocess_has_any)==0 ) \n and (array_length(parentprocess_has_any)==0) \n and (eventtype=='*' or eventtype=='ProcessCreated')\n and (array_length(commandline_has_any)==0 or EventDetails has_any (commandline_has_any)) \n and (array_length(commandline_has_all)==0 or EventDetails has_all (commandline_has_all)) \n and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(EventDetails, commandline_has_any_ip_prefix) ) \n and (array_length(targetprocess_has_any)==0 or EventDetails has_any (targetprocess_has_any)) \n and (targetusername_has=='*' or EventDetails has targetusername_has) \n and (array_length(dvchostname_has_any)==0 or DeviceId has_any (dvchostname_has_any)) \n // --------------------------------------------------------------------------------------\n | extend\n EventDetails = todynamic(EventDetails)\n | where EventDetails.EventType != 'EXIT' // TODO: move filter to prefiltering. see prev comment \n | extend // required for postfilterring\n TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), \n TargetProcessName = coalesce (tostring(EventDetails.Executable), split(EventDetails.Commandline,\" \")[0]),\n DvcOs = iif (EventDetails.MessageSource == \"Linux\", \"Linux\", \"Windows\") // Intermediate fix\n | extend \n TargetUsername = iff (DvcOs == \"Windows\", tostring(EventDetails.UserName), \"\")\n // --------------------------------------------------------------------------------------\n | where (array_length(commandline_has_any)==0 or TargetProcessCommandLine has_any (commandline_has_any)) \n and (array_length(commandline_has_all)==0 or TargetProcessCommandLine has_all (commandline_has_all)) \n and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(TargetProcessCommandLine, commandline_has_any_ip_prefix) ) \n and (array_length(targetprocess_has_any)==0 or TargetProcessName has_any (targetprocess_has_any)) \n and (targetusername_has=='*' or TargetUsername has targetusername_has) \n // --------------------------------------------------------------------------------------\n | extend\n EventOriginalUid = tostring(EventDetails.OriginalEventId), \n EventCount = toint(EventDetails.HitCount), \n EventProduct = 'Azure Defender for IoT', \n EventVendor = 'Microsoft', \n EventSchemaVersion = '0.1.0', \n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(EventDetails.TimestampUTC), \n EventEndTime = todatetime(TimeGenerated), \n EventType = 'ProcessCreated', \n EventSubType = tostring(EventDetails.EventType),\n EventResult = 'Success', \n TargetProcessId = tostring(EventDetails.ProcessId), \n TargetUsernameType = iif (DvcOs == \"Windows\", \"Windows\", \"Simple\"), \n ActingProcessId = iff (DvcOs == \"Windows\", tostring(EventDetails.ParentProcessId), \"\") \n | project-rename\n DvcHostname = DeviceId,\n EventProductVersion = AgentVersion, \n _ResourceId = AssociatedResourceId, \n _SubscriptionId = AzureSubscriptionId \n | extend \n // -- aliases\n User = TargetUsername, \n CommandLine = TargetProcessCommandLine, \n Process = TargetProcessName, \n Dvc = DvcHostname \n };\n ProcessEvents_MD4IoT\n", + "query": "let ProcessEvents_MD4IoT=()\n{\n SecurityIoTRawEvent \n | where RawEventName == \"Process\" // TODO: exclude entries where segment EventType is \"EXIT\" by full segment structure\n // --------------------------------------------------------------------------------------\n | where\n (isnull(starttime) or TimeGenerated >= starttime )\n and (isnull(endtime) or TimeGenerated <= endtime )\n and not(disabled)\n and (array_length(dvcipaddr_has_any_prefix)==0)\n and (array_length(actingprocess_has_any)==0 ) \n and (array_length(parentprocess_has_any)==0) \n and (eventtype=='*' or eventtype=='ProcessCreated')\n and (array_length(commandline_has_any)==0 or EventDetails has_any (commandline_has_any)) \n and (array_length(commandline_has_all)==0 or EventDetails has_all (commandline_has_all)) \n and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(EventDetails, commandline_has_any_ip_prefix) ) \n and (array_length(targetprocess_has_any)==0 or EventDetails has_any (targetprocess_has_any)) \n and (targetusername_has=='*' or EventDetails has targetusername_has) \n and (array_length(dvchostname_has_any)==0 or DeviceId has_any (dvchostname_has_any)) \n // --------------------------------------------------------------------------------------\n | extend\n EventDetails = todynamic(EventDetails)\n | where EventDetails.EventType != 'EXIT' // TODO: move filter to prefiltering. see prev comment \n | extend // required for postfilterring\n TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), \n TargetProcessName = coalesce (tostring(EventDetails.Executable), tostring(split(EventDetails.Commandline,\" \")[0])),\n DvcOs = iif (EventDetails.MessageSource == \"Linux\", \"Linux\", \"Windows\") // Intermediate fix\n | extend \n TargetUsername = iff (DvcOs == \"Windows\", tostring(EventDetails.UserName), \"\")\n // --------------------------------------------------------------------------------------\n | where (array_length(commandline_has_any)==0 or TargetProcessCommandLine has_any (commandline_has_any)) \n and (array_length(commandline_has_all)==0 or TargetProcessCommandLine has_all (commandline_has_all)) \n and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(TargetProcessCommandLine, commandline_has_any_ip_prefix) ) \n and (array_length(targetprocess_has_any)==0 or TargetProcessName has_any (targetprocess_has_any)) \n and (targetusername_has=='*' or TargetUsername has targetusername_has) \n // --------------------------------------------------------------------------------------\n | extend\n EventOriginalUid = tostring(EventDetails.OriginalEventId), \n EventCount = toint(EventDetails.HitCount), \n EventProduct = 'Azure Defender for IoT', \n EventVendor = 'Microsoft', \n EventSchemaVersion = '0.1.0', \n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(EventDetails.TimestampUTC), \n EventEndTime = todatetime(TimeGenerated), \n EventType = 'ProcessCreated', \n EventSubType = tostring(EventDetails.EventType),\n EventResult = 'Success', \n TargetProcessId = tostring(EventDetails.ProcessId), \n TargetUsernameType = iif (DvcOs == \"Windows\", \"Windows\", \"Simple\"), \n ActingProcessId = iff (DvcOs == \"Windows\", tostring(EventDetails.ParentProcessId), \"\") \n | project-rename\n DvcHostname = DeviceId,\n EventProductVersion = AgentVersion, \n _ResourceId = AssociatedResourceId, \n _SubscriptionId = AzureSubscriptionId \n | extend \n // -- aliases\n User = TargetUsername, \n CommandLine = TargetProcessCommandLine, \n Process = TargetProcessName, \n Dvc = DvcHostname \n };\n ProcessEvents_MD4IoT\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),commandline_has_any:dynamic=dynamic([]),commandline_has_all:dynamic=dynamic([]),commandline_has_any_ip_prefix:dynamic=dynamic([]),actingprocess_has_any:dynamic=dynamic([]),targetprocess_has_any:dynamic=dynamic([]),parentprocess_has_any:dynamic=dynamic([]),targetusername_has:string='*',dvcipaddr_has_any_prefix:dynamic=dynamic([]),dvchostname_has_any:dynamic=dynamic([]),eventtype:string='*',disabled:bool=False" } diff --git a/Parsers/ASimProcessEvent/ARM/vimProcessEventMD4IoT/README.md b/Parsers/ASimProcessEvent/ARM/vimProcessEventMD4IoT/README.md deleted file mode 100644 index b2b3635b974..00000000000 --- a/Parsers/ASimProcessEvent/ARM/vimProcessEventMD4IoT/README.md +++ /dev/null @@ -1,21 +0,0 @@ -# Microsoft Defender for IoT ASIM ProcessEvent Normalization Parser - -ARM template for ASIM ProcessEvent schema parser for Microsoft Defender for IoT. - -This ASIM parser supports normalizing Microsoft Defender for IoT events to the ASIM Process Event normalized schema. - - -The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace. - -For more information, see: - -- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM) -- [Deploy all of ASIM](https://aka.ms/DeployASIM) -- [ASIM ProcessEvent normalization schema reference](https://aka.ms/ASimProcessEventDoc) - -For the changelog, see: -- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventMD4IoT.md) - -
