diff --git a/Parsers/ASimEmailEvent/ARM/ASimEmailEventProofpointTAPClicksPermitted/ASimEmailEventProofpointTAPClicksPermitted.json b/Parsers/ASimEmailEvent/ARM/ASimEmailEventProofpointTAPClicksPermitted/ASimEmailEventProofpointTAPClicksPermitted.json index f54cd8e456a..5e9af96035d 100644 --- a/Parsers/ASimEmailEvent/ARM/ASimEmailEventProofpointTAPClicksPermitted/ASimEmailEventProofpointTAPClicksPermitted.json +++ b/Parsers/ASimEmailEvent/ARM/ASimEmailEventProofpointTAPClicksPermitted/ASimEmailEventProofpointTAPClicksPermitted.json @@ -27,7 +27,7 @@ "displayName": "ASIM Email Event parser for Proofpoint TAP permitted clicks", "category": "ASIM", "FunctionAlias": "ASimEmailEventProofpointTAPClicksPermitted", - "query": "let parser = (disabled:bool=false, pack:bool=false) {\n ProofPointTAPClicksPermittedV2_CL\n | where not(disabled)\n | project-rename\n Dst=recipient,\n EmailMailFromAddress=sender,\n SrcIpAddr=clickIP,\n ThreatId=threatID,\n ThreatOriginalCategory=classification,\n ThreatFirstReportedTime=threatTime,\n EventReportUrl=threatURL\n | extend\n EventVendor=\"Proofpoint\",\n EventProduct=\"TAP\",\n EventSchema=\"EmailEvent\",\n EventSchemaVersion=\"1.0.0\",\n EventType=\"EmailInteraction\",\n EventOriginalType=\"clicksPermitted\",\n EventOriginalUid=tostring(column_ifexists(\"id\", \"\")),\n EventCount=int(1),\n EventStartTime=coalesce(clickTime, TimeGenerated),\n EventResult=\"NA\",\n DvcOriginalAction=\"Permitted\",\n DvcAction=\"NA\",\n DvcEntityKey=\"\",\n EmailDirection=\"Unknown\",\n EmailUrls=iff(isempty(url), dynamic([]), pack_array(url)),\n AdditionalEntities=dynamic([]),\n AdditionalFields=iff(pack, bag_pack(\n \"CampaignId\", campaignId,\n \"MessageGuid\", GUID,\n \"MessageId\", messageID,\n \"SenderIpAddr\", senderIP,\n \"ThreatStatus\", threatStatus,\n \"UserAgent\", userAgent), dynamic({}))\n | extend\n EventEndTime=EventStartTime,\n Dvc=EventProduct,\n Src=SrcIpAddr,\n IpAddr=SrcIpAddr,\n EmailMailFromDomain=tostring(split(EmailMailFromAddress, \"@\")[1]),\n ThreatCategory=case(\n ThreatOriginalCategory =~ \"malware\", \"Malware\",\n ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"Phishing\",\n ThreatOriginalCategory =~ \"spam\", \"Spam\",\n \"\"),\n ThreatIsActive=case(\n threatStatus =~ \"active\", true,\n threatStatus in~ (\"cleared\", \"falsepositive\"), false,\n bool(null)),\n ThreatField=iff(isnotempty(url), \"EmailUrls\", \"\"),\n EventResultDetails=case(\n ThreatOriginalCategory =~ \"malware\", \"MalwareDetected\",\n ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"PhishingDetected\",\n isnotempty(ThreatOriginalCategory), \"Other\",\n \"\")\n | project\n TimeGenerated, Type,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion,\n EventType, EventOriginalType, EventCount, EventStartTime, EventEndTime,\n EventResult, EventResultDetails, EventOriginalUid, EventReportUrl,\n Dvc, DvcOriginalAction, DvcAction, DvcEntityKey,\n Src, SrcIpAddr, IpAddr, Dst,\n EmailMailFromAddress, EmailMailFromDomain, EmailDirection, EmailUrls,\n ThreatId, ThreatOriginalCategory, ThreatCategory, ThreatIsActive,\n ThreatFirstReportedTime, ThreatField,\n AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n", + "query": "let parser = (disabled:bool=false, pack:bool=false) {\n ProofPointTAPClicksPermittedV2_CL\n | where not(disabled)\n | project-rename\n Dst=recipient,\n EmailMailFromAddress=sender,\n SrcIpAddr=clickIP,\n ThreatId=threatID,\n