Derrick Lee (yummyblabla) · Oct 29, 2026 · Oct 27, 2026 · Oct 28, 2026 · Oct 28, 2026 · Oct 28, 2026
@@ -0,0 +1,174 @@
+Parser:
+  DisplayName: "Ingestion-time Process Event ASIM parser for CrowdStrike Falcon Endpoint Protection"
+  Version: "0.1.0"
+  LastUpdated: "2026-10-27"
+Product:
+  Name: "CrowdStrike Falcon Endpoint Protection"
+Normalization:
+  Schema: "ProcessEvent"
+  Version: "1.0.0"
+Author: "Microsoft"
+Description: |
+  Normalizes the accepted CrowdStrike_Process_Events_CL process observations, creation, termination, and termination requests to ASimProcessEventLogs during ingestion.
+ParserName: "ASimProcessEventCrowdStrikeFalconEndpointProtection"
+DCRType: "Standard"
+InputStream: "Custom-CrowdStrike_Process_Events_CL"
+SourceRawTable: "CrowdStrike_Process_Events_CL"
+TargetASIMTable: "ASimProcessEventLogs"
+ParserFilterQuery: |
+  source
+  | where event_simpleName in ('WmiCreateProcess', 'UnsignedModuleLoad', 'TerminateProcess', 'SyntheticProcessRollup2', 'ProcessSelfDeleted', 'ProcessRollup2', 'ProcessInjection', 'ProcessBlocked', 'ModuleLoadV3DetectInfo', 'FileWrittenAndExecutedInContainer', 'ExecutableDeleted', 'EndOfProcess')
+ParserQuery: |
+  source
+  | extend Type = "CrowdStrike_Process_Events_CL"
+  | where event_simpleName in ('WmiCreateProcess', 'UnsignedModuleLoad', 'TerminateProcess', 'SyntheticProcessRollup2', 'ProcessSelfDeleted', 'ProcessRollup2', 'ProcessInjection', 'ProcessBlocked', 'ModuleLoadV3DetectInfo', 'FileWrittenAndExecutedInContainer', 'ExecutableDeleted', 'EndOfProcess')
+  | extend
+      _SourceFields = pack(
+          "SourceAdditionalFields", AdditionalFields,
+          "ContextTimeStamp", ContextTimeStamp, "ConfigBuild", ConfigBuild, "ConfigStateHash", ConfigStateHash,
+          "ContextProcessId", ContextProcessId, "ContextThreadId", ContextThreadId, "BoundingLimitCount", BoundingLimitCount,
+          "BoundingLimitDuration", BoundingLimitDuration, "Entitlements", Entitlements, "EffectiveTransmissionClass", EffectiveTransmissionClass,
+          "OciContainerId", OciContainerId, "TreeId", TreeId,
+          "InjecteeImageFileName", InjecteeImageFileName, "InjectorImageFileName", InjectorImageFileName,
+          "ParentProcessId", ParentProcessId, "TargetProcessId", TargetProcessId, "ConHostProcessId", ConHostProcessId,
+          "WritingProcessId", WritingProcessId, "SourceProcessId", SourceProcessId, "TargetFileName", TargetFileName,
+          "WritingProcessImageFileName", WritingProcessImageFileName, "WritingProcessCommandLine", WritingProcessCommandLine,
+          "ProcessEndTime", ProcessEndTime, "ModuleName", ModuleName, "TokenType", TokenType,
+          "RpcClientProcessId", RpcClientProcessId, "TemplateInstanceId", TemplateInstanceId,
+          "PatternId", PatternId, "Tags", Tags,
+          "ProcessGroupId", ProcessGroupId, "SyntheticPR2Flags", SyntheticPR2Flags,
+          "ImageSubsystem", ImageSubsystem, "SourceThreadId", SourceThreadId, "AuthenticodeHashData", AuthenticodeHashData,
+          "SessionId", SessionId, "ParentAuthenticationId", ParentAuthenticationId, "SignInfoFlags", SignInfoFlags,
+          "CallStackModuleNamesVersion", CallStackModuleNamesVersion, "CsaProcessDataCollectionInstanceId", CsaProcessDataCollectionInstanceId, "CallStackModuleNames", CallStackModuleNames,
+          "CreateProcessType", CreateProcessType, "ZoneIdentifier", ZoneIdentifier, "HostUrl", HostUrl,
+          "TargetThreadId", TargetThreadId, "SignatureErrorState", SignatureErrorState, "ModuleCharacteristics", ModuleCharacteristics,