- -[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimProcessEvent%2FARM%2FvimProcessEventMD4IoT%2FvimProcessEventMD4IoT.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimProcessEvent%2FARM%2FvimProcessEventMD4IoT%2FvimProcessEventMD4IoT.json) diff --git a/Parsers/ASimProcessEvent/ARM/vimProcessEventMD4IoT/vimProcessEventMD4IoT.json b/Parsers/ASimProcessEvent/ARM/vimProcessEventMD4IoT/vimProcessEventMD4IoT.json deleted file mode 100644 index 36acae4013d..00000000000 --- a/Parsers/ASimProcessEvent/ARM/vimProcessEventMD4IoT/vimProcessEventMD4IoT.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "Workspace": { - "type": "string", - "metadata": { - "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group." - } - }, - "WorkspaceRegion": { - "type": "string", - "defaultValue": "[resourceGroup().location]", - "metadata": { - "description": "The region of the selected workspace. The default value will use the Region selection above." - } - } - }, - "resources": [ - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2020-08-01", - "name": "[concat(parameters('Workspace'), '/vimProcessEventMD4IoT')]", - "location": "[parameters('WorkspaceRegion')]", - "properties": { - "etag": "*", - "displayName": "Process Create Event ASIM parser for Microsoft Defender for IoT", - "category": "ASIM", - "FunctionAlias": "vimProcessEventMD4IoT", - "query": "let ProcessEvents_MD4IoT=()\n{\n SecurityIoTRawEvent \n | where RawEventName == \"Process\" \n // --------------------------------------------------------------------------------------\n | where\n (isnull(starttime) or TimeGenerated >= starttime )\n and (isnull(endtime) or TimeGenerated <= endtime )\n and not(disabled)\n and (array_length(dvcipaddr_has_any_prefix)==0)\n and (array_length(actingprocess_has_any)==0 ) \n and (array_length(parentprocess_has_any)==0) \n and (eventtype=='*' or eventtype=='ProcessCreated')\n and (array_length(commandline_has_any)==0 or EventDetails has_any (commandline_has_any)) \n and (array_length(commandline_has_all)==0 or EventDetails has_all (commandline_has_all)) \n and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(EventDetails, commandline_has_any_ip_prefix) ) \n and (array_length(targetprocess_has_any)==0 or EventDetails has_any (targetprocess_has_any)) \n and (targetusername_has=='*' or EventDetails has targetusername_has) \n and (array_length(dvchostname_has_any)==0 or DeviceId has_any (dvchostname_has_any)) \n // --------------------------------------------------------------------------------------\n | extend\n EventDetails = todynamic(EventDetails)\n | extend // required for postfilterring\n TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), \n TargetProcessName = coalesce (tostring(EventDetails.Executable), split(EventDetails.Commandline,\" \")[0]),\n DvcOs = iif (EventDetails.MessageSource == \"Linux\", \"Linux\", \"Windows\") // Intermediate fix\n | extend \n TargetUsername = iff (DvcOs == \"Windows\", tostring(EventDetails.UserName), \"\")\n // --------------------------------------------------------------------------------------\n | where (array_length(commandline_has_any)==0 or TargetProcessCommandLine has_any (commandline_has_any)) \n and (array_length(commandline_has_all)==0 or TargetProcessCommandLine has_all (commandline_has_all)) \n and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(TargetProcessCommandLine, commandline_has_any_ip_prefix) ) \n and (array_length(targetprocess_has_any)==0 or TargetProcessName has_any (targetprocess_has_any)) \n and (targetusername_has=='*' or TargetUsername has targetusername_has) \n // --------------------------------------------------------------------------------------\n | extend\n EventOriginalUid = tostring(EventDetails.OriginalEventId), \n EventCount = toint(EventDetails.HitCount), \n EventProduct = 'Azure Defender for IoT', \n EventVendor = 'Microsoft', \n EventSchemaVersion = '0.1.0', \n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(EventDetails.TimestampUTC), \n EventEndTime = todatetime(TimeGenerated), \n EventType = iff (EventDetails.EventType == 'EXIT', 'ProcessTerminate', 'ProcessCreated'), \n EventSubType = tostring(EventDetails.EventType),\n EventResult = 'Success', \n TargetProcessId = tostring(EventDetails.ProcessId), \n TargetUsernameType = iif (DvcOs == \"Windows\", \"Windows\", \"Simple\"), \n ActingProcessId = iff (DvcOs == \"Windows\", tostring(EventDetails.ParentProcessId), \"\") \n | project-rename\n DvcHostname = DeviceId,\n EventProductVersion = AgentVersion, // Not available in Windows\n _ResourceId = AssociatedResourceId, \n _SubscriptionId = AzureSubscriptionId \n | extend \n // -- aliases\n User = TargetUsername, \n CommandLine = TargetProcessCommandLine, \n Process = TargetProcessName, \n Dvc = DvcHostname \n };\n ProcessEvents_MD4IoT\n", - "version": 1, - "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),commandline_has_any:dynamic=dynamic([]),commandline_has_all:dynamic=dynamic([]),commandline_has_any_ip_prefix:dynamic=dynamic([]),actingprocess_has_any:dynamic=dynamic([]),targetprocess_has_any:dynamic=dynamic([]),parentprocess_has_any:dynamic=dynamic([]),targetusername_has:string='*',dvcipaddr_has_any_prefix:dynamic=dynamic([]),dvchostname_has_any:dynamic=dynamic([]),eventtype:string='*',disabled:bool=False" - } - } - ] -} \ No newline at end of file diff --git a/Parsers/ASimProcessEvent/ARM/vimProcessEventMicrosoft365D/vimProcessEventMicrosoft365D.json b/Parsers/ASimProcessEvent/ARM/vimProcessEventMicrosoft365D/vimProcessEventMicrosoft365D.json index 2e8027bcac8..0f82a1acf5a 100644 --- a/Parsers/ASimProcessEvent/ARM/vimProcessEventMicrosoft365D/vimProcessEventMicrosoft365D.json +++ b/Parsers/ASimProcessEvent/ARM/vimProcessEventMicrosoft365D/vimProcessEventMicrosoft365D.json @@ -27,9 +27,9 @@ "displayName": "Process Create Event ASIM parser for Microsoft 365 Defender for endpoint", "category": "ASIM", "FunctionAlias": "vimProcessEventMicrosoft365D", - "query": "let parser = (\n starttime:datetime=datetime(null),\n endtime:datetime=datetime(null),\n commandline_has_any:dynamic=dynamic([]),\n commandline_has_all:dynamic=dynamic([]),\n commandline_has_any_ip_prefix:dynamic=dynamic([]),\n actingprocess_has_any:dynamic=dynamic([]),\n targetprocess_has_any:dynamic=dynamic([]),\n parentprocess_has_any:dynamic=dynamic([]),\n targetusername_has:string='*',\n dvcipaddr_has_any_prefix:dynamic=dynamic([]),\n dvchostname_has_any:dynamic=dynamic([]),\n eventtype:string='*',\n hashes_has_any:dynamic=dynamic([]),\n disabled:bool=false\n ) {\n DeviceProcessEvents \n // -- pre-filtering\n | where\n (isnull(starttime) or TimeGenerated >= starttime )\n and (isnull(endtime) or TimeGenerated <= endtime )\n and not(disabled)\n and (array_length(dvcipaddr_has_any_prefix)==0)\n and (array_length(commandline_has_all)==0 or ProcessCommandLine has_all (commandline_has_all)) \n and (array_length(commandline_has_any)==0 or ProcessCommandLine has_any (commandline_has_any)) \n and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(ProcessCommandLine, commandline_has_any_ip_prefix) ) \n and (array_length(actingprocess_has_any)==0 or InitiatingProcessFolderPath has_any (actingprocess_has_any)) \n and (array_length(targetprocess_has_any)==0 or FolderPath has_any (targetprocess_has_any)) \n and (array_length(parentprocess_has_any)==0 or InitiatingProcessParentFileName has_any (parentprocess_has_any)) \n and (targetusername_has=='*' or AccountName has targetusername_has or AccountDomain has targetusername_has) \n and (array_length(dvchostname_has_any)==0 or DeviceName has_any (dvchostname_has_any)) \n and (array_length(hashes_has_any)==0 or SHA256 in (hashes_has_any) or SHA1 in (hashes_has_any) or MD5 in (hashes_has_any))\n and (eventtype=='*' or eventtype=='ProcessCreated')\n | extend\n Type = \"DeviceProcessEvents\",\n EventOriginalUid = tostring(ReportId),\n EventCount = int(1),\n EventProduct = 'M365 Defender for Endpoint',\n EventVendor = 'Microsoft',\n EventSchemaVersion = '0.1.4',\n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(Timestamp),\n EventEndTime = todatetime(Timestamp),\n EventResult = 'Success'\n | extend\n EventUid = EventOriginalUid,\n ActorUsername = iff (InitiatingProcessAccountDomain == '', InitiatingProcessAccountName, strcat(InitiatingProcessAccountDomain, '\\\\', InitiatingProcessAccountName)),\n TargetUsername = iff (AccountDomain == '', AccountName, strcat(AccountDomain, '\\\\', AccountName)),\n TargetUsernameType = iff(AccountDomain == '','Simple', 'Windows'),\n ActorUsernameType = iff(InitiatingProcessAccountDomain == '','Simple', 'Windows'),\n ActorUserIdType = 'SID',\n TargetUserIdType = 'SID',\n ActorSessionId = tostring(InitiatingProcessLogonId),\n TargetUserSessionId = tostring(LogonId),\n Hash = coalesce (SHA256, SHA1, MD5, \"\"),\n TargetProcessId = tostring(ProcessId),\n ActingProcessId = tostring(InitiatingProcessId),\n ParentProcessId = tostring(InitiatingProcessParentId),\n DvcOs = iff (AdditionalFields has \"ProcessPosixProcessGroupId\", \"Linux\", \"Windows\"),\n TargetProcessFileSize = iif(FileSize != 0, FileSize, dynamic(null)),\n ActingProcessFileSize = iif(InitiatingProcessFileSize != 0, InitiatingProcessFileSize, dynamic(null))\n | extend\n HashType = tostring(dynamic([\"SHA256\", \"SHA1\", \"MD5\"])[array_index_of(pack_array(SHA256, SHA1, MD5),Hash)])\n | invoke _ASIM_ResolveDvcFQDN('DeviceName')\n | project-rename\n DvcId = DeviceId,\n EventType = ActionType,\n ActorUserId = InitiatingProcessAccountSid,\n ActorUserAadId = InitiatingProcessAccountObjectId,\n ActorUserUpn = InitiatingProcessAccountUpn,\n