[ASIM] Add Proofpoint TAP permitted-click ingestion-time EmailEvent parser

Parsers/ASimEmailEvent/ARM/ASimEmailEventProofpointTAPClicksPermitted/ASimEmailEventProofpointTAPClicksPermitted.json

@@ -27,7 +27,7 @@
         "displayName": "ASIM Email Event parser for Proofpoint TAP permitted clicks",
         "category": "ASIM",
         "FunctionAlias": "ASimEmailEventProofpointTAPClicksPermitted",
-        "query": "let parser = (disabled:bool=false, pack:bool=false) {\n    ProofPointTAPClicksPermittedV2_CL\n    | where not(disabled)\n    | project-rename\n        Dst=recipient,\n        EmailMailFromAddress=sender,\n        SrcIpAddr=clickIP,\n        ThreatId=threatID,\n        ThreatOriginalCategory=classification,\n        ThreatFirstReportedTime=threatTime,\n        EventReportUrl=threatURL\n    | extend\n        EventVendor=\"Proofpoint\",\n        EventProduct=\"TAP\",\n        EventSchema=\"EmailEvent\",\n        EventSchemaVersion=\"1.0.0\",\n        EventType=\"EmailInteraction\",\n        EventOriginalType=\"clicksPermitted\",\n        EventOriginalUid=tostring(column_ifexists(\"id\", \"\")),\n        EventCount=int(1),\n        EventStartTime=coalesce(clickTime, TimeGenerated),\n        EventResult=\"NA\",\n        DvcOriginalAction=\"Permitted\",\n        DvcAction=\"NA\",\n        DvcEntityKey=\"\",\n        EmailDirection=\"Unknown\",\n        EmailUrls=iff(isempty(url), dynamic([]), pack_array(url)),\n        AdditionalEntities=dynamic([]),\n        AdditionalFields=iff(pack, bag_pack(\n            \"CampaignId\", campaignId,\n            \"MessageGuid\", GUID,\n            \"MessageId\", messageID,\n            \"SenderIpAddr\", senderIP,\n            \"ThreatStatus\", threatStatus,\n            \"UserAgent\", userAgent), dynamic({}))\n    | extend\n        EventEndTime=EventStartTime,\n        Dvc=EventProduct,\n        Src=SrcIpAddr,\n        IpAddr=SrcIpAddr,\n        EmailMailFromDomain=tostring(split(EmailMailFromAddress, \"@\")[1]),\n        ThreatCategory=case(\n            ThreatOriginalCategory =~ \"malware\", \"Malware\",\n            ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"Phishing\",\n            ThreatOriginalCategory =~ \"spam\", \"Spam\",\n            \"\"),\n        ThreatIsActive=case(\n            threatStatus =~ \"active\", true,\n            threatStatus in~ (\"cleared\", \"falsepositive\"), false,\n            bool(null)),\n        ThreatField=iff(isnotempty(url), \"EmailUrls\", \"\"),\n        EventResultDetails=case(\n            ThreatOriginalCategory =~ \"malware\", \"MalwareDetected\",\n            ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"PhishingDetected\",\n            isnotempty(ThreatOriginalCategory), \"Other\",\n            \"\")\n    | project\n        TimeGenerated, Type,\n        EventVendor, EventProduct, EventSchema, EventSchemaVersion,\n        EventType, EventOriginalType, EventCount, EventStartTime, EventEndTime,\n        EventResult, EventResultDetails, EventOriginalUid, EventReportUrl,\n        Dvc, DvcOriginalAction, DvcAction, DvcEntityKey,\n        Src, SrcIpAddr, IpAddr, Dst,\n        EmailMailFromAddress, EmailMailFromDomain, EmailDirection, EmailUrls,\n        ThreatId, ThreatOriginalCategory, ThreatCategory, ThreatIsActive,\n        ThreatFirstReportedTime, ThreatField,\n        AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n",