+          "PublicKeys", PublicKeys, "ExtendedKeyUsages", ExtendedKeyUsages, "SignatureState", SignatureState,
+          "MappedFromUserMode", MappedFromUserMode, "FileSigningTime", FileSigningTime, "Certificate", Certificate,
+          "FileIdentifier", FileIdentifier, "ExecutableBytes", ExecutableBytes, "LoadingProcessOriginalFilename", LoadingProcessOriginalFilename,
+          "ModuleTagsAsString", ModuleTagsAsString, "ImageDirectoryClassification", ImageDirectoryClassification, "ParentProcessPatternIdList", ParentProcessPatternIdList,
+          "ModuleLoadMechanism", ModuleLoadMechanism, "PatternIdList", PatternIdList, "ScreenshotsTakenCount", ScreenshotsTakenCount,
+          "NetworkListenCount", NetworkListenCount, "SuspiciousRawDiskReadCount", SuspiciousRawDiskReadCount,
+          "NetworkBindCount", NetworkBindCount, "NetworkRecvAcceptCount", NetworkRecvAcceptCount, "ContextData", ContextData,
+          "NewExecutableWrittenCount", NewExecutableWrittenCount, "ExeAndServiceCount", ExeAndServiceCount, "NetworkCloseCount", NetworkCloseCount,
+          "SuspectStackCount", SuspectStackCount, "CLICreationCount", CLICreationCount, "UnsignedModuleLoadCount", UnsignedModuleLoadCount,
+          "UserTime", UserTime, "AllocateVirtualMemoryCount", AllocateVirtualMemoryCount, "ServiceEventCount", ServiceEventCount,
+          "SnapshotFileOpenCount", SnapshotFileOpenCount, "RemovableDiskFileWrittenCount", RemovableDiskFileWrittenCount, "InjectedDllCount", InjectedDllCount,
+          "ModuleLoadCount", ModuleLoadCount, "UserMemoryProtectExecutableCount", UserMemoryProtectExecutableCount, "NetworkCapableAsepWriteCount", NetworkCapableAsepWriteCount,
+          "DnsRequestCount", DnsRequestCount, "ArchiveFileWrittenCount", ArchiveFileWrittenCount, "SetThreadContextCount", SetThreadContextCount,
+          "SuspiciousCredentialModuleLoadCount", SuspiciousCredentialModuleLoadCount, "FileDeletedCount", FileDeletedCount, "UserMemoryAllocateExecutableCount", UserMemoryAllocateExecutableCount,
+          "DirectoryCreatedCount", DirectoryCreatedCount, "NetworkConnectCountUdp", NetworkConnectCountUdp, "QueueApcCount", QueueApcCount,
+          "SuspiciousFontLoadCount", SuspiciousFontLoadCount, "ConHostId", ConHostId, "NetworkConnectCount", NetworkConnectCount,
+          "BinaryExecutableWrittenCount", BinaryExecutableWrittenCount, "CycleTime", CycleTime, "PrivilegedProcessHandleCount", PrivilegedProcessHandleCount,
+          "MaxThreadCount", MaxThreadCount, "GenericFileWrittenCount", GenericFileWrittenCount, "ScriptEngineInvocationCount", ScriptEngineInvocationCount,
+          "RunDllInvocationCount", RunDllInvocationCount, "CreateProcessCount", CreateProcessCount, "KernelTime", KernelTime,
+          "DirectoryEnumeratedCount", DirectoryEnumeratedCount, "AsepWrittenCount", AsepWrittenCount, "SuspiciousDnsRequestCount", SuspiciousDnsRequestCount,
+          "DocumentFileWrittenCount", DocumentFileWrittenCount, "ProtectVirtualMemoryCount", ProtectVirtualMemoryCount, "UserMemoryProtectExecutableRemoteCount", UserMemoryProtectExecutableRemoteCount,
+          "UserMemoryAllocateExecutableRemoteCount", UserMemoryAllocateExecutableRemoteCount, "ExecutableDeletedCount", ExecutableDeletedCount, "RegKeySecurityDecreasedCount", RegKeySecurityDecreasedCount,
+          "InjectedThreadCount", InjectedThreadCount, "NetworkModuleLoadCount", NetworkModuleLoadCount, "ThreadStartAddress", ThreadStartAddress,