ThreatOriginalCategory=classification,\n ThreatFirstReportedTime=threatTime,\n EventReportUrl=threatURL\n | extend\n EventVendor=\"Proofpoint\",\n EventProduct=\"TAP\",\n EventSchema=\"EmailEvent\",\n EventSchemaVersion=\"1.0.0\",\n EventType=\"EmailInteraction\",\n EventOriginalType=\"clicksPermitted\",\n EventOriginalUid=tostring(id),\n EventCount=int(1),\n EventStartTime=coalesce(clickTime, TimeGenerated),\n EventResult=\"NA\",\n DvcOriginalAction=\"Permitted\",\n DvcAction=\"NA\",\n DvcEntityKey=\"\",\n EmailDirection=\"Unknown\",\n EmailUrls=iff(isempty(url), dynamic([]), pack_array(url)),\n AdditionalEntities=dynamic([]),\n AdditionalFields=iff(pack, bag_pack(\n \"CampaignId\", campaignId,\n \"MessageGuid\", GUID,\n \"MessageId\", messageID,\n \"SenderIpAddr\", senderIP,\n \"ThreatStatus\", threatStatus,\n \"UserAgent\", userAgent), dynamic({}))\n | extend\n EventEndTime=EventStartTime,\n Dvc=EventProduct,\n Src=SrcIpAddr,\n IpAddr=SrcIpAddr,\n EmailMailFromDomain=tostring(split(EmailMailFromAddress, \"@\")[1]),\n ThreatCategory=case(\n ThreatOriginalCategory =~ \"malware\", \"Malware\",\n ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"Phishing\",\n ThreatOriginalCategory =~ \"spam\", \"Spam\",\n \"\"),\n ThreatIsActive=case(\n threatStatus =~ \"active\", true,\n threatStatus in~ (\"cleared\", \"falsepositive\"), false,\n bool(null)),\n ThreatField=iff(isnotempty(url), \"EmailUrls\", \"\"),\n EventResultDetails=case(\n ThreatOriginalCategory =~ \"malware\", \"MalwareDetected\",\n ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"PhishingDetected\",\n isnotempty(ThreatOriginalCategory), \"Other\",\n \"\")\n | project\n TimeGenerated, Type,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion,\n EventType, EventOriginalType, EventCount, EventStartTime, EventEndTime,\n EventResult, EventResultDetails, EventOriginalUid, EventReportUrl,\n Dvc, DvcOriginalAction, DvcAction, DvcEntityKey,\n Src, SrcIpAddr, IpAddr, Dst,\n EmailMailFromAddress, EmailMailFromDomain, EmailDirection, EmailUrls,\n ThreatId, ThreatOriginalCategory, ThreatCategory, ThreatIsActive,\n ThreatFirstReportedTime, ThreatField,\n AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n", "version": 1, "functionParameters": "disabled:bool=False,pack:bool=False" } diff --git a/Parsers/ASimEmailEvent/ARM/vimEmailEventProofpointTAPClicksPermitted/vimEmailEventProofpointTAPClicksPermitted.json b/Parsers/ASimEmailEvent/ARM/vimEmailEventProofpointTAPClicksPermitted/vimEmailEventProofpointTAPClicksPermitted.json index e115bf21948..591591bc19a 100644 --- a/Parsers/ASimEmailEvent/ARM/vimEmailEventProofpointTAPClicksPermitted/vimEmailEventProofpointTAPClicksPermitted.json +++ b/Parsers/ASimEmailEvent/ARM/vimEmailEventProofpointTAPClicksPermitted/vimEmailEventProofpointTAPClicksPermitted.json @@ -27,7 +27,7 @@ "displayName": "ASIM Email Event filtering parser for Proofpoint TAP permitted clicks", "category": "ASIM", "FunctionAlias": "vimEmailEventProofpointTAPClicksPermitted", - "query": "let parser = (\n starttime:datetime=datetime(null),\n endtime:datetime=datetime(null),\n ipaddr_has_any_prefix:dynamic=dynamic([]),\n emailfromaddress_has_any:dynamic=dynamic([]),\n emailrecipient_has_any:dynamic=dynamic([]),\n emailsubject_has_any:dynamic=dynamic([]),\n emaildirection_in:dynamic=dynamic([]),\n emaildeliverylocation_in:dynamic=dynamic([]),\n eventresult:string=\"*\",\n disabled:bool=false,\n pack:bool=false\n) {\n