[ASIM] AlertEvent - Microsoft Defender XDR Parser updates

Parsers/ASimAlertEvent/ARM/ASimAlertEventMicrosoftDefenderXDR/ASimAlertEventMicrosoftDefenderXDR.json

@@ -27,7 +27,7 @@
         "displayName": "Alert Event ASIM parser for Microsoft Defender XDR",
         "category": "ASIM",
         "FunctionAlias": "ASimAlertEventMicrosoftDefenderXDR",
-        "query": "let IndicatorTypeLookup = datatable (EntityType: string, IndicatorType: string)\n[\n\"User\", \"User\",\n\"Machine\", \"Host\",\n\"Process\", \"Process\",\n\"File\", \"File\",\n\"Ip\", \"Ip\",\n\"Url\", \"Url\",\n\"RegistryValue\", \"Registry\",\n\"CloudLogonSession\", \"LogonSession\",\n\"CloudApplication\", \"Application\",\n\"Mailbox\", \"Mailbox\",\n\"MailMessage\", \"Email\",\n\"CloudResource\", \"Cloud Resource\"\n];\nlet IndicatorAssociationLookup = datatable (EvidenceRole: string, IndicatorAssociation: string)\n    [\n    \"Related\", \"Associated\",\n    \"Impacted\", \"Targeted\"\n];\nlet RegistryValueTypeLookup = datatable (ValueType: string, RegistryValueType: string)\n    [\n    \"ExpandString\", \"Reg_Expand_Sz\"\n];\nlet AlertVerdictLookup = datatable (AlertVerdict_Custom: string, AlertVerdict: string)\n    [\n    \"Malicious\", \"True Positive\",\n    \"Suspicious\", \"True Positive\",\n    \"NoThreatsFound\", \"Benign Positive\"\n];\nlet AttackTacticSet = dynamic([\"Exfiltration\", \"PrivilegeEscalation\", \"Persistence\", \"LateralMovement\", \"Execution\", \"Discovery\", \"InitialAccess\", \"CredentialAccess\", \"DefenseEvasion\", \"CommandAndControl\", \"Impact\"]);\nlet ThreatCategorySet = dynamic([\"Malware\", \"Ransomware\", \"Trojan\", \"Virus\", \"Worm\", \"Adware\", \"Spyware\", \"Rootkit\", \"Cryptominor\", \"Phishing\", \"Spam\", \"MaliciousUrl\", \"Spoofing\", \"Security Policy Violation\", \"Unknown\", \"SuspiciousActivity\"]);\nlet parser = (\n    disabled: bool=false) {\n    AlertEvidence\n    | where not(disabled)\n    // Mapping Inspection Fields\n    | extend \n        EventUid = AlertId,\n        AlertName = Title,\n        AlertVerdict_Custom = tostring(AdditionalFields.ThreatAnalysisSummary[0].Verdict),\n        AlertVerdictDate_s = todatetime(AdditionalFields.ThreatAnalysisSummary[0].AnalysisDate),\n        AttackTactics = iff(Categories has_any (AttackTacticSet), replace(@\"[\\[\\]\\\"\"]\", \"\", Categories), \"\"),\n        AlertOriginalStatus = tostring(AdditionalFields.LastRemediationState),\n        AlertStatus = iif(isnotempty(AdditionalFields.LastRemediationState), iif(AdditionalFields.LastRemediationState == \"Active\", \"Active\", \"Closed\"), \"\"),\n        DetectionMethod = DetectionSource\n    | lookup AlertVerdictLookup on AlertVerdict_Custom\n    | lookup IndicatorTypeLookup on EntityType\n    | lookup IndicatorAssociationLookup on EvidenceRole\n    // Mapping Threat Fields\n    | extend\n        ThreatCategory = iif(Categories has_any (ThreatCategorySet), replace(@\"[\\[\\]\\\"\"]\", \"\", Categories), \"\")\n    // Mapping User Entity\n    | extend \n        UserId = coalesce(AccountObjectId, tostring(AdditionalFields.Account.AadUserId)),\n        UserSid = coalesce(AccountSid, tostring(AdditionalFields.Account.Sid)),\n        Username = coalesce(AccountUpn, tostring(AdditionalFields.Account.UserPrincipalName)),\n        UserSessionId = tostring(AdditionalFields.SessionId),\n        UserScopeId = tostring(AdditionalFields.AadTenantId),\n        HttpUserAgent_s = tostring(AdditionalFields.UserAgent)\n    | extend\n        