Skip to content

[ASIM] ProcessEvent type fixes #15445

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Remco Hofman (SpeedyFireCyclone) wants to merge 9 commits into
base: master
Choose a base branch
from
+81 −238
Open

[ASIM] ProcessEvent type fixes #15445

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
fe783a6
ASIM ProcessEvent: correct TargetProcessName, AdditionalFields and Ru…
SpeedyFireCyclone Oct 27, 2026
e125a7b
Update deployment templates
SpeedyFireCyclone Oct 27, 2026
4c5f4fa
Add PR number to changelogs
SpeedyFireCyclone Oct 27, 2026
8d1421c
Removed unreferenced & unmaintained parser
SpeedyFireCyclone Oct 28, 2026
3105d50
Add missing actorusername_has filter
SpeedyFireCyclone Oct 28, 2026
3612678
Update normalization schema versions
SpeedyFireCyclone Oct 28, 2026
450b86e
Fix duplicated `or` in actorusername_has filter
SpeedyFireCyclone Oct 29, 2026
d9c27e0
Fix missing closing quote
SpeedyFireCyclone Oct 29, 2026
f2018db
Fix function signature
SpeedyFireCyclone Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Parsers/ASimProcessEvent/ARM/ASimProcessEventMD4IoT/ASimProcessEventMD4IoT.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
"displayName": "Process Create Event ASIM parser for Microsoft Defender for IoT",
"category": "ASIM",
"FunctionAlias": "ASimProcessEventMD4IoT",
"query": "let ProcessEvents_MD4IoT=()\n{\n SecurityIoTRawEvent | where not(disabled)\n | where RawEventName == \"Process\"\n | extend\n EventDetails = todynamic(EventDetails)\n | extend \n DvcOs = iif (EventDetails.MessageSource == \"Linux\", \"Linux\", \"Windows\") // Intermediate fix\n | extend \n EventOriginalUid = tostring(EventDetails.OriginalEventId), \n EventCount = toint(EventDetails.HitCount), \n EventProduct = 'Azure Defender for IoT', \n EventVendor = 'Microsoft', \n EventSchemaVersion = '0.1.0', \n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(EventDetails.TimestampUTC), \n EventEndTime = todatetime(TimeGenerated), \n EventType = iff (EventDetails.EventType == 'EXIT', 'ProcessTerminate', 'ProcessCreated'), \n EventSubType = tostring(EventDetails.EventType),\n EventResult = 'Success', \n TargetProcessId = tostring(EventDetails.ProcessId), \n TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), \n TargetProcessName = coalesce (tostring(EventDetails.Executable), split(EventDetails.Commandline,\" \")[0]),\n TargetUsernameType = iif (DvcOs == \"Windows\", \"Windows\", \"Simple\"), \n TargetUsername = iff (DvcOs == \"Windows\", tostring(EventDetails.UserName), \"\"), \n ActingProcessId = iff (DvcOs == \"Windows\", tostring(EventDetails.ParentProcessId), \"\") \n | project-rename\n DvcHostname = DeviceId,\n EventProductVersion = AgentVersion, // Not available in Windows\n _ResourceId = AssociatedResourceId, \n _SubscriptionId = AzureSubscriptionId \n | extend \n // -- aliases\n User = TargetUsername, \n CommandLine = TargetProcessCommandLine, \n Process = TargetProcessName, \n Dvc = DvcHostname \n };\n ProcessEvents_MD4IoT\n",