ProofPointTAPClicksPermittedV2_CL\n | where not(disabled)\n | where isnull(starttime)\n or clickTime >= starttime\n or (isnull(clickTime) and TimeGenerated >= starttime)\n | where isnull(endtime)\n or clickTime <= endtime\n or (isnull(clickTime) and TimeGenerated <= endtime)\n | where array_length(ipaddr_has_any_prefix) == 0\n or has_any_ipv4_prefix(clickIP, ipaddr_has_any_prefix)\n | where array_length(emailrecipient_has_any) == 0\n or recipient has_any (emailrecipient_has_any)\n | where array_length(emaildirection_in) == 0\n or \"Unknown\" in~ (emaildirection_in)\n | where eventresult == \"*\" or eventresult =~ \"NA\"\n // This source does not supply header From, subject, or delivery location.\n | where array_length(emailfromaddress_has_any) == 0\n | where array_length(emailsubject_has_any) == 0\n | where array_length(emaildeliverylocation_in) == 0\n | project-rename\n Dst=recipient,\n EmailMailFromAddress=sender,\n SrcIpAddr=clickIP,\n ThreatId=threatID,\n ThreatOriginalCategory=classification,\n ThreatFirstReportedTime=threatTime,\n EventReportUrl=threatURL\n | extend\n EventVendor=\"Proofpoint\",\n EventProduct=\"TAP\",\n EventSchema=\"EmailEvent\",\n EventSchemaVersion=\"1.0.0\",\n EventType=\"EmailInteraction\",\n EventOriginalType=\"clicksPermitted\",\n EventOriginalUid=tostring(column_ifexists(\"id\", \"\")),\n EventCount=int(1),\n EventStartTime=coalesce(clickTime, TimeGenerated),\n EventResult=\"NA\",\n DvcOriginalAction=\"Permitted\",\n DvcAction=\"NA\",\n DvcEntityKey=\"\",\n EmailDirection=\"Unknown\",\n EmailUrls=iff(isempty(url), dynamic([]), pack_array(url)),\n AdditionalEntities=dynamic([]),\n AdditionalFields=iff(pack, bag_pack(\n \"CampaignId\", campaignId,\n \"MessageGuid\", GUID,\n \"MessageId\", messageID,\n \"SenderIpAddr\", senderIP,\n \"ThreatStatus\", threatStatus,\n \"UserAgent\", userAgent), dynamic({}))\n | extend\n EventEndTime=EventStartTime,\n Dvc=EventProduct,\n Src=SrcIpAddr,\n IpAddr=SrcIpAddr,\n EmailMailFromDomain=tostring(split(EmailMailFromAddress, \"@\")[1]),\n ThreatCategory=case(\n ThreatOriginalCategory =~ \"malware\", \"Malware\",\n ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"Phishing\",\n ThreatOriginalCategory =~ \"spam\", \"Spam\",\n \"\"),\n ThreatIsActive=case(\n threatStatus =~ \"active\", true,\n threatStatus in~ (\"cleared\", \"falsepositive\"), false,\n bool(null)),\n ThreatField=iff(isnotempty(url), \"EmailUrls\", \"\"),\n EventResultDetails=case(\n ThreatOriginalCategory =~ \"malware\", \"MalwareDetected\",\n ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"PhishingDetected\",\n isnotempty(ThreatOriginalCategory), \"Other\",\n \"\")\n | project\n TimeGenerated, Type,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion,\n EventType, EventOriginalType, EventCount, EventStartTime, EventEndTime,\n EventResult, EventResultDetails, EventOriginalUid, EventReportUrl,\n Dvc, DvcOriginalAction, DvcAction, DvcEntityKey,\n Src, SrcIpAddr, IpAddr, Dst,\n EmailMailFromAddress, EmailMailFromDomain, EmailDirection, EmailUrls,\n ThreatId, ThreatOriginalCategory, ThreatCategory, ThreatIsActive,\n ThreatFirstReportedTime, ThreatField,\n AdditionalEntities, AdditionalFields\n};\nparser(starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, emailfromaddress_has_any=emailfromaddress_has_any, emailrecipient_has_any=emailrecipient_has_any, emailsubject_has_any=emailsubject_has_any, emaildirection_in=emaildirection_in, emaildeliverylocation_in=emaildeliverylocation_in, eventresult=eventresult, disabled=disabled, pack=pack)\n", + "query": "let