Skip to content

Commit 7576ff8

Browse files
mhebrard-bigidmhebrard-bigid
committed
BigID DSPM Asset expanding and mapping
1 parent 0f0480d commit 7576ff8

File tree

5 files changed

+568
-14
lines changed

5 files changed

+568
-14
lines changed

‎Solutions/BigID/Data Connectors/BigIDDSPMLogs_ccp/BigIDDSPMCatalog_Table.json‎

Lines changed: 265 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,11 @@
1414
"description": "The timestamp (UTC) reflecting the time in which the event was generated."
1515
},
1616
{
17-
"name": "case",
17+
"name": "dspmCase",
1818
"type": "dynamic"
1919
},
2020
{
21-
"name": "affectedObjects",
21+
"name": "expand",
2222
"type": "dynamic"
2323
},
2424
{
@@ -28,5 +28,268 @@
2828
]
2929
}
3030
}
31+
},
32+
{
33+
"name": "BigIDDSPMAssetStore_CL",
34+
"type": "Microsoft.OperationalInsights/workspaces/tables",
35+
"apiVersion": "2021-03-01-privatepreview",
36+
"properties": {
37+
"schema": {
38+
"name": "BigIDDSPMAssetStore_CL",
39+
"columns": [
40+
{
41+
"name": "IngestionTime",
42+
"type": "datetime",
43+
"description": "The date and time that the line was written to the store. This is used when there are multiple lines for each file, such as when a change is detected, or if 24 hours have passed since the last store line was added."
44+
},
45+
{
46+
"name": "TimeGenerated",
47+
"type": "datetime",
48+
"isDefaultDisplay": true,
49+
"description": "Time the asset information was collected (snapshot or the changefeed of that asset was taken)"
50+
},
51+
{
52+
"name": "AssetID",
53+
"type": "string",
54+
"description": "Unique identifier of the Asset. E.g. device ID, Document ID etc."
55+
},
56+
{
57+
"name": "CreatedDateTime",
58+
"type": "datetime",
59+
"description": "Date and time the Asset was created."
60+
},
61+
{
62+
"name": "AssetOwner",
63+
"type": "dynamic",
64+
"description": "Owner of the asset: e.g. File owner (from filesystem metadata). AccountUpn"
65+
},
66+
{
67+
"name": "AssetName",
68+
"type": "string",
69+
"description": "Name of the Asset"
70+
},
71+
{
72+
"name": "AssetType",
73+
"type": "string",
74+
"description": "Type of the asset: File, Site, Mailbox etc."
75+
},
76+
{
77+
"name": "AssetPermissions",
78+
"type": "dynamic",
79+
"description": "Permission strings on the assets"
80+
},
81+
{
82+
"name": "AdditionalFields",
83+
"type": "dynamic",
84+
"description": "Additional unmapped information about the event in JSON array format"
85+
},
86+
{
87+
"name": "Provider",
88+
"type": "string",
89+
"description": "The vendor who is providing this information: Microsoft/3P Providers etc."
90+
},
91+
{
92+
"name": "AssetSource",
93+
"type": "string",
94+
"description": "The source which generates the information: Microsoft, Snowflake, Salesforce etc."
95+
},
96+
{
97+
"name": "AADTenantID",
98+
"type": "string",
99+
"description": "Customer AAD Tenant ID"
100+
},
101+
{
102+
"name": "Workload",
103+
"type": "string",
104+
"description": "The workload within the source which is generating this information: Azure, M365 etc."
105+
},
106+
{
107+
"name": "SubWorkload",
108+
"type": "string",
109+
"description": "Sub workload within the Workload which is generating this information: Exchange, SharePoint, Teams in M365"
110+
},
111+
{
112+
"name": "Location",
113+
"type": "string",
114+
"description": "Location of the resolved IP (city/region/country), source from which it came from."
115+
},
116+
{
117+
"name": "Region",
118+
"type": "string",
119+
"description": "Geographical information"
120+
},
121+
{
122+
"name": "Classification",
123+
"type": "string",
124+
"description": "Sensitive Data classification: PII, HIPAA, Financial Data, etc. MIP classification and confidence level"
125+
},
126+
{
127+
"name": "ClassificationLastScanDateTime",
128+
"type": "datetime",
129+
"description": "Last time an asset was scanned to derive the classification. This is necessary to understand the darkdata on the Purview side."
130+
},
131+
{
132+
"name": "IsProtectedByDlp",
133+
"type": "bool",
134+
"description": "Whether the asset is protected by any DLP policy"
135+
},
136+
{
137+
"name": "Risks",
138+
"type": "string",
139+
"description": "All the documented issues or risks attached to the asset."
140+
},
141+
{
142+
"name": "IdentityDirectorySource",
143+
"type": "string",
144+
"description": "e.g Azure Active Directory, Okta etc."