+          "ThreadExecutionControlType", ThreadExecutionControlType, "PayloadClassification", PayloadClassification, "PayloadClassificationFlags", PayloadClassificationFlags,
+          "MemoryDescriptionFlags", MemoryDescriptionFlags, "WellKnownTargetFunction", WellKnownTargetFunction, "RemoteAddressIP4", RemoteAddressIP4)
+  | extend
+      _IsCreate = event_simpleName in ("ProcessRollup2", "SyntheticProcessRollup2"),
+      _IsTerminationRequest = event_simpleName == "TerminateProcess",
+      _EventTime = iif(isnotnull((datetime(1970-01-01) + timestamp * 1ms)), (datetime(1970-01-01) + timestamp * 1ms), TimeGenerated),
+      _Hostname = tostring(columnifexists("ComputerName", "")),
+      _OsPid = tostring(tolong(RawProcessId)),
+      _UsernameType = case(isempty(UserName), "", UserName contains "\\", "Windows",
+          UserName contains "@", "UPN", "Simple")
+  | project-rename
+      EventOriginalType = event_simpleName,
+      EventOriginalSubType = name,
+      EventOriginalUid = CrowdStrikeId,
+      DvcId = aid,
+      DvcScopeId = cid,
+      DvcIpAddr = aip
+  | extend
+      EventType = iff(_IsCreate, "ProcessCreated", "ProcessTerminated"),
+      EventStartTime = _EventTime,
+      EventEndTime = _EventTime,
+      EventCount = toint(1),
+      EventResult = iff(_IsTerminationRequest, "NA", "Success"),
+      EventVendor = "CrowdStrike",
+      EventProduct = "Falcon Endpoint Protection",
+      EventSchema = "ProcessEvent",
+      EventSchemaVersion = "1.0.0",
+      EventSeverity = "Informational",
+      EventUid = EventOriginalUid,
+      DvcIdType = iff(isnotempty(DvcId), "Other", ""),
+      DvcHostname = _Hostname,
+      DvcOs = case(event_platform == "Win", "Windows", event_platform == "Lin", "Linux",
+          event_platform == "Mac", "macOS", ""),
+      TargetProcessId = iff(_IsTerminationRequest, "", _OsPid),
+      TargetProcessName = iff(_IsTerminationRequest, "", ImageFileName),
+      TargetProcessCommandLine = iff(_IsTerminationRequest, "", CommandLine),
+      TargetProcessCreationTime = iff(not(_IsTerminationRequest) and ProcessStartTime > 0,
+          (datetime(1970-01-01) + ProcessStartTime * 1s), datetime(null)),
+      TargetProcessFileOriginalName = iff(_IsTerminationRequest, "", OriginalFilename),
+      TargetProcessIntegrityLevel = iff(_IsTerminationRequest, "",
+          case(IntegrityLevel == "0", "Untrusted", IntegrityLevel == "4096", "Low",
+              IntegrityLevel == "8192", "Medium", IntegrityLevel == "8448", "MediumPlus",
+              IntegrityLevel == "12288", "High", IntegrityLevel == "16384", "System",
+              IntegrityLevel == "20480", "ProtectedProcess", "")),
+      TargetProcessMD5 = iff(not(_IsTerminationRequest) and strlen(MD5HashData) == 32
+          and MD5HashData != "00000000000000000000000000000000", tolower(MD5HashData), ""),
+      TargetProcessSHA1 = iff(not(_IsTerminationRequest) and strlen(SHA1HashData) == 40
+          and SHA1HashData != "0000000000000000000000000000000000000000", tolower(SHA1HashData), ""),
+      TargetProcessSHA256 = iff(not(_IsTerminationRequest) and strlen(SHA256HashData) == 64
+          and SHA256HashData != "0000000000000000000000000000000000000000000000000000000000000000", tolower(SHA256HashData), ""),
+      TargetProcessStatusCode = iff(EventOriginalType == "EndOfProcess", ExitCode, ""),
+      ActingProcessId = iff(_IsTerminationRequest, _OsPid, ""),