parser = (\n starttime:datetime=datetime(null),\n endtime:datetime=datetime(null),\n ipaddr_has_any_prefix:dynamic=dynamic([]),\n emailfromaddress_has_any:dynamic=dynamic([]),\n emailrecipient_has_any:dynamic=dynamic([]),\n emailsubject_has_any:dynamic=dynamic([]),\n emaildirection_in:dynamic=dynamic([]),\n emaildeliverylocation_in:dynamic=dynamic([]),\n eventresult:string=\"*\",\n disabled:bool=false,\n pack:bool=false\n) {\n ProofPointTAPClicksPermittedV2_CL\n | where not(disabled)\n | where isnull(starttime)\n or clickTime >= starttime\n or (isnull(clickTime) and TimeGenerated >= starttime)\n | where isnull(endtime)\n or clickTime <= endtime\n or (isnull(clickTime) and TimeGenerated <= endtime)\n | where array_length(ipaddr_has_any_prefix) == 0\n or has_any_ipv4_prefix(clickIP, ipaddr_has_any_prefix)\n | where array_length(emailrecipient_has_any) == 0\n or recipient has_any (emailrecipient_has_any)\n | where array_length(emaildirection_in) == 0\n or \"Unknown\" in~ (emaildirection_in)\n | where eventresult == \"*\" or eventresult =~ \"NA\"\n // This source does not supply header From, subject, or delivery location.\n | where array_length(emailfromaddress_has_any) == 0\n | where array_length(emailsubject_has_any) == 0\n | where array_length(emaildeliverylocation_in) == 0\n | project-rename\n Dst=recipient,\n EmailMailFromAddress=sender,\n SrcIpAddr=clickIP,\n ThreatId=threatID,\n ThreatOriginalCategory=classification,\n ThreatFirstReportedTime=threatTime,\n EventReportUrl=threatURL\n | extend\n EventVendor=\"Proofpoint\",\n EventProduct=\"TAP\",\n EventSchema=\"EmailEvent\",\n EventSchemaVersion=\"1.0.0\",\n EventType=\"EmailInteraction\",\n EventOriginalType=\"clicksPermitted\",\n EventOriginalUid=tostring(id),\n EventCount=int(1),\n EventStartTime=coalesce(clickTime, TimeGenerated),\n EventResult=\"NA\",\n DvcOriginalAction=\"Permitted\",\n DvcAction=\"NA\",\n DvcEntityKey=\"\",\n EmailDirection=\"Unknown\",\n EmailUrls=iff(isempty(url), dynamic([]), pack_array(url)),\n AdditionalEntities=dynamic([]),\n AdditionalFields=iff(pack, bag_pack(\n \"CampaignId\", campaignId,\n \"MessageGuid\", GUID,\n \"MessageId\", messageID,\n \"SenderIpAddr\", senderIP,\n \"ThreatStatus\", threatStatus,\n \"UserAgent\", userAgent), dynamic({}))\n | extend\n EventEndTime=EventStartTime,\n Dvc=EventProduct,\n Src=SrcIpAddr,\n IpAddr=SrcIpAddr,\n EmailMailFromDomain=tostring(split(EmailMailFromAddress, \"@\")[1]),\n ThreatCategory=case(\n ThreatOriginalCategory =~ \"malware\", \"Malware\",\n ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"Phishing\",\n ThreatOriginalCategory =~ \"spam\", \"Spam\",\n \"\"),\n ThreatIsActive=case(\n threatStatus =~ \"active\", true,\n threatStatus in~ (\"cleared\", \"falsepositive\"), false,\n bool(null)),\n ThreatField=iff(isnotempty(url), \"EmailUrls\", \"\"),\n EventResultDetails=case(\n ThreatOriginalCategory =~ \"malware\", \"MalwareDetected\",\n ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"PhishingDetected\",\n isnotempty(ThreatOriginalCategory), \"Other\",\n \"\")\n | project\n TimeGenerated, Type,\n EventVendor, EventProduct, EventSchema, EventSchemaVersion,\n EventType, EventOriginalType, EventCount, EventStartTime, EventEndTime,\n EventResult, EventResultDetails, EventOriginalUid, EventReportUrl,\n