145+
},
146+
{
147+
"name": "LastAccessDateTime",
148+
"type": "datetime",
149+
"description": "Last date and time the asset was accessed."
150+
},
151+
{
152+
"name": "LastModifiedDateTime",
153+
"type": "datetime",
154+
"description": "Last date and time the asset was modified."
155+
},
156+
{
157+
"name": "IsAssetRemoved",
158+
"type": "bool",
159+
"description": "Signifies if the asset is deleted or not?"
160+
},
161+
{
162+
"name": "FeedType",
163+
"type": "string",
164+
"description": "Signifies \"Changefeed\" or \"Snapshot\""
165+
},
166+
{
167+
"name": "SensitivityLabel",
168+
"type": "string",
169+
"description": "Whether the file is digitally signed, and if so, whether the signature is valid."
170+
},
171+
{
172+
"name": "ThreatDetected",
173+
"type": "bool",
174+
"description": "True/False if flagged as malicious."
175+
},
176+
{
177+
"name": "ThreatCategory",
178+
"type": "string",
179+
"description": "Type of threat: phishing, malware hosting, etc)."
180+
},
181+
{
182+
"name": "ThreatName",
183+
"type": "string",
184+
"description": "Name of detected threat family (e.g. malware name)."
185+
},
186+
{
187+
"name": "RelatedIndicators",
188+
"type": "string",
189+
"description": "Related IOCs (file hashes, IPs, domains)."
190+
},
191+
{
192+
"name": "RequestSourceIP",
193+
"type": "string",
194+
"description": "(If network-delivered) Source IP associated with the file event."
195+
},
196+
{
197+
"name": "RequestDestinationIP",
198+
"type": "string",
199+
"description": "(If network-related) Destination IP."
200+
},
201+
{
202+
"name": "AssetPath",
203+
"type": "string",
204+
"description": "Fully qualified path of the asset: Filepath or site path."
205+
},
206+
{
207+
"name": "InternalUserWithPermissionCount",
208+
"type": "int",
209+
"description": "Total number of permissions assigned to internal users within an organization. De-duped count of users (preferred)"
210+
},
211+
{
212+
"name": "ExternalUserWithPermissionCount",
213+
"type": "int",
214+
"description": "Total number of permissions assigned to external users outside an organization. De-duped count of users (preferred)"
215+
},
216+
{
217+
"name": "DeviceName",
218+
"type": "string",
219+
"description": "Fully qualified domain name (FQDN) of the device or the host name of the file."
220+
},
221+
{
222+
"name": "UserName",
223+
"type": "string",
224+
"description": "Account associated with the file action."
225+
},
226+
{
227+
"name": "AssetSize",
228+
"type": "string",
229+
"description": "Size of the file in bytes."
230+
},
231+
{
232+
"name": "MD5",
233+
"type": "string",
234+
"description": "MD5 hash of the file."
235+
},
236+
{
237+
"name": "SHA1",
238+
"type": "string",
239+
"description": "SHA1 hash of the file."
240+
},
241+
{
242+
"name": "SHA256",
243+
"type": "string",
244+
"description": "SHA-256 of the file, if this field is usually not populated — use the SHA1 column when available."
245+
},
246+
{
247+
"name": "Extension",
248+
"type": "string",
249+
"description": "File extension (e.g., .exe, .docx)"
250+
},
251+
{
252+
"name": "SignatureStatus",
253+
"type": "string",
254+
"description": "The \"signature status\" of a file indicates whether its digital signature is valid, invalid, or has a recoverable error, confirming the file's integrity and the sender's identity after being signed with a digital certificate"
255+
},
256+
{
257+
"name": "DomainName",
258+
"type": "string",
259+
"description": "Fully qualified domain (e.g., malicious-site.com)"
260+
},
261+
{
262+
"name": "Subdomain",
263+
"type": "string",
264+
"description": "Subdomain accessed (e.g., login.malicious-site.com)"
265+
},
266+
{
267+
"name": "TopLevelDomain",
268+
"type": "string",
269+
"description": "Extracted TLD (e.g., .com, .org)"
270+
},
271+
{
272+
"name": "IPAddress",
273+
"type": "string",
274+
"description": "IP address resolved for the domain (IPv4/IPv6)."
275+
},
276+
{
277+
"name": "URL",
278+
"type": "string",
279+
"description": "Full URL requested (path, query string included)."
280+
},
281+
{
282+
"name": "ISP",
283+
"type": "string",
284+
"description": "Internet Service Provider hosting the site."
285+
},
286+
{
287+
"name": "ASN",
288+
"type": "string",
289+
"description": "Autonomous System Number of the hosting provider."
290+
}
291+
]
292+
}
293+
}
31294
}
32295
]