+      ActingProcessName = case(_IsCreate, iif(isnotempty(ParentImageFileName), ParentImageFileName, ParentBaseFileName),
+          _IsTerminationRequest, ImageFileName, ""),
+      ActingProcessCommandLine = case(_IsCreate, ParentCommandLine, _IsTerminationRequest, CommandLine, ""),
+      ActorUsername = iff(_IsTerminationRequest, UserName, ""),
+      ActorUsernameType = iff(_IsTerminationRequest, _UsernameType, ""),
+      ActorUserId = iff(_IsTerminationRequest, UserSid, ""),
+      ActorUserIdType = iff(_IsTerminationRequest and isnotempty(UserSid), "SID", ""),
+      ActorSessionId = iff(_IsTerminationRequest, AuthenticationId, ""),
+      TargetUsername = iff(_IsTerminationRequest, "", UserName),
+      TargetUsernameType = iff(_IsTerminationRequest, "", _UsernameType),
+      TargetUserId = iff(_IsTerminationRequest, "", UserSid),
+      TargetUserIdType = iff(not(_IsTerminationRequest) and isnotempty(UserSid), "SID", ""),
+      TargetUserSessionId = iff(_IsTerminationRequest, "", AuthenticationId),
+      ParentProcessName = "",
+      AdditionalFields = _SourceFields,
+      DvcEntityKey = "",
+      ActingProcessEntityKey = "",
+      ActorUserEntityKey = "",
+      ActorUserAdditionalIds = parse_json('[]'),
+      ParentProcessEntityKey = "",
+      TargetProcessEntityKey = "",
+      TargetUserEntityKey = "",
+      TargetUserAdditionalIds = parse_json('[]'),
+      AdditionalEntities = parse_json('[]')
+  | extend
+      _TargetParts = split(replace(@"\\", "/", TargetProcessName), "/"),
+      _ActingParts = split(replace(@"\\", "/", ActingProcessName), "/")
+  | extend
+      Dvc = iif(isnotempty(DvcHostname), DvcHostname, iif(isnotempty(DvcIpAddr), DvcIpAddr, DvcId)),
+      TargetProcessFilename = tostring(_TargetParts[array_length(_TargetParts) - 1]),
+      ActingProcessFilename = tostring(_ActingParts[array_length(_ActingParts) - 1]),
+      Hash = iif(isnotempty(TargetProcessSHA256), TargetProcessSHA256, iif(isnotempty(TargetProcessSHA1), TargetProcessSHA1, TargetProcessMD5)),
+      HashType = case(isnotempty(TargetProcessSHA256), "SHA256",
+          isnotempty(TargetProcessSHA1), "SHA", isnotempty(TargetProcessMD5), "MD5", ""),
+      User = TargetUsername,
+      Process = TargetProcessName,
+      CommandLine = TargetProcessCommandLine
+  | project
+      TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, EventType, EventResult,
+      EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity,
+      EventOriginalType, EventOriginalSubType, EventOriginalUid, EventUid,
+      Dvc, DvcId, DvcIdType, DvcScopeId, DvcIpAddr, DvcHostname, DvcOs, DvcEntityKey,
+      ActorUsername, ActorUsernameType, ActorUserId, ActorUserIdType, ActorSessionId,
+      ActorUserEntityKey, ActorUserAdditionalIds,
+      ActingProcessId, ActingProcessName, ActingProcessFilename, ActingProcessCommandLine,
+      ActingProcessEntityKey, ParentProcessName, ParentProcessEntityKey,
+      TargetProcessId, TargetProcessName, TargetProcessFilename, TargetProcessCommandLine,
+      TargetProcessCreationTime, TargetProcessFileOriginalName, TargetProcessIntegrityLevel,
+      TargetProcessMD5, TargetProcessSHA1, TargetProcessSHA256, TargetProcessStatusCode,
+      TargetProcessEntityKey, TargetUsername, TargetUsernameType, TargetUserId,
+      TargetUserIdType, TargetUserSessionId, TargetUserEntityKey, TargetUserAdditionalIds,
+      User, Process, CommandLine, Hash, HashType, AdditionalFields, AdditionalEntities
+Change:
+  Date: "2026-10-27"
+  Description: "Initial ingestion-time conversion."