"query": "let ProcessEvents_MD4IoT=()\n{\n SecurityIoTRawEvent | where not(disabled)\n | where RawEventName == \"Process\"\n | extend\n EventDetails = todynamic(EventDetails)\n | extend \n DvcOs = iif (EventDetails.MessageSource == \"Linux\", \"Linux\", \"Windows\") // Intermediate fix\n | extend \n EventOriginalUid = tostring(EventDetails.OriginalEventId), \n EventCount = toint(EventDetails.HitCount), \n EventProduct = 'Azure Defender for IoT', \n EventVendor = 'Microsoft', \n EventSchemaVersion = '0.1.0', \n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(EventDetails.TimestampUTC), \n EventEndTime = todatetime(TimeGenerated), \n EventType = iff (EventDetails.EventType == 'EXIT', 'ProcessTerminate', 'ProcessCreated'), \n EventSubType = tostring(EventDetails.EventType),\n EventResult = 'Success', \n TargetProcessId = tostring(EventDetails.ProcessId), \n TargetProcessCommandLine = coalesce (tostring(EventDetails.Commandline), tostring(EventDetails.Executable)), \n TargetProcessName = coalesce (tostring(EventDetails.Executable), tostring(split(EventDetails.Commandline,\" \")[0])),\n TargetUsernameType = iif (DvcOs == \"Windows\", \"Windows\", \"Simple\"), \n TargetUsername = iff (DvcOs == \"Windows\", tostring(EventDetails.UserName), \"\"), \n ActingProcessId = iff (DvcOs == \"Windows\", tostring(EventDetails.ParentProcessId), \"\") \n | project-rename\n DvcHostname = DeviceId,\n EventProductVersion = AgentVersion, // Not available in Windows\n _ResourceId = AssociatedResourceId, \n _SubscriptionId = AzureSubscriptionId \n | extend \n // -- aliases\n User = TargetUsername, \n CommandLine = TargetProcessCommandLine, \n Process = TargetProcessName, \n Dvc = DvcHostname \n };\n ProcessEvents_MD4IoT\n",
"version": 1,
"functionParameters": "disabled:bool=False"
}
Expand Down
2 changes: 1 addition & 1 deletion ...ers/ASimProcessEvent/ARM/ASimProcessEventMicrosoft365D/ASimProcessEventMicrosoft365D.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
"displayName": "Process Create Event ASIM parser for Microsoft 365 Defender for endpoint",
"category": "ASIM",
"FunctionAlias": "ASimProcessEventMicrosoft365D",
"query": "let parser=(disabled:boolean=false)\n {\n DeviceProcessEvents \n | where not(disabled)\n | extend\n Type = \"DeviceProcessEvents\",\n EventOriginalUid = tostring(ReportId),\n EventCount = int(1),\n EventProduct = 'M365 Defender for Endpoint',\n EventVendor = 'Microsoft',\n EventSchemaVersion = '0.1.4',\n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(Timestamp),\n EventEndTime = todatetime(Timestamp),\n EventResult = 'Success'\n | extend\n EventUid = EventOriginalUid,\n ActorUsername = iff (InitiatingProcessAccountDomain == '', InitiatingProcessAccountName, strcat(InitiatingProcessAccountDomain, '\\\\', InitiatingProcessAccountName)),\n TargetUsername = iff (AccountDomain == '', AccountName, strcat(AccountDomain, '\\\\', AccountName)),\n TargetUsernameType = iff(AccountDomain == '','Simple', 'Windows'),\n ActorUsernameType = iff(InitiatingProcessAccountDomain == '','Simple', 'Windows'),\n ActorUserIdType = 'SID',\n TargetUserIdType = 'SID',\n ActorSessionId = tostring(InitiatingProcessLogonId),\n TargetUserSessionId = tostring(LogonId),\n Hash = coalesce (SHA256, SHA1, MD5, \"\"),\n TargetProcessId = tostring(ProcessId),\n ActingProcessId = tostring(InitiatingProcessId),\n ParentProcessId = tostring(InitiatingProcessParentId),\n DvcOs = iff (AdditionalFields has \"ProcessPosixProcessGroupId\", \"Linux\", \"Windows\"),\n TargetProcessFileSize = iif(FileSize != 0, FileSize, dynamic(null)),\n ActingProcessFileSize = iif(InitiatingProcessFileSize != 0, InitiatingProcessFileSize, dynamic(null))\n | extend\n HashType = tostring(dynamic([\"SHA256\", \"SHA1\", \"MD5\"])[array_index_of(pack_array(SHA256, SHA1, MD5),Hash)])\n | invoke _ASIM_ResolveDvcFQDN('DeviceName')\n | project-rename\n DvcId = DeviceId,\n EventType = ActionType,\n ActorUserId = InitiatingProcessAccountSid,\n ActorUserAadId = InitiatingProcessAccountObjectId,\n ActorUserUpn = InitiatingProcessAccountUpn,\n TargetUserId = AccountSid,\n TargetUserAadId = AccountObjectId,\n TargetUserUpn = AccountUpn,\n ParentProcessName = InitiatingProcessParentFileName,\n TargetProcessFilename = FileName,\n TargetProcessFileCompany = ProcessVersionInfoCompanyName,\n TargetProcessFileDescription = ProcessVersionInfoFileDescription,\n TargetProcessFileProduct = ProcessVersionInfoProductName,\n TargetProcessFileVersion = ProcessVersionInfoProductVersion,\n TargetProcessFileInternalName = ProcessVersionInfoInternalFileName,\n TargetProcessFileOriginalName = ProcessVersionInfoOriginalFileName,\n ParentProcessCreationTime = InitiatingProcessParentCreationTime,\n TargetProcessName = FolderPath,\n TargetProcessCommandLine = ProcessCommandLine,\n TargetProcessMD5 = MD5,\n TargetProcessSHA1 = SHA1,\n TargetProcessSHA256 = SHA256,\n TargetProcessIntegrityLevel = ProcessIntegrityLevel,\n TargetProcessTokenElevation = ProcessTokenElevation,\n TargetProcessCreationTime = ProcessCreationTime,\n ActingProcessName = InitiatingProcessFolderPath, \n ActingProcessFilename = InitiatingProcessFileName,\n ActingProcessFileCompany = InitiatingProcessVersionInfoCompanyName,\n ActingProcessFileDescription = InitiatingProcessVersionInfoFileDescription,\n ActingProcessFileProduct = InitiatingProcessVersionInfoProductName,\n ActingProcessFileVersion = InitiatingProcessVersionInfoProductVersion,\n ActingProcessFileInternalName = InitiatingProcessVersionInfoInternalFileName,\n ActingProcessFileOriginalName = InitiatingProcessVersionInfoOriginalFileName,\n ActingProcessCommandLine = InitiatingProcessCommandLine, \n ActingProcessMD5 = InitiatingProcessMD5, \n ActingProcessSHA1 = InitiatingProcessSHA1, \n ActingProcessSHA256 = InitiatingProcessSHA256, \n ActingProcessIntegrityLevel = InitiatingProcessIntegrityLevel,\n ActingProcessTokenElevation = InitiatingProcessTokenElevation,\n ActingProcessCreationTime = InitiatingProcessCreationTime\n | extend\n ActorUsernameType = _ASIM_GetUsernameType(ActorUsername),\n TargetUsernameType = _ASIM_GetUsernameType(TargetUsername)\n | extend // -- aliases\n User = coalesce(TargetUsername, ActorUsername),\n CommandLine = TargetProcessCommandLine,\n Process = TargetProcessName,\n Dvc = DvcHostname\n | project\n TimeGenerated,\n Type,\n EventUid,\n EventOriginalUid,\n EventCount,\n EventProduct,\n EventVendor,\n EventSchemaVersion,\n EventSchema,\n EventStartTime,\n EventEndTime,\n EventResult,\n ActorUsername,\n