+        "query": "let parser = (disabled:bool=false, pack:bool=false) {\n    ProofPointTAPClicksPermittedV2_CL\n    | where not(disabled)\n    | project-rename\n        Dst=recipient,\n        EmailMailFromAddress=sender,\n        SrcIpAddr=clickIP,\n        ThreatId=threatID,\n        ThreatOriginalCategory=classification,\n        ThreatFirstReportedTime=threatTime,\n        EventReportUrl=threatURL\n    | extend\n        EventVendor=\"Proofpoint\",\n        EventProduct=\"TAP\",\n        EventSchema=\"EmailEvent\",\n        EventSchemaVersion=\"1.0.0\",\n        EventType=\"EmailInteraction\",\n        EventOriginalType=\"clicksPermitted\",\n        EventOriginalUid=tostring(id),\n        EventCount=int(1),\n        EventStartTime=coalesce(clickTime, TimeGenerated),\n        EventResult=\"NA\",\n        DvcOriginalAction=\"Permitted\",\n        DvcAction=\"NA\",\n        DvcEntityKey=\"\",\n        EmailDirection=\"Unknown\",\n        EmailUrls=iff(isempty(url), dynamic([]), pack_array(url)),\n        AdditionalEntities=dynamic([]),\n        AdditionalFields=iff(pack, bag_pack(\n            \"CampaignId\", campaignId,\n            \"MessageGuid\", GUID,\n            \"MessageId\", messageID,\n            \"SenderIpAddr\", senderIP,\n            \"ThreatStatus\", threatStatus,\n            \"UserAgent\", userAgent), dynamic({}))\n    | extend\n        EventEndTime=EventStartTime,\n        Dvc=EventProduct,\n        Src=SrcIpAddr,\n        IpAddr=SrcIpAddr,\n        EmailMailFromDomain=tostring(split(EmailMailFromAddress, \"@\")[1]),\n        ThreatCategory=case(\n            ThreatOriginalCategory =~ \"malware\", \"Malware\",\n            ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"Phishing\",\n            ThreatOriginalCategory =~ \"spam\", \"Spam\",\n            \"\"),\n        ThreatIsActive=case(\n            threatStatus =~ \"active\", true,\n            threatStatus in~ (\"cleared\", \"falsepositive\"), false,\n            bool(null)),\n        ThreatField=iff(isnotempty(url), \"EmailUrls\", \"\"),\n        EventResultDetails=case(\n            ThreatOriginalCategory =~ \"malware\", \"MalwareDetected\",\n            ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"PhishingDetected\",\n            isnotempty(ThreatOriginalCategory), \"Other\",\n            \"\")\n    | project\n        TimeGenerated, Type,\n        EventVendor, EventProduct, EventSchema, EventSchemaVersion,\n        EventType, EventOriginalType, EventCount, EventStartTime, EventEndTime,\n        EventResult, EventResultDetails, EventOriginalUid, EventReportUrl,\n        Dvc, DvcOriginalAction, DvcAction, DvcEntityKey,\n        Src, SrcIpAddr, IpAddr, Dst,\n        EmailMailFromAddress, EmailMailFromDomain, EmailDirection, EmailUrls,\n        ThreatId, ThreatOriginalCategory, ThreatCategory, ThreatIsActive,\n        ThreatFirstReportedTime, ThreatField,\n        AdditionalEntities, AdditionalFields\n};\nparser(disabled=disabled, pack=pack)\n",
         "version": 1,
         "functionParameters": "disabled:bool=False,pack:bool=False"
       }