TargetUserId = AccountSid,\n TargetUserAadId = AccountObjectId,\n TargetUserUpn = AccountUpn,\n ParentProcessName = InitiatingProcessParentFileName,\n TargetProcessFilename = FileName,\n TargetProcessFileCompany = ProcessVersionInfoCompanyName,\n TargetProcessFileDescription = ProcessVersionInfoFileDescription,\n TargetProcessFileProduct = ProcessVersionInfoProductName,\n TargetProcessFileVersion = ProcessVersionInfoProductVersion,\n TargetProcessFileInternalName = ProcessVersionInfoInternalFileName,\n TargetProcessFileOriginalName = ProcessVersionInfoOriginalFileName,\n ParentProcessCreationTime = InitiatingProcessParentCreationTime,\n TargetProcessName = FolderPath,\n TargetProcessCommandLine = ProcessCommandLine,\n TargetProcessMD5 = MD5,\n TargetProcessSHA1 = SHA1,\n TargetProcessSHA256 = SHA256,\n TargetProcessIntegrityLevel = ProcessIntegrityLevel,\n TargetProcessTokenElevation = ProcessTokenElevation,\n TargetProcessCreationTime = ProcessCreationTime,\n ActingProcessName = InitiatingProcessFolderPath, \n ActingProcessFilename = InitiatingProcessFileName,\n ActingProcessFileCompany = InitiatingProcessVersionInfoCompanyName,\n ActingProcessFileDescription = InitiatingProcessVersionInfoFileDescription,\n ActingProcessFileProduct = InitiatingProcessVersionInfoProductName,\n ActingProcessFileVersion = InitiatingProcessVersionInfoProductVersion,\n ActingProcessFileInternalName = InitiatingProcessVersionInfoInternalFileName,\n ActingProcessFileOriginalName = InitiatingProcessVersionInfoOriginalFileName,\n ActingProcessCommandLine = InitiatingProcessCommandLine, \n ActingProcessMD5 = InitiatingProcessMD5, \n ActingProcessSHA1 = InitiatingProcessSHA1, \n ActingProcessSHA256 = InitiatingProcessSHA256, \n ActingProcessIntegrityLevel = InitiatingProcessIntegrityLevel,\n ActingProcessTokenElevation = InitiatingProcessTokenElevation,\n ActingProcessCreationTime = InitiatingProcessCreationTime\n | extend\n ActorUsernameType = _ASIM_GetUsernameType(ActorUsername),\n TargetUsernameType = _ASIM_GetUsernameType(TargetUsername)\n | extend // -- aliases\n User = coalesce(TargetUsername, ActorUsername),\n CommandLine = TargetProcessCommandLine,\n Process = TargetProcessName,\n Dvc = DvcHostname\n | project\n TimeGenerated,\n Type,\n EventUid,\n EventOriginalUid,\n EventCount,\n EventProduct,\n EventVendor,\n EventSchemaVersion,\n EventSchema,\n EventStartTime,\n EventEndTime,\n EventResult,\n ActorUsername,\n ActorUserIdType,\n TargetUserIdType,\n ActorUsernameType,\n TargetUsername,\n TargetUsernameType,\n ActorSessionId,\n TargetUserSessionId,\n Hash,\n TargetProcessId,\n ActingProcessId,\n ParentProcessId,\n DvcOs,\n HashType,\n DvcId,\n DvcHostname,\n DvcDomain,\n DvcDomainType,\n EventType,\n ActorUserId,\n ActorUserAadId,\n ActorUserUpn,\n TargetUserId,\n TargetUserAadId,\n TargetUserUpn,\n ParentProcessName,\n TargetProcessFilename,\n ParentProcessCreationTime,\n TargetProcessName,\n TargetProcessCommandLine,\n TargetProcessMD5,\n TargetProcessSHA1,\n TargetProcessSHA256,\n TargetProcessIntegrityLevel,\n TargetProcessTokenElevation,\n TargetProcessCreationTime,\n TargetProcessFileCompany,\n TargetProcessFileDescription,\n TargetProcessFileProduct,\n TargetProcessFileVersion,\n TargetProcessFileInternalName,\n TargetProcessFileOriginalName,\n TargetProcessFileSize,\n ActingProcessName,\n ActingProcessFilename,\n ActingProcessCommandLine,\n ActingProcessMD5,\n ActingProcessSHA1,\n ActingProcessSHA256,\n ActingProcessIntegrityLevel,\n ActingProcessTokenElevation,\n ActingProcessCreationTime,\n ActingProcessFileCompany,\n ActingProcessFileDescription,\n ActingProcessFileProduct,\n ActingProcessFileVersion,\n ActingProcessFileInternalName,\n ActingProcessFileOriginalName,\n ActingProcessFileSize,\n User,\n CommandLine,\n Process,\n Dvc,\n AdditionalFields\n };\n parser (\n starttime=starttime, \n endtime=endtime, \n commandline_has_any=commandline_has_any,\n commandline_has_all=commandline_has_all,\n commandline_has_any_ip_prefix=commandline_has_any_ip_prefix,\n actingprocess_has_any=actingprocess_has_any,\n targetprocess_has_any=targetprocess_has_any,\n parentprocess_has_any=parentprocess_has_any,\n targetusername_has=targetusername_has,\n dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix,\n dvchostname_has_any=dvchostname_has_any,\n eventtype=eventtype,\n hashes_has_any=hashes_has_any,\n disabled=disabled\n)", + "query": "let parser = (\n starttime:datetime=datetime(null),\n endtime:datetime=datetime(null),\n commandline_has_any:dynamic=dynamic([]),\n commandline_has_all:dynamic=dynamic([]),\n commandline_has_any_ip_prefix:dynamic=dynamic([]),\n actingprocess_has_any:dynamic=dynamic([]),\n targetprocess_has_any:dynamic=dynamic([]),\n parentprocess_has_any:dynamic=dynamic([]),\n targetusername_has:string='*',\n actorusername_has:string='*',\n dvcipaddr_has_any_prefix:dynamic=dynamic([]),\n dvchostname_has_any:dynamic=dynamic([]),\n eventtype:string='*',\n hashes_has_any:dynamic=dynamic([]),\n disabled:bool=false\n ) {\n DeviceProcessEvents \n // -- pre-filtering\n | where\n (isnull(starttime) or TimeGenerated >= starttime )\n and (isnull(endtime) or TimeGenerated <= endtime )\n and not(disabled)\n and (array_length(dvcipaddr_has_any_prefix)==0)\n and (array_length(commandline_has_all)==0 or ProcessCommandLine has_all (commandline_has_all)) \n and (array_length(commandline_has_any)==0 or ProcessCommandLine has_any (commandline_has_any)) \n and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(ProcessCommandLine, commandline_has_any_ip_prefix) ) \n and (array_length(actingprocess_has_any)==0 or InitiatingProcessFolderPath has_any (actingprocess_has_any)) \n and (array_length(targetprocess_has_any)==0 or FolderPath has_any (targetprocess_has_any)) \n and (array_length(parentprocess_has_any)==0 or InitiatingProcessParentFileName has_any (parentprocess_has_any)) \n and (targetusername_has=='*' or AccountName has targetusername_has or AccountDomain has targetusername_has)\n and (actorusername_has=='* or or InitiatingProcessAccountName has actorusername_has or InitiatingProcessAccountDomain has actorusername_has)\n and (array_length(dvchostname_has_any)==0 or DeviceName has_any (dvchostname_has_any)) \n and (array_length(hashes_has_any)==0 or SHA256 in (hashes_has_any) or SHA1 in (hashes_has_any) or MD5 in (hashes_has_any))\n and (eventtype=='*' or eventtype=='ProcessCreated')\n | extend\n Type = \"DeviceProcessEvents\",\n EventOriginalUid = tostring(ReportId),\n EventCount = int(1),\n EventProduct = 'M365 Defender for Endpoint',\n EventVendor = 'Microsoft',\n EventSchemaVersion = '0.1.4',\n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(Timestamp),\n EventEndTime = todatetime(Timestamp),\n EventResult = 'Success'\n | extend\n EventUid = EventOriginalUid,\n ActorUsername = iff (InitiatingProcessAccountDomain == '', InitiatingProcessAccountName, strcat(InitiatingProcessAccountDomain, '\\\\', InitiatingProcessAccountName)),\n TargetUsername = iff (AccountDomain == '', AccountName, strcat(AccountDomain, '\\\\', AccountName)),\n TargetUsernameType = iff(AccountDomain == '','Simple', 'Windows'),\n ActorUsernameType = iff(InitiatingProcessAccountDomain == '','Simple', 'Windows'),\n ActorUserIdType = 'SID',\n TargetUserIdType = 'SID',\n ActorSessionId = tostring(InitiatingProcessLogonId),\n TargetUserSessionId = tostring(LogonId),\n Hash = coalesce (SHA256, SHA1, MD5, \"\"),\n TargetProcessId = tostring(ProcessId),\n ActingProcessId = tostring(InitiatingProcessId),\n ParentProcessId = tostring(InitiatingProcessParentId),\n DvcOs = iff (AdditionalFields has \"ProcessPosixProcessGroupId\", \"Linux\", \"Windows\"),\n TargetProcessFileSize = iif(FileSize != 0, FileSize, dynamic(null)),\n ActingProcessFileSize = iif(InitiatingProcessFileSize != 0, InitiatingProcessFileSize, dynamic(null))\n | extend\n HashType = tostring(dynamic([\"SHA256\", \"SHA1\", \"MD5\"])[array_index_of(pack_array(SHA256, SHA1, MD5),Hash)])\n | invoke _ASIM_ResolveDvcFQDN('DeviceName')\n | project-rename\n DvcId = DeviceId,\n EventType = ActionType,\n ActorUserId = InitiatingProcessAccountSid,\n ActorUserAadId = InitiatingProcessAccountObjectId,\n ActorUserUpn = InitiatingProcessAccountUpn,\n TargetUserId = AccountSid,\n TargetUserAadId = AccountObjectId,\n TargetUserUpn = AccountUpn,\n ParentProcessName = InitiatingProcessParentFileName,\n TargetProcessFilename = FileName,\n TargetProcessFileCompany = ProcessVersionInfoCompanyName,\n TargetProcessFileDescription = ProcessVersionInfoFileDescription,\n TargetProcessFileProduct = ProcessVersionInfoProductName,\n TargetProcessFileVersion = ProcessVersionInfoProductVersion,\n TargetProcessFileInternalName = ProcessVersionInfoInternalFileName,\n TargetProcessFileOriginalName = ProcessVersionInfoOriginalFileName,\n ParentProcessCreationTime = InitiatingProcessParentCreationTime,\n TargetProcessName = FolderPath,\n TargetProcessCommandLine = ProcessCommandLine,\n TargetProcessMD5 = MD5,\n TargetProcessSHA1 = SHA1,\n TargetProcessSHA256 = SHA256,\n TargetProcessIntegrityLevel = ProcessIntegrityLevel,\n TargetProcessTokenElevation = ProcessTokenElevation,\n TargetProcessCreationTime = ProcessCreationTime,\n ActingProcessName = InitiatingProcessFolderPath, \n ActingProcessFilename = InitiatingProcessFileName,\n ActingProcessFileCompany = InitiatingProcessVersionInfoCompanyName,\n ActingProcessFileDescription = InitiatingProcessVersionInfoFileDescription,\n ActingProcessFileProduct = InitiatingProcessVersionInfoProductName,\n ActingProcessFileVersion = InitiatingProcessVersionInfoProductVersion,\n ActingProcessFileInternalName = InitiatingProcessVersionInfoInternalFileName,\n ActingProcessFileOriginalName = InitiatingProcessVersionInfoOriginalFileName,\n ActingProcessCommandLine = InitiatingProcessCommandLine, \n ActingProcessMD5 = InitiatingProcessMD5, \n ActingProcessSHA1 = InitiatingProcessSHA1, \n ActingProcessSHA256 = InitiatingProcessSHA256, \n ActingProcessIntegrityLevel = InitiatingProcessIntegrityLevel,\n ActingProcessTokenElevation = InitiatingProcessTokenElevation,\n ActingProcessCreationTime = InitiatingProcessCreationTime\n | extend\n ActorUsernameType = _ASIM_GetUsernameType(ActorUsername),\n TargetUsernameType = _ASIM_GetUsernameType(TargetUsername)\n | extend // -- aliases\n User = coalesce(TargetUsername, ActorUsername),\n CommandLine = TargetProcessCommandLine,\n Process = TargetProcessName,\n Dvc = DvcHostname,\n AdditionalFields = todynamic(AdditionalFields)\n | project\n TimeGenerated,\n Type,\n EventUid,\n EventOriginalUid,\n EventCount,\n EventProduct,\n EventVendor,\n EventSchemaVersion,\n EventSchema,\n EventStartTime,\n EventEndTime,\n EventResult,\n ActorUsername,\n ActorUserIdType,\n TargetUserIdType,\n ActorUsernameType,\n TargetUsername,\n TargetUsernameType,\n ActorSessionId,\n TargetUserSessionId,\n Hash,\n TargetProcessId,\n ActingProcessId,\n ParentProcessId,\n DvcOs,\n HashType,\n DvcId,\n DvcHostname,\n DvcDomain,\n DvcDomainType,\n EventType,\n ActorUserId,\n ActorUserAadId,\n ActorUserUpn,\n TargetUserId,\n TargetUserAadId,\n TargetUserUpn,\n ParentProcessName,\n TargetProcessFilename,\n ParentProcessCreationTime,\n TargetProcessName,\n TargetProcessCommandLine,\n TargetProcessMD5,\n TargetProcessSHA1,\n TargetProcessSHA256,\n TargetProcessIntegrityLevel,\n TargetProcessTokenElevation,\n TargetProcessCreationTime,\n TargetProcessFileCompany,\n TargetProcessFileDescription,\n TargetProcessFileProduct,\n TargetProcessFileVersion,\n TargetProcessFileInternalName,\n TargetProcessFileOriginalName,\n TargetProcessFileSize,\n ActingProcessName,\n ActingProcessFilename,\n ActingProcessCommandLine,\n ActingProcessMD5,\n ActingProcessSHA1,\n ActingProcessSHA256,\n ActingProcessIntegrityLevel,\n ActingProcessTokenElevation,\n ActingProcessCreationTime,\n ActingProcessFileCompany,\n ActingProcessFileDescription,\n ActingProcessFileProduct,\n ActingProcessFileVersion,\n ActingProcessFileInternalName,\n ActingProcessFileOriginalName,\n ActingProcessFileSize,\n User,\n CommandLine,\n Process,\n Dvc,\n AdditionalFields\n };\n parser (\n starttime=starttime, \n endtime=endtime, \n commandline_has_any=commandline_has_any,\n commandline_has_all=commandline_has_all,\n commandline_has_any_ip_prefix=commandline_has_any_ip_prefix,\n actingprocess_has_any=actingprocess_has_any,\n targetprocess_has_any=targetprocess_has_any,\n parentprocess_has_any=parentprocess_has_any,\n targetusername_has=targetusername_has,\n dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix,\n dvchostname_has_any=dvchostname_has_any,\n eventtype=eventtype,\n hashes_has_any=hashes_has_any,\n disabled=disabled\n)", "version": 1, - "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),commandline_has_any:dynamic=dynamic([]),commandline_has_all:dynamic=dynamic([]),commandline_has_any_ip_prefix:dynamic=dynamic([]),actingprocess_has_any:dynamic=dynamic([]),targetprocess_has_any:dynamic=dynamic([]),parentprocess_has_any:dynamic=dynamic([]),targetusername_has:string='*',dvcipaddr_has_any_prefix:dynamic=dynamic([]),dvchostname_has_any:dynamic=dynamic([]),eventtype:string='*',hashes_has_any:dynamic=dynamic([]),disabled:bool=False" + "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),commandline_has_any:dynamic=dynamic([]),commandline_has_all:dynamic=dynamic([]),commandline_has_any_ip_prefix:dynamic=dynamic([]),actingprocess_has_any:dynamic=dynamic([]),targetprocess_has_any:dynamic=dynamic([]),parentprocess_has_any:dynamic=dynamic([]),targetusername_has:string='*',actorusername_has:string='*',dvcipaddr_has_any_prefix:dynamic=dynamic([]),dvchostname_has_any:dynamic=dynamic([]),hashes_has_any:dynamic=dynamic([]),eventtype:string='*',disabled:bool=False" } } ] diff --git a/Parsers/ASimProcessEvent/ARM/vimProcessEventNative/vimProcessEventNative.json b/Parsers/ASimProcessEvent/ARM/vimProcessEventNative/vimProcessEventNative.json index be4b486194f..4cb1f214d03 100644 --- a/Parsers/ASimProcessEvent/ARM/vimProcessEventNative/vimProcessEventNative.json +++ b/Parsers/ASimProcessEvent/ARM/vimProcessEventNative/vimProcessEventNative.json @@ -27,7 +27,7 @@ "displayName": "Process Event ASIM filtering parser for Microsoft Sentinel native Process Event table", "category": "ASIM", "FunctionAlias": "vimProcessEventNative", - "query": "let parser = (\n starttime: datetime=datetime(null),\n endtime: datetime=datetime(null),\n commandline_has_any: dynamic=dynamic([]),\n commandline_has_all: dynamic=dynamic([]),\n commandline_has_any_ip_prefix: dynamic=dynamic([]),\n actingprocess_has_any: dynamic=dynamic([]),\n targetprocess_has_any: dynamic=dynamic([]),\n parentprocess_has_any: dynamic=dynamic([]),\n targetusername_has: string='*',\n actorusername_has: string='*',\n dvcipaddr_has_any_prefix: dynamic=dynamic([]),\n dvchostname_has_any: dynamic=dynamic([]),\n eventtype: string='*',\n hashes_has_any: dynamic=dynamic([]),\n disabled: bool=false\n ) {\n ASimProcessEventLogs \n | where not(disabled)\n | where (isnull(starttime) or TimeGenerated >= starttime)\n and (isnull(endtime) or TimeGenerated <= endtime)\n and (array_length(dvcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(DvcIpAddr, dvcipaddr_has_any_prefix))\n and (array_length(commandline_has_all) == 0 or TargetProcessCommandLine has_all (commandline_has_all)) \n and (array_length(commandline_has_any) == 0 or TargetProcessCommandLine has_any (commandline_has_any)) \n and (array_length(commandline_has_any_ip_prefix) == 0 or has_any_ipv4_prefix(TargetProcessCommandLine, commandline_has_any_ip_prefix)) \n and (array_length(actingprocess_has_any) == 0 or ActingProcessName has_any (actingprocess_has_any)) \n and (array_length(targetprocess_has_any) == 0 or TargetProcessName has_any (targetprocess_has_any)) \n and (array_length(parentprocess_has_any) == 0 or ParentProcessName has_any (parentprocess_has_any)) \n and (targetusername_has == '*' or TargetUsername has targetusername_has)\n and (actorusername_has == '*' or ActorUsername has actorusername_has) \n and (array_length(dvchostname_has_any) == 0 or DvcHostname has_any (dvchostname_has_any)) \n and (array_length(hashes_has_any) == 0 or TargetProcessSHA512 has_any (hashes_has_any) or TargetProcessSHA256 has_any (hashes_has_any) or TargetProcessSHA1 has_any (hashes_has_any) or TargetProcessMD5 has_any (hashes_has_any) or TargetProcessIMPHASH has_any (hashes_has_any))\n and (eventtype == '*' or EventType == eventtype)\n | project-rename\n EventUid = _ItemId\n | extend \n EventSchema = \"ProcessEvent\",\n DvcScopeId = iff(isempty(DvcScopeId), _SubscriptionId, DvcScopeId)\n // -- Aliases\n | extend\n EventEndTime = iff (isnull(EventEndTime), TimeGenerated, EventEndTime),\n EventStartTime = iff (isnull(EventEndTime), TimeGenerated, EventStartTime),\n Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId),\n Rule = coalesce(RuleName, tostring(RuleNumber)),\n User = TargetUsername,\n Process = TargetProcessName,\n CommandLine = TargetProcessCommandLine,\n Hash = coalesce(TargetProcessSHA512, TargetProcessSHA256, TargetProcessMD5, TargetProcessSHA1, TargetProcessIMPHASH)\n | project-away\n TenantId,\n SourceSystem,\n _SubscriptionId,\n _ResourceId\n};\nparser (\n starttime=starttime, \n endtime=endtime, \n commandline_has_any=commandline_has_any,\n commandline_has_all=commandline_has_all,\n commandline_has_any_ip_prefix=commandline_has_any_ip_prefix,\n actingprocess_has_any=actingprocess_has_any,\n targetprocess_has_any=targetprocess_has_any,\n parentprocess_has_any=parentprocess_has_any,\n targetusername_has=targetusername_has,\n actorusername_has=actorusername_has,\n dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix,\n