ActorUserIdType,\n TargetUserIdType,\n ActorUsernameType,\n TargetUsername,\n TargetUsernameType,\n ActorSessionId,\n TargetUserSessionId,\n Hash,\n TargetProcessId,\n ActingProcessId,\n ParentProcessId,\n DvcOs,\n HashType,\n DvcId,\n DvcHostname,\n DvcDomain,\n DvcDomainType,\n EventType,\n ActorUserId,\n ActorUserAadId,\n ActorUserUpn,\n TargetUserId,\n TargetUserAadId,\n TargetUserUpn,\n ParentProcessName,\n TargetProcessFilename,\n ParentProcessCreationTime,\n TargetProcessName,\n TargetProcessCommandLine,\n TargetProcessMD5,\n TargetProcessSHA1,\n TargetProcessSHA256,\n TargetProcessIntegrityLevel,\n TargetProcessTokenElevation,\n TargetProcessCreationTime,\n TargetProcessFileCompany,\n TargetProcessFileDescription,\n TargetProcessFileProduct,\n TargetProcessFileVersion,\n TargetProcessFileInternalName,\n TargetProcessFileOriginalName,\n TargetProcessFileSize,\n ActingProcessName,\n ActingProcessFilename,\n ActingProcessCommandLine,\n ActingProcessMD5,\n ActingProcessSHA1,\n ActingProcessSHA256,\n ActingProcessIntegrityLevel,\n ActingProcessTokenElevation,\n ActingProcessCreationTime,\n ActingProcessFileCompany,\n ActingProcessFileDescription,\n ActingProcessFileProduct,\n ActingProcessFileVersion,\n ActingProcessFileInternalName,\n ActingProcessFileOriginalName,\n ActingProcessFileSize,\n User,\n CommandLine,\n Process,\n Dvc,\n AdditionalFields\n };\n parser (disabled = disabled)",
"query": "let parser=(disabled:boolean=false)\n {\n DeviceProcessEvents \n | where not(disabled)\n | extend\n Type = \"DeviceProcessEvents\",\n EventOriginalUid = tostring(ReportId),\n EventCount = int(1),\n EventProduct = 'M365 Defender for Endpoint',\n EventVendor = 'Microsoft',\n EventSchemaVersion = '0.1.4',\n EventSchema = 'ProcessEvent',\n EventStartTime = todatetime(Timestamp),\n EventEndTime = todatetime(Timestamp),\n EventResult = 'Success'\n | extend\n EventUid = EventOriginalUid,\n ActorUsername = iff (InitiatingProcessAccountDomain == '', InitiatingProcessAccountName, strcat(InitiatingProcessAccountDomain, '\\\\', InitiatingProcessAccountName)),\n TargetUsername = iff (AccountDomain == '', AccountName, strcat(AccountDomain, '\\\\', AccountName)),\n TargetUsernameType = iff(AccountDomain == '','Simple', 'Windows'),\n ActorUsernameType = iff(InitiatingProcessAccountDomain == '','Simple', 'Windows'),\n ActorUserIdType = 'SID',\n TargetUserIdType = 'SID',\n ActorSessionId = tostring(InitiatingProcessLogonId),\n TargetUserSessionId = tostring(LogonId),\n Hash = coalesce (SHA256, SHA1, MD5, \"\"),\n TargetProcessId = tostring(ProcessId),\n ActingProcessId = tostring(InitiatingProcessId),\n ParentProcessId = tostring(InitiatingProcessParentId),\n DvcOs = iff (AdditionalFields has \"ProcessPosixProcessGroupId\", \"Linux\", \"Windows\"),\n TargetProcessFileSize = iif(FileSize != 0, FileSize, dynamic(null)),\n ActingProcessFileSize = iif(InitiatingProcessFileSize != 0, InitiatingProcessFileSize, dynamic(null))\n | extend\n HashType = tostring(dynamic([\"SHA256\", \"SHA1\", \"MD5\"])[array_index_of(pack_array(SHA256, SHA1, MD5),Hash)])\n | invoke _ASIM_ResolveDvcFQDN('DeviceName')\n | project-rename\n DvcId = DeviceId,\n