Parsers/ASimEmailEvent/ARM/vimEmailEventProofpointTAPClicksPermitted/vimEmailEventProofpointTAPClicksPermitted.json

@@ -27,7 +27,7 @@
         "displayName": "ASIM Email Event filtering parser for Proofpoint TAP permitted clicks",
         "category": "ASIM",
         "FunctionAlias": "vimEmailEventProofpointTAPClicksPermitted",
-        "query": "let parser = (\n    starttime:datetime=datetime(null),\n    endtime:datetime=datetime(null),\n    ipaddr_has_any_prefix:dynamic=dynamic([]),\n    emailfromaddress_has_any:dynamic=dynamic([]),\n    emailrecipient_has_any:dynamic=dynamic([]),\n    emailsubject_has_any:dynamic=dynamic([]),\n    emaildirection_in:dynamic=dynamic([]),\n    emaildeliverylocation_in:dynamic=dynamic([]),\n    eventresult:string=\"*\",\n    disabled:bool=false,\n    pack:bool=false\n) {\n    ProofPointTAPClicksPermittedV2_CL\n    | where not(disabled)\n    | where isnull(starttime)\n        or clickTime >= starttime\n        or (isnull(clickTime) and TimeGenerated >= starttime)\n    | where isnull(endtime)\n        or clickTime <= endtime\n        or (isnull(clickTime) and TimeGenerated <= endtime)\n    | where array_length(ipaddr_has_any_prefix) == 0\n        or has_any_ipv4_prefix(clickIP, ipaddr_has_any_prefix)\n    | where array_length(emailrecipient_has_any) == 0\n        or recipient has_any (emailrecipient_has_any)\n    | where array_length(emaildirection_in) == 0\n        or \"Unknown\" in~ (emaildirection_in)\n    | where eventresult == \"*\" or eventresult =~ \"NA\"\n    // This source does not supply header From, subject, or delivery location.\n    | where array_length(emailfromaddress_has_any) == 0\n    | where array_length(emailsubject_has_any) == 0\n    | where array_length(emaildeliverylocation_in) == 0\n    | project-rename\n        Dst=recipient,\n        EmailMailFromAddress=sender,\n        SrcIpAddr=clickIP,\n        ThreatId=threatID,\n        ThreatOriginalCategory=classification,\n        ThreatFirstReportedTime=threatTime,\n        EventReportUrl=threatURL\n    | extend\n        EventVendor=\"Proofpoint\",\n        EventProduct=\"TAP\",\n        EventSchema=\"EmailEvent\",\n        EventSchemaVersion=\"1.0.0\",\n        EventType=\"EmailInteraction\",\n        EventOriginalType=\"clicksPermitted\",\n        EventOriginalUid=tostring(column_ifexists(\"id\", \"\")),\n        EventCount=int(1),\n        EventStartTime=coalesce(clickTime, TimeGenerated),\n        EventResult=\"NA\",\n        DvcOriginalAction=\"Permitted\",\n        DvcAction=\"NA\",\n        DvcEntityKey=\"\",\n        EmailDirection=\"Unknown\",\n        EmailUrls=iff(isempty(url), dynamic([]), pack_array(url)),\n        AdditionalEntities=dynamic([]),\n        AdditionalFields=iff(pack, bag_pack(\n            \"CampaignId\", campaignId,\n            \"MessageGuid\", GUID,\n            \"MessageId\", messageID,\n            \"SenderIpAddr\", senderIP,\n            \"ThreatStatus\", threatStatus,\n            \"UserAgent\", userAgent), dynamic({}))\n    | extend\n        EventEndTime=EventStartTime,\n        Dvc=EventProduct,\n        Src=SrcIpAddr,\n        IpAddr=SrcIpAddr,\n        EmailMailFromDomain=tostring(split(EmailMailFromAddress, \"@\")[1]),\n        ThreatCategory=case(\n            ThreatOriginalCategory =~ \"malware\", \"Malware\",\n            ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"Phishing\",\n            ThreatOriginalCategory =~ \"spam\", \"Spam\",\n            \"\"),\n        ThreatIsActive=case(\n            threatStatus =~ \"active\", true,\n            threatStatus in~ (\"cleared\", \"falsepositive\"), false,\n            bool(null)),\n        ThreatField=iff(isnotempty(url), \"EmailUrls\", \"\"),\n        EventResultDetails=case(\n            ThreatOriginalCategory =~ \"malware\", \"MalwareDetected\",\n            ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"PhishingDetected\",\n            isnotempty(ThreatOriginalCategory), \"Other\",\n            \"\")\n    | project\n        TimeGenerated, Type,\n        EventVendor, EventProduct, EventSchema, EventSchemaVersion,\n        EventType, EventOriginalType, EventCount, EventStartTime, EventEndTime,\n        EventResult, EventResultDetails, EventOriginalUid, EventReportUrl,\n        Dvc, DvcOriginalAction, DvcAction, DvcEntityKey,\n        Src, SrcIpAddr, IpAddr, Dst,\n        EmailMailFromAddress, EmailMailFromDomain, EmailDirection, EmailUrls,\n        ThreatId, ThreatOriginalCategory, ThreatCategory, ThreatIsActive,\n        ThreatFirstReportedTime, ThreatField,\n        AdditionalEntities, AdditionalFields\n};\nparser(starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, emailfromaddress_has_any=emailfromaddress_has_any, emailrecipient_has_any=emailrecipient_has_any, emailsubject_has_any=emailsubject_has_any, emaildirection_in=emaildirection_in, emaildeliverylocation_in=emaildeliverylocation_in, eventresult=eventresult, disabled=disabled, pack=pack)\n",