Dvc, DvcOriginalAction, DvcAction, DvcEntityKey,\n Src, SrcIpAddr, IpAddr, Dst,\n EmailMailFromAddress, EmailMailFromDomain, EmailDirection, EmailUrls,\n ThreatId, ThreatOriginalCategory, ThreatCategory, ThreatIsActive,\n ThreatFirstReportedTime, ThreatField,\n AdditionalEntities, AdditionalFields\n};\nparser(starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, emailfromaddress_has_any=emailfromaddress_has_any, emailrecipient_has_any=emailrecipient_has_any, emailsubject_has_any=emailsubject_has_any, emaildirection_in=emaildirection_in, emaildeliverylocation_in=emaildeliverylocation_in, eventresult=eventresult, disabled=disabled, pack=pack)\n", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),ipaddr_has_any_prefix:dynamic=dynamic([]),emailfromaddress_has_any:dynamic=dynamic([]),emailrecipient_has_any:dynamic=dynamic([]),emailsubject_has_any:dynamic=dynamic([]),emaildirection_in:dynamic=dynamic([]),emaildeliverylocation_in:dynamic=dynamic([]),eventresult:string='*',disabled:bool=False,pack:bool=False" } diff --git a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointTAPClicksPermitted.md b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointTAPClicksPermitted.md index bb20409f31a..45b1c13f326 100644 --- a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointTAPClicksPermitted.md +++ b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointTAPClicksPermitted.md @@ -1,5 +1,10 @@ # Changelog for ASimEmailEventProofpointTAPClicksPermitted.yaml +## Version 0.1.3 + +- (2026-10-30) Read the source id directly for EventOriginalUid instead of substituting an empty value when the column is missing - [PR #15501](https://github.com/Azure/Azure-Sentinel/pull/15501) +- Require the declared source id column; retain all other mappings and packing behavior. + ## Version 0.1.2 - (2026-10-29) Read the optional source id defensively so a missing column does not prevent event normalization - [PR #15483](https://github.com/Azure/Azure-Sentinel/pull/15483) diff --git a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointTAPClicksPermittedIngestTime.md b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointTAPClicksPermittedIngestTime.md new file mode 100644 index 00000000000..9946f01be40 --- /dev/null +++ b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointTAPClicksPermittedIngestTime.md @@ -0,0 +1,12 @@ +# Changelog for ASimEmailEventProofpointTAPClicksPermittedIngestTime.yaml + +## Version 0.1.3 + +- (2026-10-30) Read the source id directly for EventOriginalUid without a missing-column fallback, matching the query-time parsers - [PR #15501](https://github.com/Azure/Azure-Sentinel/pull/15501) +- Require the declared source id column; retain one normalized event per source row and all other mappings. + +## Version 0.1.2 + +- (2026-10-29) Added the initial Proofpoint TAP permitted-click ingestion-time parser for EmailEvent interaction activity - [PR #15501](https://github.com/Azure/Azure-Sentinel/pull/15501) +- Normalize each source row into ASimEmailEventLogs while preserving the original click type, optional event identifier, click-time fallback, and threat context. +- Retain campaign, message, sender IP, threat status, and user-agent context in AdditionalFields. diff --git a/Parsers/ASimEmailEvent/CHANGELOG/vimEmailEventProofpointTAPClicksPermitted.md b/Parsers/ASimEmailEvent/CHANGELOG/vimEmailEventProofpointTAPClicksPermitted.md index 11ee53e52d4..cfc206d35ab 