EventType = ActionType,\n ActorUserId = InitiatingProcessAccountSid,\n ActorUserAadId = InitiatingProcessAccountObjectId,\n ActorUserUpn = InitiatingProcessAccountUpn,\n TargetUserId = AccountSid,\n TargetUserAadId = AccountObjectId,\n TargetUserUpn = AccountUpn,\n ParentProcessName = InitiatingProcessParentFileName,\n TargetProcessFilename = FileName,\n TargetProcessFileCompany = ProcessVersionInfoCompanyName,\n TargetProcessFileDescription = ProcessVersionInfoFileDescription,\n TargetProcessFileProduct = ProcessVersionInfoProductName,\n TargetProcessFileVersion = ProcessVersionInfoProductVersion,\n TargetProcessFileInternalName = ProcessVersionInfoInternalFileName,\n TargetProcessFileOriginalName = ProcessVersionInfoOriginalFileName,\n ParentProcessCreationTime = InitiatingProcessParentCreationTime,\n TargetProcessName = FolderPath,\n TargetProcessCommandLine = ProcessCommandLine,\n TargetProcessMD5 = MD5,\n TargetProcessSHA1 = SHA1,\n TargetProcessSHA256 = SHA256,\n TargetProcessIntegrityLevel = ProcessIntegrityLevel,\n TargetProcessTokenElevation = ProcessTokenElevation,\n TargetProcessCreationTime = ProcessCreationTime,\n ActingProcessName = InitiatingProcessFolderPath, \n ActingProcessFilename = InitiatingProcessFileName,\n ActingProcessFileCompany = InitiatingProcessVersionInfoCompanyName,\n ActingProcessFileDescription = InitiatingProcessVersionInfoFileDescription,\n ActingProcessFileProduct = InitiatingProcessVersionInfoProductName,\n ActingProcessFileVersion = InitiatingProcessVersionInfoProductVersion,\n ActingProcessFileInternalName = InitiatingProcessVersionInfoInternalFileName,\n ActingProcessFileOriginalName = InitiatingProcessVersionInfoOriginalFileName,\n ActingProcessCommandLine = InitiatingProcessCommandLine, \n ActingProcessMD5 = InitiatingProcessMD5, \n ActingProcessSHA1 = InitiatingProcessSHA1, \n ActingProcessSHA256 = InitiatingProcessSHA256, \n ActingProcessIntegrityLevel = InitiatingProcessIntegrityLevel,\n ActingProcessTokenElevation = InitiatingProcessTokenElevation,\n ActingProcessCreationTime = InitiatingProcessCreationTime\n | extend\n ActorUsernameType = _ASIM_GetUsernameType(ActorUsername),\n TargetUsernameType = _ASIM_GetUsernameType(TargetUsername)\n | extend // -- aliases\n User = coalesce(TargetUsername, ActorUsername),\n CommandLine = TargetProcessCommandLine,\n Process = TargetProcessName,\n Dvc = DvcHostname,\n AdditionalFields = todynamic(AdditionalFields)\n | project\n TimeGenerated,\n Type,\n EventUid,\n EventOriginalUid,\n EventCount,\n EventProduct,\n EventVendor,\n EventSchemaVersion,\n EventSchema,\n EventStartTime,\n EventEndTime,\n EventResult,\n ActorUsername,\n ActorUserIdType,\n TargetUserIdType,\n ActorUsernameType,\n TargetUsername,\n TargetUsernameType,\n ActorSessionId,\n TargetUserSessionId,\n Hash,\n TargetProcessId,\n ActingProcessId,\n ParentProcessId,\n DvcOs,\n HashType,\n DvcId,\n DvcHostname,\n DvcDomain,\n DvcDomainType,\n EventType,\n ActorUserId,\n ActorUserAadId,\n ActorUserUpn,\n TargetUserId,\n TargetUserAadId,\n TargetUserUpn,\n ParentProcessName,\n TargetProcessFilename,\n ParentProcessCreationTime,\n TargetProcessName,\n