‎Solutions/BigID/Data Connectors/BigIDDSPMLogs_ccp/BigIDDSPMLogs_DCR.json‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@
1010
"Custom-BigIDDSPMCatalog_CL": {
1111
"columns": [
1212
{
13-
"name": "case",
13+
"name": "dspmCase",
1414
"type": "dynamic"
1515
},
1616
{
17-
"name": "affectedObjects",
17+
"name": "expand",
1818
"type": "dynamic"
1919
},
2020
{
@@ -40,8 +40,18 @@
4040
"destinations": [
4141
"clv2ws1"
4242
],
43-
"transformKql": "source | extend TimeGenerated = now(), EventType = 'catalog', EventVendor = 'BigID', EventProduct = 'DSPM'",
43+
"transformKql": "source | extend TimeGenerated = now()",
4444
"outputStream": "Custom-BigIDDSPMCatalog_CL"
45+
},
46+
{
47+
"streams": [
48+
"Custom-BigIDDSPMCatalog_CL"
49+
],
50+
"destinations": [
51+
"clv2ws1"
52+
],
53+
"transformKql": "source | project IngestionTime=now(), TimeGenerated=todatetime(expand.created_date), AssetID=tostring(expand.fullyQualifiedName), Provider='BigID', FeedType='Snapshot', CreatedDateTime=todatetime(expand.created_date), AssetOwner=expand.owner, AssetName=tostring(expand.objectName), AssetPath=tostring(expand.fullObjectName), AssetSize=tostring(expand.sizeInBytes), AssetSource=tostring(expand.type), AssetType=tostring(expand.objectType), Workload=tostring(expand.source), Location=tostring(datasource.location), Classification=tostring(expand.attribute), ClassificationLastScanDateTime=todatetime(expand.last_scanned), LastModifiedDateTime=todatetime(expand.updated_at), Risks=tostring(dspmCase.caseLabel)",
54+
"outputStream": "Custom-BigIDDSPMAssetStore_CL"
4555
}
4656
]
4757
}

‎Solutions/BigID/Data Connectors/BigIDDSPMLogs_ccp/BigIDDSPMLogs_PollerConfig.json‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
"OffsetParaName": "offset"
4848
},
4949
"shouldJoinNestedData": true,
50-
"joinedDataStepName": "case",
50+
"joinedDataStepName": "dspmCase",
5151
"stepInfo": {
5252
"stepType": "Nested",
5353
"nextSteps": [
@@ -88,7 +88,7 @@
8888
},
8989
"fetchObjectsDetails": {
9090
"shouldJoinNestedData": true,
91-
"joinedDataStepName": "affectedObjects",
91+
"joinedDataStepName": "expand",
9292
"request": {
9393
"httpMethod": "GET",
9494
"apiEndpoint": "https://{{bigidFqdn}}/api/v1/data-catalog/",
@@ -107,6 +107,9 @@
107107
"format": "json"
108108
}
109109
}
110+
},
111+
"extra": {
112+
"nestedTransformName": "/ASI/Microsoft/MvExpandTransformer"
110113
}
111114
}
112115
}

‎Solutions/BigID/Package/3.0.0.zip‎

2.13 KB
Binary file not shown.

0 commit comments

Comments
 (0)