+        "query": "let parser = (\n    starttime:datetime=datetime(null),\n    endtime:datetime=datetime(null),\n    ipaddr_has_any_prefix:dynamic=dynamic([]),\n    emailfromaddress_has_any:dynamic=dynamic([]),\n    emailrecipient_has_any:dynamic=dynamic([]),\n    emailsubject_has_any:dynamic=dynamic([]),\n    emaildirection_in:dynamic=dynamic([]),\n    emaildeliverylocation_in:dynamic=dynamic([]),\n    eventresult:string=\"*\",\n    disabled:bool=false,\n    pack:bool=false\n) {\n    ProofPointTAPClicksPermittedV2_CL\n    | where not(disabled)\n    | where isnull(starttime)\n        or clickTime >= starttime\n        or (isnull(clickTime) and TimeGenerated >= starttime)\n    | where isnull(endtime)\n        or clickTime <= endtime\n        or (isnull(clickTime) and TimeGenerated <= endtime)\n    | where array_length(ipaddr_has_any_prefix) == 0\n        or has_any_ipv4_prefix(clickIP, ipaddr_has_any_prefix)\n    | where array_length(emailrecipient_has_any) == 0\n        or recipient has_any (emailrecipient_has_any)\n    | where array_length(emaildirection_in) == 0\n        or \"Unknown\" in~ (emaildirection_in)\n    | where eventresult == \"*\" or eventresult =~ \"NA\"\n    // This source does not supply header From, subject, or delivery location.\n    | where array_length(emailfromaddress_has_any) == 0\n    | where array_length(emailsubject_has_any) == 0\n    | where array_length(emaildeliverylocation_in) == 0\n    | project-rename\n        Dst=recipient,\n        EmailMailFromAddress=sender,\n        SrcIpAddr=clickIP,\n        ThreatId=threatID,\n        ThreatOriginalCategory=classification,\n        ThreatFirstReportedTime=threatTime,\n        EventReportUrl=threatURL\n    | extend\n        EventVendor=\"Proofpoint\",\n        EventProduct=\"TAP\",\n        EventSchema=\"EmailEvent\",\n        EventSchemaVersion=\"1.0.0\",\n        EventType=\"EmailInteraction\",\n        EventOriginalType=\"clicksPermitted\",\n        EventOriginalUid=tostring(id),\n        EventCount=int(1),\n        EventStartTime=coalesce(clickTime, TimeGenerated),\n        EventResult=\"NA\",\n        DvcOriginalAction=\"Permitted\",\n        DvcAction=\"NA\",\n        DvcEntityKey=\"\",\n        EmailDirection=\"Unknown\",\n        EmailUrls=iff(isempty(url), dynamic([]), pack_array(url)),\n        AdditionalEntities=dynamic([]),\n        AdditionalFields=iff(pack, bag_pack(\n            \"CampaignId\", campaignId,\n            \"MessageGuid\", GUID,\n            \"MessageId\", messageID,\n            \"SenderIpAddr\", senderIP,\n            \"ThreatStatus\", threatStatus,\n            \"UserAgent\", userAgent), dynamic({}))\n    | extend\n        EventEndTime=EventStartTime,\n        Dvc=EventProduct,\n        Src=SrcIpAddr,\n        IpAddr=SrcIpAddr,\n        EmailMailFromDomain=tostring(split(EmailMailFromAddress, \"@\")[1]),\n        ThreatCategory=case(\n            ThreatOriginalCategory =~ \"malware\", \"Malware\",\n            ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"Phishing\",\n            ThreatOriginalCategory =~ \"spam\", \"Spam\",\n            \"\"),\n        ThreatIsActive=case(\n            threatStatus =~ \"active\", true,\n            threatStatus in~ (\"cleared\", \"falsepositive\"), false,\n            bool(null)),\n        ThreatField=iff(isnotempty(url), \"EmailUrls\", \"\"),\n        EventResultDetails=case(\n            ThreatOriginalCategory =~ \"malware\", \"MalwareDetected\",\n            ThreatOriginalCategory in~ (\"phish\", \"phishing\"), \"PhishingDetected\",\n            isnotempty(ThreatOriginalCategory), \"Other\",\n            \"\")\n    | project\n        TimeGenerated, Type,\n        EventVendor, EventProduct, EventSchema, EventSchemaVersion,\n        EventType, EventOriginalType, EventCount, EventStartTime, EventEndTime,\n        EventResult, EventResultDetails, EventOriginalUid, EventReportUrl,\n        Dvc, DvcOriginalAction, DvcAction, DvcEntityKey,\n        Src, SrcIpAddr, IpAddr, Dst,\n        EmailMailFromAddress, EmailMailFromDomain, EmailDirection, EmailUrls,\n        ThreatId, ThreatOriginalCategory, ThreatCategory, ThreatIsActive,\n        ThreatFirstReportedTime, ThreatField,\n        AdditionalEntities, AdditionalFields\n};\nparser(starttime=starttime, endtime=endtime, ipaddr_has_any_prefix=ipaddr_has_any_prefix, emailfromaddress_has_any=emailfromaddress_has_any, emailrecipient_has_any=emailrecipient_has_any, emailsubject_has_any=emailsubject_has_any, emaildirection_in=emaildirection_in, emaildeliverylocation_in=emaildeliverylocation_in, eventresult=eventresult, disabled=disabled, pack=pack)\n",
         "version": 1,
         "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),ipaddr_has_any_prefix:dynamic=dynamic([]),emailfromaddress_has_any:dynamic=dynamic([]),emailrecipient_has_any:dynamic=dynamic([]),emailsubject_has_any:dynamic=dynamic([]),emaildirection_in:dynamic=dynamic([]),emaildeliverylocation_in:dynamic=dynamic([]),eventresult:string='*',disabled:bool=False,pack:bool=False"
       }

Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointTAPClicksPermitted.md

@@ -1,5 +1,10 @@
 # Changelog for ASimEmailEventProofpointTAPClicksPermitted.yaml
 
+## Version 0.1.3
+
+- (2026-10-30) Read the source id directly for EventOriginalUid instead of substituting an empty value when the column is missing - [PR #15501](https://github.com/Azure/Azure-Sentinel/pull/15501)
+- Require the declared source id column; retain all other mappings and packing behavior.
+
 ## Version 0.1.2
 
 - (2026-10-29) Read the optional source id defensively so a missing column does not prevent event normalization - [PR #15483](https://github.com/Azure/Azure-Sentinel/pull/15483)

Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointTAPClicksPermittedIngestTime.md

@@ -0,0 +1,12 @@
+# Changelog for ASimEmailEventProofpointTAPClicksPermittedIngestTime.yaml
+
+## Version 0.1.3
+
+- (2026-10-30) Read the source id directly for EventOriginalUid without a missing-column fallback, matching the query-time parsers - [PR #15501](https://github.com/Azure/Azure-Sentinel/pull/15501)
+- Require the declared source id column; retain one normalized event per source row and all other mappings.
+
+## Version 0.1.2
+
+- (2026-10-29) Added the initial Proofpoint TAP permitted-click ingestion-time parser for EmailEvent interaction activity - [PR #15501](https://github.com/Azure/Azure-Sentinel/pull/15501)
+- Normalize each source row into ASimEmailEventLogs while preserving the original click type, optional event identifier, click-time fallback, and threat context.
+- Retain campaign, message, sender IP, threat status, and user-agent context in AdditionalFields.

Parsers/ASimEmailEvent/CHANGELOG/vimEmailEventProofpointTAPClicksPermitted.md

@@ -1,5 +1,10 @@
 # Changelog for vimEmailEventProofpointTAPClicksPermitted.yaml
 
+## Version 0.1.3
+
+- (2026-10-30) Read the source id directly for EventOriginalUid instead of substituting an empty value when the column is missing - [PR #15501](https://github.com/Azure/Azure-Sentinel/pull/15501)
+- Require the declared source id column; retain all existing filtering, mappings, and packing behavior.
+
 ## Version 0.1.2
 
 - (2026-10-29) Read the optional source id defensively while retaining the existing filtering behavior - [PR #15483](https://github.com/Azure/Azure-Sentinel/pull/15483)