100644 --- a/Parsers/ASimEmailEvent/CHANGELOG/vimEmailEventProofpointTAPClicksPermitted.md +++ b/Parsers/ASimEmailEvent/CHANGELOG/vimEmailEventProofpointTAPClicksPermitted.md @@ -1,5 +1,10 @@ # Changelog for vimEmailEventProofpointTAPClicksPermitted.yaml +## Version 0.1.3 + +- (2026-10-30) Read the source id directly for EventOriginalUid instead of substituting an empty value when the column is missing - [PR #15501](https://github.com/Azure/Azure-Sentinel/pull/15501) +- Require the declared source id column; retain all existing filtering, mappings, and packing behavior. + ## Version 0.1.2 - (2026-10-29) Read the optional source id defensively while retaining the existing filtering behavior - [PR #15483](https://github.com/Azure/Azure-Sentinel/pull/15483) diff --git a/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointTAPClicksPermittedIngestTime.yaml b/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointTAPClicksPermittedIngestTime.yaml new file mode 100644 index 00000000000..4f96b03f7a0 --- /dev/null +++ b/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointTAPClicksPermittedIngestTime.yaml @@ -0,0 +1,91 @@ +Parser: + DisplayName: 'Proofpoint TAP permitted clicks ASIM EmailEvent ingestion-time parser' + Version: '0.1.3' + LastUpdated: '2026-10-30' +Product: + Name: 'Proofpoint Targeted Attack Protection' +Normalization: + Schema: 'EmailEvent' + Version: '1.0.0' +Author: 'nsethupathi' +Description: | + Normalizes ProofPointTAPClicksPermittedV2_CL URL Defense permitted-click events + into ASimEmailEventLogs as EmailInteraction activity during ingestion. + Expects the connector's raw-table shape, including TimeGenerated. +ParserName: 'ASimEmailEventProofpointTAPClicksPermittedIngestTime' +DCRType: 'Standard' +InputStream: 'Custom-ProofPointTAPClicksPermittedV2_CL' +SourceRawTable: 'ProofPointTAPClicksPermittedV2_CL' +TargetASIMTable: 'ASimEmailEventLogs' +ParserFilterQuery: | + source +ParserQuery: | + source + | extend Type = "ProofPointTAPClicksPermittedV2_CL" + | project-rename + Dst=recipient, + EmailMailFromAddress=sender, + SrcIpAddr=clickIP, + ThreatId=threatID, + ThreatOriginalCategory=classification, + ThreatFirstReportedTime=threatTime, + EventReportUrl=threatURL + | extend + EventVendor="Proofpoint", + EventProduct="TAP", + EventSchema="EmailEvent", + EventSchemaVersion="1.0.0", + EventType="EmailInteraction", + EventOriginalType="clicksPermitted", + EventOriginalUid=tostring(id), + EventCount=int(1), + EventStartTime=iif(isnotnull(clickTime), clickTime, TimeGenerated), + EventResult="NA", + DvcOriginalAction="Permitted", + DvcAction="NA", + DvcEntityKey="", + EmailDirection="Unknown", + EmailUrls=iff(isempty(url), parse_json('[]'), pack_array(url)), + AdditionalEntities=parse_json('[]'), + AdditionalFields=pack( + "CampaignId", campaignId, + "MessageGuid", GUID, + "MessageId", messageID, + "SenderIpAddr", senderIP, + "ThreatStatus", threatStatus, + "UserAgent", userAgent) + | extend + EventEndTime=EventStartTime, + Dvc=EventProduct, + Src=SrcIpAddr, + IpAddr=SrcIpAddr, + EmailMailFromDomain=tostring(split(EmailMailFromAddress, "@")[1]), + ThreatCategory=case( + ThreatOriginalCategory =~ "malware", "Malware", + tolower(ThreatOriginalCategory) in ("phish", "phishing"), "Phishing", + ThreatOriginalCategory =~ "spam", "Spam", + ""), + ThreatIsActive=case( + threatStatus =~ "active", true, + tolower(threatStatus) in ("cleared", "falsepositive"), false, + bool(null)), + ThreatField=iff(isnotempty(url), "EmailUrls", ""), + EventResultDetails=case( + ThreatOriginalCategory =~ "malware", "MalwareDetected", + tolower(ThreatOriginalCategory) in ("phish", "phishing"), "PhishingDetected", + isnotempty(ThreatOriginalCategory), "Other", + "") + | project + TimeGenerated, Type, + EventVendor, EventProduct, EventSchema, EventSchemaVersion, + EventType, EventOriginalType, EventCount, EventStartTime, EventEndTime, + EventResult, EventResultDetails, EventOriginalUid, EventReportUrl, + Dvc, DvcOriginalAction, DvcAction, DvcEntityKey, + Src, SrcIpAddr, IpAddr, Dst, + EmailMailFromAddress, EmailMailFromDomain, EmailDirection, EmailUrls, + ThreatId, ThreatOriginalCategory, ThreatCategory, ThreatIsActive, + ThreatFirstReportedTime, ThreatField, + AdditionalEntities, AdditionalFields +Change: + Date: '2026-10-30' + Description: 'Read the source id directly for EventOriginalUid without a missing-column fallback.' diff --git a/Parsers/ASimEmailEvent/Parsers/ASimEmailEventProofpointTAPClicksPermitted.yaml b/Parsers/ASimEmailEvent/Parsers/ASimEmailEventProofpointTAPClicksPermitted.yaml index f4dab1b4649..4f722c61029 100644 --- a/Parsers/ASimEmailEvent/Parsers/ASimEmailEventProofpointTAPClicksPermitted.yaml +++ b/Parsers/ASimEmailEvent/Parsers/ASimEmailEventProofpointTAPClicksPermitted.yaml @@ -1,7 +1,7 @@ Parser: Title: ASIM Email Event parser for Proofpoint TAP permitted clicks - Version: '0.1.2' - LastUpdated: Oct 29, 2026 + Version: '0.1.3' + LastUpdated: Oct 30, 2026 Product: Name: Proofpoint Targeted Attack Protection Normalization: @@ -46,7 +46,7 @@ ParserQuery: | EventSchemaVersion="1.0.0", EventType="EmailInteraction", EventOriginalType="clicksPermitted", - EventOriginalUid=tostring(column_ifexists("id", "")), + EventOriginalUid=tostring(id), EventCount=int(1), EventStartTime=coalesce(clickTime, TimeGenerated), EventResult="NA", diff --git a/Parsers/ASimEmailEvent/Parsers/vimEmailEventProofpointTAPClicksPermitted.yaml b/Parsers/ASimEmailEvent/Parsers/vimEmailEventProofpointTAPClicksPermitted.yaml index b90c90734d6..8c19a25a61a 100644 --- a/Parsers/ASimEmailEvent/Parsers/vimEmailEventProofpointTAPClicksPermitted.yaml +++ b/Parsers/ASimEmailEvent/Parsers/vimEmailEventProofpointTAPClicksPermitted.yaml @@ -1,7 +1,7 @@ Parser: Title: ASIM Email Event filtering parser for Proofpoint TAP permitted clicks - Version: '0.1.2' - LastUpdated: Oct 29, 2026 + Version: '0.1.3' + LastUpdated: Oct 30, 2026 Product: Name: Proofpoint Targeted Attack Protection Normalization: @@ -102,7 +102,7 @@ ParserQuery: | EventSchemaVersion="1.0.0", EventType="EmailInteraction", EventOriginalType="clicksPermitted", - EventOriginalUid=tostring(column_ifexists("id", "")), + EventOriginalUid=tostring(id), EventCount=int(1), EventStartTime=coalesce(clickTime, TimeGenerated), EventResult="NA", diff --git a/Sample Data/ASIM/Proofpoint_TAP_EmailEvent_ProofPointTAPClicksPermittedV2_CL_IngestedLogs.csv b/Sample Data/ASIM/Proofpoint_TAP_EmailEvent_ProofPointTAPClicksPermittedV2_CL_IngestedLogs.csv new file mode 100644 index 00000000000..4642f8738c0 --- /dev/null +++ b/Sample Data/ASIM/Proofpoint_TAP_EmailEvent_ProofPointTAPClicksPermittedV2_CL_IngestedLogs.csv @@ -0,0 +1,11 @@ +campaignId,classification,clickIP,clickTime [UTC],GUID,id,messageID,recipient,sender,senderIP,threatID,threatStatus,threatTime [UTC],threatURL,url,userAgent,TimeGenerated [UTC],Type +campaign-001,malware,192.0.2.10,2026-10-28T08:00:00Z,10000000-0000-4000-8000-000000000001,20000000-0000-4000-8000-000000000001,,recipient1@example.com,sender1@example.net,198.51.100.10,threat-001,active,2026-10-28T07:55:00Z,https://tap.example.com/threat/001,https://example.com/malware/001,TestBrowser/1.0,2026-10-28T08:00:00Z,ProofPointTAPClicksPermittedV2_CL +campaign-002,phish,192.0.2.11,2026-10-28T08:01:00Z,10000000-0000-4000-8000-000000000002,20000000-0000-4000-8000-000000000002,,recipient2@example.com,sender2@example.net,198.51.100.11,threat-002,cleared,2026-10-28T07:56:00Z,https://tap.example.com/threat/002,https://example.net/phish/002,TestBrowser/2.0,2026-10-28T08:01:00Z,ProofPointTAPClicksPermittedV2_CL +campaign-003,spam,192.0.2.12,2026-10-28T08:02:00Z,10000000-0000-4000-8000-000000000003,20000000-0000-4000-8000-000000000003,,recipient3@example.com,sender3@example.net,198.51.100.12,threat-003,falsepositive,2026-10-28T08:03:00Z,https://tap.example.com/threat/003,https://example.org/spam/003,TestBrowser/3.0,2026-10-28T08:02:00Z,ProofPointTAPClicksPermittedV2_CL +campaign-004,MALWARE,203.0.113.10,2026-10-28T08:03:00Z,10000000-0000-4000-8000-000000000004,20000000-0000-4000-8000-000000000004,,recipient4@example.com,sender4@example.net,198.51.100.13,threat-004,ACTIVE,2026-10-28T07:58:00Z,https://tap.example.com/threat/004,https://example.com/malware/004,TestBrowser/4.0,2026-10-28T08:03:00Z,ProofPointTAPClicksPermittedV2_CL +campaign-005,PHISH,203.0.113.11,2026-10-28T08:04:00Z,10000000-0000-4000-8000-000000000005,20000000-0000-4000-8000-000000000005,,recipient5@example.com,sender5@example.net,198.51.100.14,threat-005,CLEARED,2026-10-28T07:59:00Z,https://tap.example.com/threat/005,https://example.net/phish/005,TestBrowser/5.0,2026-10-28T08:04:00Z,ProofPointTAPClicksPermittedV2_CL +campaign-006,SPAM,203.0.113.12,2026-10-28T08:05:00Z,10000000-0000-4000-8000-000000000006,20000000-0000-4000-8000-000000000006,,recipient6@example.com,sender6@example.net,198.51.100.15,threat-006,FALSEPOSITIVE,2026-10-28T08:06:00Z,https://tap.example.com/threat/006,https://example.org/spam/006,TestBrowser/6.0,2026-10-28T08:05:00Z,ProofPointTAPClicksPermittedV2_CL +campaign-007,malware,2001:db8::10,2026-10-28T08:06:00Z,10000000-0000-4000-8000-000000000007,20000000-0000-4000-8000-000000000007,,recipient7@example.com,sender7@example.net,2001:db8:1::10,threat-007,active,2026-10-28T08:01:00Z,https://tap.example.com/threat/007,https://example.com/malware/007,TestBrowser/7.0,2026-10-28T08:06:00Z,ProofPointTAPClicksPermittedV2_CL +campaign-008,phish,192.0.2.20,2026-10-28T08:07:00Z,10000000-0000-4000-8000-000000000008,20000000-0000-4000-8000-000000000008,,recipient8@example.com,sender8@example.net,198.51.100.20,threat-008,cleared,2026-10-28T08:02:00Z,https://tap.example.com/threat/008,https://example.net/phish/008,TestBrowser/8.0,2026-10-28T08:07:00Z,ProofPointTAPClicksPermittedV2_CL +campaign-009,spam,192.0.2.21,2026-10-28T08:08:00Z,10000000-0000-4000-8000-000000000009,20000000-0000-4000-8000-000000000009,,recipient9@example.com,sender9@example.net,198.51.100.21,threat-009,falsepositive,2026-10-28T08:03:00Z,https://tap.example.com/threat/009,https://example.org/spam/009,TestBrowser/9.0,2026-10-28T08:08:00Z,ProofPointTAPClicksPermittedV2_CL +,,,,10000000-0000-4000-8000-000000000010,20000000-0000-4000-8000-000000000010,,recipient10@example.com,,,,,,,,,2026-10-28T08:09:00Z,ProofPointTAPClicksPermittedV2_CL