dvchostname_has_any=dvchostname_has_any,\n eventtype=eventtype,\n hashes_has_any=hashes_has_any,\n disabled=disabled\n)\n", + "query": "let parser = (\n starttime: datetime=datetime(null),\n endtime: datetime=datetime(null),\n commandline_has_any: dynamic=dynamic([]),\n commandline_has_all: dynamic=dynamic([]),\n commandline_has_any_ip_prefix: dynamic=dynamic([]),\n actingprocess_has_any: dynamic=dynamic([]),\n targetprocess_has_any: dynamic=dynamic([]),\n parentprocess_has_any: dynamic=dynamic([]),\n targetusername_has: string='*',\n actorusername_has: string='*',\n dvcipaddr_has_any_prefix: dynamic=dynamic([]),\n dvchostname_has_any: dynamic=dynamic([]),\n eventtype: string='*',\n hashes_has_any: dynamic=dynamic([]),\n disabled: bool=false\n ) {\n ASimProcessEventLogs \n | where not(disabled)\n | where (isnull(starttime) or TimeGenerated >= starttime)\n and (isnull(endtime) or TimeGenerated <= endtime)\n and (array_length(dvcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(DvcIpAddr, dvcipaddr_has_any_prefix))\n and (array_length(commandline_has_all) == 0 or TargetProcessCommandLine has_all (commandline_has_all)) \n and (array_length(commandline_has_any) == 0 or TargetProcessCommandLine has_any (commandline_has_any)) \n and (array_length(commandline_has_any_ip_prefix) == 0 or has_any_ipv4_prefix(TargetProcessCommandLine, commandline_has_any_ip_prefix)) \n and (array_length(actingprocess_has_any) == 0 or ActingProcessName has_any (actingprocess_has_any)) \n and (array_length(targetprocess_has_any) == 0 or TargetProcessName has_any (targetprocess_has_any)) \n and (array_length(parentprocess_has_any) == 0 or ParentProcessName has_any (parentprocess_has_any)) \n and (targetusername_has == '*' or TargetUsername has targetusername_has)\n and (actorusername_has == '*' or ActorUsername has actorusername_has) \n and (array_length(dvchostname_has_any) == 0 or DvcHostname has_any (dvchostname_has_any)) \n and (array_length(hashes_has_any) == 0 or TargetProcessSHA512 has_any (hashes_has_any) or TargetProcessSHA256 has_any (hashes_has_any) or TargetProcessSHA1 has_any (hashes_has_any) or TargetProcessMD5 has_any (hashes_has_any) or TargetProcessIMPHASH has_any (hashes_has_any))\n and (eventtype == '*' or EventType == eventtype)\n | project-rename\n EventUid = _ItemId\n | extend \n EventSchema = \"ProcessEvent\",\n RuleNumber = toint(RuleNumber),\n DvcScopeId = iff(isempty(DvcScopeId), _SubscriptionId, DvcScopeId)\n // -- Aliases\n | extend\n EventEndTime = iff (isnull(EventEndTime), TimeGenerated, EventEndTime),\n EventStartTime = iff (isnull(EventEndTime), TimeGenerated, EventStartTime),\n Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId),\n Rule = coalesce(RuleName, tostring(RuleNumber)),\n User = TargetUsername,\n Process = TargetProcessName,\n CommandLine = TargetProcessCommandLine,\n Hash = coalesce(TargetProcessSHA512, TargetProcessSHA256, TargetProcessMD5, TargetProcessSHA1, TargetProcessIMPHASH)\n | project-away\n TenantId,\n SourceSystem,\n _SubscriptionId,\n _ResourceId\n};\nparser (\n starttime=starttime, \n endtime=endtime, \n commandline_has_any=commandline_has_any,\n commandline_has_all=commandline_has_all,\n commandline_has_any_ip_prefix=commandline_has_any_ip_prefix,\n actingprocess_has_any=actingprocess_has_any,\n targetprocess_has_any=targetprocess_has_any,\n parentprocess_has_any=parentprocess_has_any,\n targetusername_has=targetusername_has,\n actorusername_has=actorusername_has,\n dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix,\n dvchostname_has_any=dvchostname_has_any,\n eventtype=eventtype,\n hashes_has_any=hashes_has_any,\n disabled=disabled\n)\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),commandline_has_any:dynamic=dynamic([]),commandline_has_all:dynamic=dynamic([]),commandline_has_any_ip_prefix:dynamic=dynamic([]),actingprocess_has_any:dynamic=dynamic([]),targetprocess_has_any:dynamic=dynamic([]),parentprocess_has_any:dynamic=dynamic([]),targetusername_has:string='*',actorusername_has:string='*',dvcipaddr_has_any_prefix:dynamic=dynamic([]),dvchostname_has_any:dynamic=dynamic([]),eventtype:string='*',hashes_has_any:dynamic=dynamic([]),disabled:bool=False" } diff --git a/Parsers/ASimProcessEvent/ARM/vimProcessTerminateMD4IoT/vimProcessTerminateMD4IoT.json b/Parsers/ASimProcessEvent/ARM/vimProcessTerminateMD4IoT/vimProcessTerminateMD4IoT.json index 6420d4fbcdb..eefe5598133 100644 --- a/Parsers/ASimProcessEvent/ARM/vimProcessTerminateMD4IoT/vimProcessTerminateMD4IoT.json +++ b/Parsers/ASimProcessEvent/ARM/vimProcessTerminateMD4IoT/vimProcessTerminateMD4IoT.json @@ -27,7 +27,7 @@ "displayName": "Process Terminate Event ASIM parser for Microsoft Defender for IoT", "category": "ASIM", "FunctionAlias": "vimProcessTerminateMD4IoT", - "query": "let ProcessEvents_MD4IoT=()\n{\n SecurityIoTRawEvent \n | where RawEventName == \"Process\" and EventDetails has_cs 'EXIT'\n // --------------------------------------------------------------------------------------\n | where\n (isnull(starttime) or TimeGenerated >= starttime )\n and (isnull(endtime) or TimeGenerated <= endtime )\n and not(disabled)\n and (array_length(dvcipaddr_has_any_prefix)==0)\n and (array_length(actingprocess_has_any)==0 ) \n and (array_length(parentprocess_has_any)==0) \n and (eventtype=='*' or eventtype=='ProcessTerminated')\n and (array_length(commandline_has_any)==0 or EventDetails has_any (commandline_has_any)) \n and (array_length(commandline_has_all)==0 or EventDetails has_all (commandline_has_all)) \n and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(EventDetails, commandline_has_any_ip_prefix) ) \n and (array_length(targetprocess_has_any)==0 or EventDetails has_any (targetprocess_has_any)) \n and (actorusername_has=='*' or EventDetails has actorusername_has) \n and (array_length(dvchostname_has_any)==0 or DeviceId has_any (dvchostname_has_any)) \n // --------------------------------------------------------------------------------------\n | extend\n EventDetails = todynamic(EventDetails)\n | where tostring(EventDetails.EventType) == 'EXIT'\n | extend // required for postfilterring\n DvcOs = iif (EventDetails.MessageSource == \"Linux\", \"Linux\", \"Windows\"), // Intermediate fix\n TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), \n TargetProcessName = coalesce (tostring(EventDetails.Executable), split(EventDetails.Commandline,\" \")[0])\n | extend // required for postfilterring\n ActorUsername = iff (DvcOs == \"Windows\", tostring(EventDetails.UserName), \"\")\n // --------------------------------------------------------------------------------------\n | where (array_length(commandline_has_any)==0 or TargetProcessCommandLine has_any (commandline_has_any)) \n and (array_length(commandline_has_all)==0 or TargetProcessCommandLine has_all (commandline_has_all)) \n and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(TargetProcessCommandLine, commandline_has_any_ip_prefix) ) \n and (array_length(targetprocess_has_any)==0 or TargetProcessName has_any (targetprocess_has_any)) \n and (actorusername_has=='*' or ActorUsername has actorusername_has) \n // --------------------------------------------------------------------------------------\n | extend\n EventOriginalUid = tostring(EventDetails.OriginalEventId), \n EventCount = toint(EventDetails.HitCount), \n EventProduct = 'Azure Defender for IoT', \n EventVendor = 'Microsoft', \n EventSchemaVersion = '0.1.0',\n EventSchema = 'ProcessEvent', \n EventStartTime = todatetime(EventDetails.TimestampUTC), \n EventEndTime = todatetime(TimeGenerated), \n EventType = 'ProcessTerminated', \n EventSubType = tostring(EventDetails.EventType),\n EventResult = 'Success', \n TargetProcessId = tostring(EventDetails.ProcessId), \n ActorUsernameType = iif (DvcOs == \"Windows\", \"Windows\", \"Simple\"), \n ActingProcessId = iff (DvcOs == \"Windows\", tostring(EventDetails.ParentProcessId), \"\") \n | project-rename\n DvcHostname = DeviceId,\n EventProductVersion = AgentVersion, // Not available in Windows\n _ResourceId = AssociatedResourceId, \n _SubscriptionId = AzureSubscriptionId \n | extend \n // -- aliases\n User = ActorUsername, \n CommandLine = TargetProcessCommandLine, \n Process = TargetProcessName, \n Dvc = DvcHostname \n };\n ProcessEvents_MD4IoT\n", + "query": "let ProcessEvents_MD4IoT=()\n{\n SecurityIoTRawEvent \n | where RawEventName == \"Process\" and EventDetails has_cs 'EXIT'\n // --------------------------------------------------------------------------------------\n | where\n (isnull(starttime) or TimeGenerated >= starttime )\n and (isnull(endtime) or TimeGenerated <= endtime )\n and not(disabled)\n and (array_length(dvcipaddr_has_any_prefix)==0)\n and (array_length(actingprocess_has_any)==0 ) \n and (array_length(parentprocess_has_any)==0) \n and (eventtype=='*' or eventtype=='ProcessTerminated')\n and (array_length(commandline_has_any)==0 or EventDetails has_any (commandline_has_any)) \n and (array_length(commandline_has_all)==0 or EventDetails has_all (commandline_has_all)) \n and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(EventDetails, commandline_has_any_ip_prefix) ) \n and (array_length(targetprocess_has_any)==0 or EventDetails has_any (targetprocess_has_any)) \n and (actorusername_has=='*' or EventDetails has actorusername_has) \n and (array_length(dvchostname_has_any)==0 or DeviceId has_any (dvchostname_has_any)) \n // --------------------------------------------------------------------------------------\n | extend\n EventDetails = todynamic(EventDetails)\n | where tostring(EventDetails.EventType) == 'EXIT'\n | extend // required for postfilterring\n DvcOs = iif (EventDetails.MessageSource == \"Linux\", \"Linux\", \"Windows\"), // Intermediate fix\n TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), \n TargetProcessName = coalesce (tostring(EventDetails.Executable), tostring(split(EventDetails.Commandline,\" \")[0]))\n | extend // required for postfilterring\n ActorUsername = iff (DvcOs == \"Windows\", tostring(EventDetails.UserName), \"\")\n // --------------------------------------------------------------------------------------\n | where (array_length(commandline_has_any)==0 or TargetProcessCommandLine has_any (commandline_has_any)) \n and (array_length(commandline_has_all)==0 or TargetProcessCommandLine has_all (commandline_has_all)) \n and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(TargetProcessCommandLine, commandline_has_any_ip_prefix) ) \n and (array_length(targetprocess_has_any)==0 or TargetProcessName has_any (targetprocess_has_any)) \n and (actorusername_has=='*' or ActorUsername has actorusername_has) \n // --------------------------------------------------------------------------------------\n | extend\n EventOriginalUid = tostring(EventDetails.OriginalEventId), \n EventCount = toint(EventDetails.HitCount), \n EventProduct = 'Azure Defender for IoT', \n EventVendor = 'Microsoft', \n EventSchemaVersion = '0.1.0',\n EventSchema = 'ProcessEvent', \n EventStartTime = todatetime(EventDetails.TimestampUTC), \n EventEndTime = todatetime(TimeGenerated), \n EventType = 'ProcessTerminated', \n EventSubType = tostring(EventDetails.EventType),\n EventResult = 'Success', \n TargetProcessId = tostring(EventDetails.ProcessId), \n ActorUsernameType = iif (DvcOs == \"Windows\", \"Windows\", \"Simple\"), \n ActingProcessId = iff (DvcOs == \"Windows\", tostring(EventDetails.ParentProcessId), \"\") \n | project-rename\n DvcHostname = DeviceId,\n EventProductVersion = AgentVersion, // Not available in Windows\n _ResourceId = AssociatedResourceId, \n _SubscriptionId = AzureSubscriptionId \n | extend \n // -- aliases\n User = ActorUsername, \n CommandLine = TargetProcessCommandLine, \n Process = TargetProcessName, \n Dvc = DvcHostname \n };\n ProcessEvents_MD4IoT\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),commandline_has_any:dynamic=dynamic([]),commandline_has_all:dynamic=dynamic([]),commandline_has_any_ip_prefix:dynamic=dynamic([]),actingprocess_has_any:dynamic=dynamic([]),targetprocess_has_any:dynamic=dynamic([]),parentprocess_has_any:dynamic=dynamic([]),actorusername_has:string='*',dvcipaddr_has_any_prefix:dynamic=dynamic([]),dvchostname_has_any:dynamic=dynamic([]),eventtype:string='*',disabled:bool=False" } diff --git a/Parsers/ASimProcessEvent/CHANGELOG/ASimProcessEventMD4IoT.md b/Parsers/ASimProcessEvent/CHANGELOG/ASimProcessEventMD4IoT.md index adb358f784b..915ff8c6336 100644 --- a/Parsers/ASimProcessEvent/CHANGELOG/ASimProcessEventMD4IoT.md +++ b/Parsers/ASimProcessEvent/CHANGELOG/ASimProcessEventMD4IoT.md @@ -1,5 +1,9 @@ # Changelog for ASimProcessEventMD4IoT.yaml +## Version 0.1.2 + +- (2026-10-27) Corrected TargetProcessName (and the Process alias) to a string: the Commandline fallback returned a dynamic, where the ProcessEvent schema declares string - [PR #15445](https://github.com/Azure/Azure-Sentinel/pull/15445) + ## Version 0.1.1 - (2022-03-23) ASIM - Changes Description fields to use regular multiline comment pipe. - [PR #4473](https://github.com/Azure/Azure-Sentinel/pull/4473) diff --git a/Parsers/ASimProcessEvent/CHANGELOG/ASimProcessEventMicrosoft365D.md b/Parsers/ASimProcessEvent/CHANGELOG/ASimProcessEventMicrosoft365D.md index d97318458b3..f8778ef3a82 100644 --- a/Parsers/ASimProcessEvent/CHANGELOG/ASimProcessEventMicrosoft365D.md +++ b/Parsers/ASimProcessEvent/CHANGELOG/ASimProcessEventMicrosoft365D.md @@ -1,5 +1,9 @@ # Changelog for ASimProcessEventMicrosoft365D.yaml +## Version 0.3.2 + +- (2026-10-27) Normalized AdditionalFields to dynamic; DeviceProcessEvents carries it as a JSON string, while the ProcessEvent schema declares dynamic - [PR #15445](https://github.com/Azure/Azure-Sentinel/pull/15445) + ## Version 0.3.1 - (2026-05-01) Fix bug where TargetUserSessionId was not projected - [PR #14183](https://github.com/Azure/Azure-Sentinel/pull/14183) diff --git a/Parsers/ASimProcessEvent/CHANGELOG/ASimProcessEventNative.md b/Parsers/ASimProcessEvent/CHANGELOG/ASimProcessEventNative.md index c982d5c5002..4ecc9f4e41e 100644 --- a/Parsers/ASimProcessEvent/CHANGELOG/ASimProcessEventNative.md +++ b/Parsers/ASimProcessEvent/CHANGELOG/ASimProcessEventNative.md @@ -1,5 +1,9 @@ # Changelog for ASimProcessEventNative.yaml +## Version 0.1.1 + +- (2026-10-27) Cast RuleNumber to int, as the ProcessEvent schema declares; ASimProcessEventLogs stores it as a string - [PR #15445](https://github.com/Azure/Azure-Sentinel/pull/15445) + ## Version 0.1.0 - (2023-11-22) AddingNativeTableParsers-Registry,Process - [PR #9448](https://github.com/Azure/Azure-Sentinel/pull/9448) diff --git a/Parsers/ASimProcessEvent/CHANGELOG/vimProcessCreateMD4IoT.md b/Parsers/ASimProcessEvent/CHANGELOG/vimProcessCreateMD4IoT.md index 3781140142b..8b37a455279 100644 --- a/Parsers/ASimProcessEvent/CHANGELOG/vimProcessCreateMD4IoT.md +++ b/Parsers/ASimProcessEvent/CHANGELOG/vimProcessCreateMD4IoT.md @@ -1,5 +1,9 @@ # Changelog for vimProcessCreateMD4IoT.yaml +## Version 0.1.1 + +- (2026-10-27) Corrected TargetProcessName (and the Process alias) to a string: the Commandline fallback returned a dynamic, where the ProcessEvent schema declares string - [PR #15445](https://github.com/Azure/Azure-Sentinel/pull/15445) + ## Version 0.1.0 - (2022-05-01) Adding params to D4IoT - [PR #4748](https://github.com/Azure/Azure-Sentinel/pull/4748) diff --git a/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventMD4IoT.md b/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventMD4IoT.md index b5c3d3e18a4..9179784d98e 100644 --- a/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventMD4IoT.md +++ b/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventMD4IoT.md @@ -1,5 +1,9 @@ # Changelog for vimProcessEventMD4IoT.yaml +## Version 0.2.1 + +- (2026-10-27) Removed unreferenced parser in favor of split ProcessCreate/ProcessTerminate variants - [PR #15445](https://github.com/Azure/Azure-Sentinel/pull/15445) + ## Version 0.2.0 - (2022-05-01) Adding params to D4IoT - [PR #4748](https://github.com/Azure/Azure-Sentinel/pull/4748) diff --git a/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventMicrosoft365D.md b/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventMicrosoft365D.md index 5e08eb49727..bed72081e43 100644 --- a/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventMicrosoft365D.md +++ b/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventMicrosoft365D.md @@ -1,5 +1,10 @@ # Changelog for vimProcessEventMicrosoft365D.yaml +## Version 0.5.0 + +- (2026-10-27) Normalized AdditionalFields to dynamic; DeviceProcessEvents carries it as a JSON string, while the ProcessEvent schema declares dynamic - [PR #15445](https://github.com/Azure/Azure-Sentinel/pull/15445) +- (2026-10-27) Added missing actorusername_has filter - [PR #15445](https://github.com/Azure/Azure-Sentinel/pull/15445) + ## Version 0.4.1 - (2026-05-01) Fix bug where TargetUserSessionId was not projected - [PR #14183](https://github.com/Azure/Azure-Sentinel/pull/14183) diff --git a/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventNative.md b/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventNative.md index f0d55d1316c..0daa66fcc3a 100644 --- a/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventNative.md +++ b/Parsers/ASimProcessEvent/CHANGELOG/vimProcessEventNative.md @@ -1,5 +1,9 @@ # Changelog for vimProcessEventNative.yaml +## Version 0.1.1 + +- (2026-10-27) Cast RuleNumber to int, as the ProcessEvent schema declares; ASimProcessEventLogs stores it as a string - [PR #15445](https://github.com/Azure/Azure-Sentinel/pull/15445) + ## Version 0.1.0 - (2023-11-23) AddingNativeTableParsers-Registry,Process - [PR #9448](https://github.com/Azure/Azure-Sentinel/pull/9448) diff --git a/Parsers/ASimProcessEvent/CHANGELOG/vimProcessTerminateMD4IoT.md b/Parsers/ASimProcessEvent/CHANGELOG/vimProcessTerminateMD4IoT.md index c69824d71d3..72bc2e3ac0b 100644 --- a/Parsers/ASimProcessEvent/CHANGELOG/vimProcessTerminateMD4IoT.md +++ b/Parsers/ASimProcessEvent/CHANGELOG/vimProcessTerminateMD4IoT.md @@ -1,5 +1,9 @@ # Changelog for vimProcessTerminateMD4IoT.yaml +## Version 0.2.1 + +- (2026-10-27) Corrected TargetProcessName (and the Process alias) to a string: the Commandline fallback returned a dynamic, where the ProcessEvent schema declares string - [PR #15445](https://github.com/Azure/Azure-Sentinel/pull/15445) + ## Version 0.2.0 - (2022-05-01) Adding params to D4IoT - [PR #4748](https://github.com/Azure/Azure-Sentinel/pull/4748) diff --git a/Parsers/ASimProcessEvent/Parsers/ASimProcessEventMD4IoT.yaml b/Parsers/ASimProcessEvent/Parsers/ASimProcessEventMD4IoT.yaml index e47320226c1..5adcf192aea 100644 --- a/Parsers/ASimProcessEvent/Parsers/ASimProcessEventMD4IoT.yaml +++ b/Parsers/ASimProcessEvent/Parsers/ASimProcessEventMD4IoT.yaml @@ -1,12 +1,12 @@ Parser: Title: Process Create Event ASIM parser for Microsoft Defender for IoT - Version: '0.1.1' - LastUpdated: Feb 23, 2022 + Version: '0.1.2' + LastUpdated: Oct 27, 2026 Product: Name: Microsoft Defender for IoT Normalization: Schema: ProcessEvent - Version: '0.1.0' + Version: '1.0.0' References: - Title: ASIM Process Schema Link: https://aka.ms/ASimProcessEventDoc @@ -43,7 +43,7 @@ ParserQuery: | EventResult = 'Success', TargetProcessId = tostring(EventDetails.ProcessId), TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), - TargetProcessName = coalesce (tostring(EventDetails.Executable), split(EventDetails.Commandline," ")[0]), + TargetProcessName = coalesce (tostring(EventDetails.Executable), tostring(split(EventDetails.Commandline," ")[0])), TargetUsernameType = iif (DvcOs == "Windows", "Windows", "Simple"), TargetUsername = iff (DvcOs == "Windows", tostring(EventDetails.UserName), ""), ActingProcessId = iff (DvcOs == "Windows", tostring(EventDetails.ParentProcessId), "") diff --git a/Parsers/ASimProcessEvent/Parsers/ASimProcessEventMicrosoft365D.yaml b/Parsers/ASimProcessEvent/Parsers/ASimProcessEventMicrosoft365D.yaml index 124b1d6bd2f..e5b8fcc8a75 100644 --- a/Parsers/ASimProcessEvent/Parsers/ASimProcessEventMicrosoft365D.yaml +++ b/Parsers/ASimProcessEvent/Parsers/ASimProcessEventMicrosoft365D.yaml @@ -1,12 +1,12 @@ Parser: Title: Process Create Event ASIM parser for Microsoft 365 Defender for endpoint - Version: '0.3.1' - LastUpdated: May 01, 2026 + Version: '0.3.2' + LastUpdated: Oct 27, 2026 Product: Name: Microsoft 365 Defender for endpoint Normalization: Schema: ProcessEvent - Version: '0.1.4' + Version: '1.0.0' References: - Title: ASIM Process Schema Link: https://aka.ms/ASimProcessEventDoc @@ -104,7 +104,8 @@ ParserQuery: | User = coalesce(TargetUsername, ActorUsername), CommandLine = TargetProcessCommandLine, Process = TargetProcessName, - Dvc = DvcHostname + Dvc = DvcHostname, + AdditionalFields = todynamic(AdditionalFields) | project TimeGenerated, Type, diff --git a/Parsers/ASimProcessEvent/Parsers/ASimProcessEventNative.yaml b/Parsers/ASimProcessEvent/Parsers/ASimProcessEventNative.yaml index 605b1021321..569a7063553 100644 --- a/Parsers/ASimProcessEvent/Parsers/ASimProcessEventNative.yaml +++ b/Parsers/ASimProcessEvent/Parsers/ASimProcessEventNative.yaml @@ -1,13 +1,13 @@ Id: 192fbf56-be7b-4bee-a172-a44e6527a9e0 Parser: Title: Process Event ASIM parser for Microsoft Sentinel native Process Event table - Version: "0.1.0" - LastUpdated: Nov 22 2023 + Version: "0.1.1" + LastUpdated: Oct 27, 2026 Product: Name: Native Normalization: Schema: ProcessEvent - Version: "0.1.4" + Version: "1.0.0" References: - Title: ASIM Process Schema Link: https://aka.ms/ASimProcessEventDoc @@ -29,6 +29,7 @@ ParserQuery: | EventUid = _ItemId | extend EventSchema = "ProcessEvent", + RuleNumber = toint(RuleNumber), DvcScopeId = iff(isempty(DvcScopeId), _SubscriptionId, DvcScopeId) // -- Aliases | extend diff --git a/Parsers/ASimProcessEvent/Parsers/imProcessEvent.yaml b/Parsers/ASimProcessEvent/Parsers/imProcessEvent.yaml index 4ac2c6983b8..c8c2c8f2183 100644 --- a/Parsers/ASimProcessEvent/Parsers/imProcessEvent.yaml +++ b/Parsers/ASimProcessEvent/Parsers/imProcessEvent.yaml @@ -88,7 +88,7 @@ ParserQuery: | let imBuiltInDisabled=toscalar('ExcludevimProcessEventBuiltIn' in (DisabledParsers) or 'Any' in (DisabledParsers)); union isfuzzy=true vimProcessEmpty, - vimProcessEventMicrosoft365D (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, (imBuiltInDisabled or ('ExcludevimProcessEventMicrosoft365D' in (DisabledParsers)))), + vimProcessEventMicrosoft365D (starttime=starttime, endtime=endtime, commandline_has_any=commandline_has_any, commandline_has_all=commandline_has_all, commandline_has_any_ip_prefix=commandline_has_any_ip_prefix, actingprocess_has_any=actingprocess_has_any, targetprocess_has_any=targetprocess_has_any, parentprocess_has_any=parentprocess_has_any, actorusername_has=actorusername_has, targetusername_has=targetusername_has, dvcipaddr_has_any_prefix=dvcipaddr_has_any_prefix, dvchostname_has_any=dvchostname_has_any, eventtype=eventtype, hashes_has_any=hashes_has_any, disabled=(imBuiltInDisabled or ('ExcludevimProcessEventMicrosoft365D' in (DisabledParsers)))), vimProcessEventCreateMicrosoftSysmon (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessEventCreateMicrosoftSysmon' in (DisabledParsers)))), vimProcessEventCreateMicrosoftSysmonWindowsEvent (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, targetusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessEventCreateMicrosoftSysmonWindowsEvent' in (DisabledParsers)))), vimProcessEventTerminateMicrosoftSysmon (starttime, endtime, commandline_has_any, commandline_has_all, commandline_has_any_ip_prefix, actingprocess_has_any, targetprocess_has_any, parentprocess_has_any, actorusername_has, dvcipaddr_has_any_prefix, dvchostname_has_any, eventtype, (imBuiltInDisabled or ('ExcludevimProcessEventTerminateMicrosoftSysmon' in (DisabledParsers)))), diff --git a/Parsers/ASimProcessEvent/Parsers/vimProcessCreateMD4IoT.yaml b/Parsers/ASimProcessEvent/Parsers/vimProcessCreateMD4IoT.yaml index 83666bba864..42ab84544c2 100644 --- a/Parsers/ASimProcessEvent/Parsers/vimProcessCreateMD4IoT.yaml +++ b/Parsers/ASimProcessEvent/Parsers/vimProcessCreateMD4IoT.yaml @@ -1,12 +1,12 @@ Parser: Title: Process Create Event ASIM parser for Microsoft Defender for IoT - Version: '0.1.0' - LastUpdated: Apr 30, 2022 + Version: '0.1.1' + LastUpdated: Oct 27, 2026 Product: Name: Microsoft Defender for IoT Normalization: Schema: ProcessEvent - Version: '0.1.0' + Version: '1.0.0' References: - Title: ASIM Process Schema Link: https://aka.ms/ASimProcessEventDoc @@ -82,7 +82,7 @@ ParserQuery: | | where EventDetails.EventType != 'EXIT' // TODO: move filter to prefiltering. see prev comment | extend // required for postfilterring TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), - TargetProcessName = coalesce (tostring(EventDetails.Executable), split(EventDetails.Commandline," ")[0]), + TargetProcessName = coalesce (tostring(EventDetails.Executable), tostring(split(EventDetails.Commandline," ")[0])), DvcOs = iif (EventDetails.MessageSource == "Linux", "Linux", "Windows") // Intermediate fix | extend TargetUsername = iff (DvcOs == "Windows", tostring(EventDetails.UserName), "") diff --git a/Parsers/ASimProcessEvent/Parsers/vimProcessEventMD4IoT.yaml b/Parsers/ASimProcessEvent/Parsers/vimProcessEventMD4IoT.yaml deleted file mode 100644 index 799c3b4d06d..00000000000 --- a/Parsers/ASimProcessEvent/Parsers/vimProcessEventMD4IoT.yaml +++ /dev/null @@ -1,122 +0,0 @@ -Parser: - Title: Process Create Event ASIM parser for Microsoft Defender for IoT - Version: '0.2.0' - LastUpdated: Feb 23, 2022 -Product: - Name: Microsoft Defender for IoT -Normalization: - Schema: ProcessEvent - Version: '0.1.0' -References: -- Title: ASIM Process Schema - Link: https://aka.ms/ASimProcessEventDoc -- Title: ASIM - Link: https://aka.ms/AboutASIM -Description: | - This ASIM parser supports normalizing Microsoft Defender for IoT events to the ASIM Process Event normalized schema. -ParserName: vimProcessEventMD4IoT -EquivalentBuiltInParser: _Im_ProcessEvent_MD4IoT -ParserParams: - - Name: starttime - Type: datetime - Default: datetime(null) - - Name: endtime - Type: datetime - Default: datetime(null) - - Name: commandline_has_any - Type: dynamic - Default: dynamic([]) - - Name: commandline_has_all - Type: dynamic - Default: dynamic([]) - - Name: commandline_has_any_ip_prefix - Type: dynamic - Default: dynamic([]) - - Name: actingprocess_has_any - Type: dynamic - Default: dynamic([]) - - Name: targetprocess_has_any - Type: dynamic - Default: dynamic([]) - - Name: parentprocess_has_any - Type: dynamic - Default: dynamic([]) - - Name: targetusername_has - Type: string - Default: '*' - - Name: dvcipaddr_has_any_prefix - Type: dynamic - Default: dynamic([]) - - Name: dvchostname_has_any - Type: dynamic - Default: dynamic([]) - - Name: eventtype - Type: string - Default: '*' - - Name: disabled - Type: bool - Default: false -ParserQuery: | - let ProcessEvents_MD4IoT=() - { - SecurityIoTRawEvent - | where RawEventName == "Process" - // -------------------------------------------------------------------------------------- - | where - (isnull(starttime) or TimeGenerated >= starttime ) - and (isnull(endtime) or TimeGenerated <= endtime ) - and not(disabled) - and (array_length(dvcipaddr_has_any_prefix)==0) - and (array_length(actingprocess_has_any)==0 ) - and (array_length(parentprocess_has_any)==0) - and (eventtype=='*' or eventtype=='ProcessCreated') - and (array_length(commandline_has_any)==0 or EventDetails has_any (commandline_has_any)) - and (array_length(commandline_has_all)==0 or EventDetails has_all (commandline_has_all)) - and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(EventDetails, commandline_has_any_ip_prefix) ) - and (array_length(targetprocess_has_any)==0 or EventDetails has_any (targetprocess_has_any)) - and (targetusername_has=='*' or EventDetails has targetusername_has) - and (array_length(dvchostname_has_any)==0 or DeviceId has_any (dvchostname_has_any)) - // -------------------------------------------------------------------------------------- - | extend - EventDetails = todynamic(EventDetails) - | extend // required for postfilterring - TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), - TargetProcessName = coalesce (tostring(EventDetails.Executable), split(EventDetails.Commandline," ")[0]), - DvcOs = iif (EventDetails.MessageSource == "Linux", "Linux", "Windows") // Intermediate fix - | extend - TargetUsername = iff (DvcOs == "Windows", tostring(EventDetails.UserName), "") - // -------------------------------------------------------------------------------------- - | where (array_length(commandline_has_any)==0 or TargetProcessCommandLine has_any (commandline_has_any)) - and (array_length(commandline_has_all)==0 or TargetProcessCommandLine has_all (commandline_has_all)) - and (array_length(commandline_has_any_ip_prefix)==0 or has_any_ipv4_prefix(TargetProcessCommandLine, commandline_has_any_ip_prefix) ) - and (array_length(targetprocess_has_any)==0 or TargetProcessName has_any (targetprocess_has_any)) - and (targetusername_has=='*' or TargetUsername has targetusername_has) - // -------------------------------------------------------------------------------------- - | extend - EventOriginalUid = tostring(EventDetails.OriginalEventId), - EventCount = toint(EventDetails.HitCount), - EventProduct = 'Azure Defender for IoT', - EventVendor = 'Microsoft', - EventSchemaVersion = '0.1.0', - EventSchema = 'ProcessEvent', - EventStartTime = todatetime(EventDetails.TimestampUTC), - EventEndTime = todatetime(TimeGenerated), - EventType = iff (EventDetails.EventType == 'EXIT', 'ProcessTerminate', 'ProcessCreated'), - EventSubType = tostring(EventDetails.EventType), - EventResult = 'Success', - TargetProcessId = tostring(EventDetails.ProcessId), - TargetUsernameType = iif (DvcOs == "Windows", "Windows", "Simple"), - ActingProcessId = iff (DvcOs == "Windows", tostring(EventDetails.ParentProcessId), "") - | project-rename - DvcHostname = DeviceId, - EventProductVersion = AgentVersion, // Not available in Windows - _ResourceId = AssociatedResourceId, - _SubscriptionId = AzureSubscriptionId - | extend - // -- aliases - User = TargetUsername, - CommandLine = TargetProcessCommandLine, - Process = TargetProcessName, - Dvc = DvcHostname - }; - ProcessEvents_MD4IoT diff --git a/Parsers/ASimProcessEvent/Parsers/vimProcessEventMicrosoft365D.yaml b/Parsers/ASimProcessEvent/Parsers/vimProcessEventMicrosoft365D.yaml index de03c65a08f..bda64733895 100644 --- a/Parsers/ASimProcessEvent/Parsers/vimProcessEventMicrosoft365D.yaml +++ b/Parsers/ASimProcessEvent/Parsers/vimProcessEventMicrosoft365D.yaml @@ -1,12 +1,12 @@ Parser: Title: Process Create Event ASIM parser for Microsoft 365 Defender for endpoint - Version: '0.4.1' - LastUpdated: May 01, 2026 + Version: '0.5.0' + LastUpdated: Oct 27, 2026 Product: Name: Microsoft 365 Defender for endpoint Normalization: Schema: ProcessEvent - Version: '0.1.4' + Version: '1.0.0' References: - Title: ASIM Process Schema Link: https://aka.ms/ASimProcessEventDoc @@ -44,18 +44,21 @@ ParserParams: - Name: targetusername_has Type: string Default: '*' + - Name: actorusername_has + Type: string + Default: '*' - Name: dvcipaddr_has_any_prefix Type: dynamic Default: dynamic([]) - Name: dvchostname_has_any Type: dynamic Default: dynamic([]) + - Name: hashes_has_any + Type: dynamic + Default: dynamic([]) - Name: eventtype Type: string Default: '*' - - Name: hashes_has_any - Type: dynamic - Default: dynamic([]) - Name: disabled Type: bool Default: false @@ -70,6 +73,7 @@ ParserQuery: | targetprocess_has_any:dynamic=dynamic([]), parentprocess_has_any:dynamic=dynamic([]), targetusername_has:string='*', + actorusername_has:string='*', dvcipaddr_has_any_prefix:dynamic=dynamic([]), dvchostname_has_any:dynamic=dynamic([]), eventtype:string='*', @@ -89,7 +93,8 @@ ParserQuery: | and (array_length(actingprocess_has_any)==0 or InitiatingProcessFolderPath has_any (actingprocess_has_any)) and (array_length(targetprocess_has_any)==0 or FolderPath has_any (targetprocess_has_any)) and (array_length(parentprocess_has_any)==0 or InitiatingProcessParentFileName has_any (parentprocess_has_any)) - and (targetusername_has=='*' or AccountName has targetusername_has or AccountDomain has targetusername_has) + and (targetusername_has=='*' or AccountName has targetusername_has or AccountDomain has targetusername_has) + and (actorusername_has=='*' or InitiatingProcessAccountName has actorusername_has or InitiatingProcessAccountDomain has actorusername_has) and (array_length(dvchostname_has_any)==0 or DeviceName has_any (dvchostname_has_any)) and (array_length(hashes_has_any)==0 or SHA256 in (hashes_has_any) or SHA1 in (hashes_has_any) or MD5 in (hashes_has_any)) and (eventtype=='*' or eventtype=='ProcessCreated') @@ -172,7 +177,8 @@ ParserQuery: | User = coalesce(TargetUsername, ActorUsername), CommandLine = TargetProcessCommandLine, Process = TargetProcessName, - Dvc = DvcHostname + Dvc = DvcHostname, + AdditionalFields = todynamic(AdditionalFields) | project TimeGenerated, Type, diff --git a/Parsers/ASimProcessEvent/Parsers/vimProcessEventNative.yaml b/Parsers/ASimProcessEvent/Parsers/vimProcessEventNative.yaml index 9fe4b2b4891..9b27c71215a 100644 --- a/Parsers/ASimProcessEvent/Parsers/vimProcessEventNative.yaml +++ b/Parsers/ASimProcessEvent/Parsers/vimProcessEventNative.yaml @@ -1,8 +1,8 @@ Id: 192fbf56-be7b-4bee-a172-a44e6527a9e0 Parser: Title: Process Event ASIM filtering parser for Microsoft Sentinel native Process Event table - Version: "0.1.0" - LastUpdated: Nov 22 2023 + Version: "0.1.1" + LastUpdated: Oct 27, 2026 Product: Name: Native Normalization: @@ -101,6 +101,7 @@ ParserQuery: | EventUid = _ItemId | extend EventSchema = "ProcessEvent", + RuleNumber = toint(RuleNumber), DvcScopeId = iff(isempty(DvcScopeId), _SubscriptionId, DvcScopeId) // -- Aliases | extend diff --git a/Parsers/ASimProcessEvent/Parsers/vimProcessTerminateMD4IoT.yaml b/Parsers/ASimProcessEvent/Parsers/vimProcessTerminateMD4IoT.yaml index 975404fab18..cafc18e2c11 100644 --- a/Parsers/ASimProcessEvent/Parsers/vimProcessTerminateMD4IoT.yaml +++ b/Parsers/ASimProcessEvent/Parsers/vimProcessTerminateMD4IoT.yaml @@ -1,12 +1,12 @@ Parser: Title: Process Terminate Event ASIM parser for Microsoft Defender for IoT - Version: '0.2.0' - LastUpdated: Apr 30, 2022 + Version: '0.2.1' + LastUpdated: Oct 27, 2026 Product: Name: Microsoft Defender for IoT Normalization: Schema: ProcessEvent - Version: '0.1.0' + Version: '1.0.0' References: - Title: ASIM Process Schema Link: https://aka.ms/ASimProcessEventDoc @@ -83,7 +83,7 @@ ParserQuery: | | extend // required for postfilterring DvcOs = iif (EventDetails.MessageSource == "Linux", "Linux", "Windows"), // Intermediate fix TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), - TargetProcessName = coalesce (tostring(EventDetails.Executable), split(EventDetails.Commandline," ")[0]) + TargetProcessName = coalesce (tostring(EventDetails.Executable), tostring(split(EventDetails.Commandline," ")[0])) | extend // required for postfilterring ActorUsername = iff (DvcOs == "Windows", tostring(EventDetails.UserName), "") // --------------------------------------------------------------------------------------