TargetProcessCommandLine,\n TargetProcessMD5,\n TargetProcessSHA1,\n TargetProcessSHA256,\n TargetProcessIntegrityLevel,\n TargetProcessTokenElevation,\n TargetProcessCreationTime,\n TargetProcessFileCompany,\n TargetProcessFileDescription,\n TargetProcessFileProduct,\n TargetProcessFileVersion,\n TargetProcessFileInternalName,\n TargetProcessFileOriginalName,\n TargetProcessFileSize,\n ActingProcessName,\n ActingProcessFilename,\n ActingProcessCommandLine,\n ActingProcessMD5,\n ActingProcessSHA1,\n ActingProcessSHA256,\n ActingProcessIntegrityLevel,\n ActingProcessTokenElevation,\n ActingProcessCreationTime,\n ActingProcessFileCompany,\n ActingProcessFileDescription,\n ActingProcessFileProduct,\n ActingProcessFileVersion,\n ActingProcessFileInternalName,\n ActingProcessFileOriginalName,\n ActingProcessFileSize,\n User,\n CommandLine,\n Process,\n Dvc,\n AdditionalFields\n };\n parser (disabled = disabled)",
"version": 1,
"functionParameters": "disabled:bool=False"
}
Expand Down
2 changes: 1 addition & 1 deletion Parsers/ASimProcessEvent/ARM/ASimProcessEventNative/ASimProcessEventNative.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
"displayName": "Process Event ASIM parser for Microsoft Sentinel native Process Event table",
"category": "ASIM",
"FunctionAlias": "ASimProcessEventNative",
"query": "let parser=(disabled: bool=false) {\n ASimProcessEventLogs \n | where not(disabled)\n | project-rename\n EventUid = _ItemId\n | extend \n EventSchema = \"ProcessEvent\",\n DvcScopeId = iff(isempty(DvcScopeId), _SubscriptionId, DvcScopeId)\n // -- Aliases\n | extend\n EventEndTime = iff (isnull(EventEndTime), TimeGenerated, EventEndTime),\n EventStartTime = iff (isnull(EventEndTime), TimeGenerated, EventStartTime),\n Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId),\n Rule = coalesce(RuleName, tostring(RuleNumber)),\n User = TargetUsername,\n Process = TargetProcessName,\n CommandLine = TargetProcessCommandLine,\n Hash = coalesce(TargetProcessSHA512, TargetProcessSHA256, TargetProcessMD5, TargetProcessSHA1, TargetProcessIMPHASH)\n | project-away\n TenantId,\n SourceSystem,\n _SubscriptionId,\n _ResourceId\n};\nparser (disabled=disabled)\n",
"query": "let parser=(disabled: bool=false) {\n ASimProcessEventLogs \n | where not(disabled)\n | project-rename\n EventUid = _ItemId\n | extend \n EventSchema = \"ProcessEvent\",\n RuleNumber = toint(RuleNumber),\n DvcScopeId = iff(isempty(DvcScopeId), _SubscriptionId, DvcScopeId)\n // -- Aliases\n | extend\n EventEndTime = iff (isnull(EventEndTime), TimeGenerated, EventEndTime),\n EventStartTime = iff (isnull(EventEndTime), TimeGenerated, EventStartTime),\n Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId),\n Rule = coalesce(RuleName, tostring(RuleNumber)),\n User = TargetUsername,\n Process = TargetProcessName,\n CommandLine = TargetProcessCommandLine,\n Hash = coalesce(TargetProcessSHA512, TargetProcessSHA256, TargetProcessMD5, TargetProcessSHA1, TargetProcessIMPHASH)\n | project-away\n TenantId,\n SourceSystem,\n _SubscriptionId,\n _ResourceId\n};\nparser (disabled=disabled)\n",
"version": 1,
"functionParameters": "disabled:bool=False"
}
Expand Down
Loading
Loading