UserIdType = iif(isnotempty(UserId), \"EntraUserID\", iif(isnotempty(UserSid), \"SID\", \"\")),\n        UserId = coalesce(UserId, UserSid),\n        UserType = _ASIM_GetUserType(Username, UserSid),\n        UsernameType = _ASIM_GetUsernameType(Username)\n    // Mapping Device Entity\n    | extend \n        DvcId = coalesce(DeviceId, tostring(AdditionalFields.Host.MachineId)),\n        DvcIpAddr = coalesce(LocalIP, tostring(AdditionalFields.Host.IpInterfaces[0].Address), RemoteIP),\n        DvcOs = tostring(coalesce(AdditionalFields.OSFamily, AdditionalFields.Host.OSFamily)),\n        DvcOsVersion = tostring(coalesce(AdditionalFields.OSVersion, AdditionalFields.Host.OSVersion)),\n        DeviceName = coalesce(DeviceName, tostring(AdditionalFields.Host.NetBiosName)),\n        DvcScopeId = coalesce(tostring(split(AdditionalFields.AzureID, \"/\")[2]), (tostring(split(AdditionalFields.ResourceId, \"/\")[2])))\n    | extend DvcIdType = iif(isnotempty(DvcId), \"MDEid\", \"\")\n    | invoke _ASIM_ResolveDvcFQDN(\"DeviceName\")\n    // Mapping Additional Fields\n    | extend\n        GeoCity_s = AdditionalFields.Location.City,\n        GeoCountry_s = AdditionalFields.Location.CountryCode,\n        GeoLatitude_s = AdditionalFields.Location.Latitude,\n        GeoLongitude_s = AdditionalFields.Location.Longitude,\n        GeoRegion_s = AdditionalFields.Location.State\n    // Mapping Process Entity\n    | extend \n        ProcessId = AdditionalFields.ProcessId,\n        ProcessCommandLine,\n        ProcessName = iif(IndicatorType == \"Process\", iif(isnotempty(FolderPath) and isnotempty(FileName), strcat(FolderPath, '\\\\', FileName), FileName), \"\"),\n        ProcessFileCompany = AdditionalFields.Publisher,\n        // Parent Process Fields\n        ParentProcessId_s = AdditionalFields.ParentProcess.ProcessId,\n        ParentProcessCommandLine_s = AdditionalFields.ParentProcess.CommandLine,\n        ParentProcessName_s = iif(IndicatorType == \"Process\", iif(isnotempty(AdditionalFields.ParentProcess.ImageFile.Directory) and isnotempty(AdditionalFields.ParentProcess.ImageFile.Name), strcat (AdditionalFields.ParentProcess.ImageFile.Directory, \"\\\\\", AdditionalFields.ParentProcess.ImageFile.Name), coalesce(AdditionalFields.ParentProcess.ImageFile.Name, AdditionalFields.ParentProcess.FriendlyName)), \"\"),\n        ParentProcessSHA1_s = AdditionalFields.ParentProcess.ImageFile[0].SHA1,\n        ParentProcessSHA256_s = AdditionalFields.ParentProcess.ImageFile[2].SHA256,\n        ParentProcessMD5_s = AdditionalFields.ParentProcess.ImageFile[1].MD5\n    // Mapping File Entity\n    | extend \n        FileName,\n        FileDirectory = FolderPath,\n        FilePath = iff(isnotempty(FolderPath) and isnotempty(FileName), strcat(FolderPath, '\\\\', FileName), FileName),\n        FileSHA1 = SHA1,\n        FileSHA256 = SHA256,\n        FileMD5 = AdditionalFields.FileHashes[1].Value,\n        FileSize = FileSize\n    // Mapping Url Entity\n    | extend \n        Url = RemoteUrl\n    // Mapping Registry Entity\n    | extend \n        RegistryKey,\n        RegistryValue = RegistryValueName,\n        RegistryValueData,\n        ValueType = tostring(AdditionalFields.ValueType)\n    | lookup RegistryValueTypeLookup on ValueType\n    // Mapping Application Entity\n    | extend \n        AppId_s = ApplicationId,\n        AppName_s = Application\n    // Mapping Email Entity\n    | extend \n        EmailMessageId = NetworkMessageId,\n        EmailSubject\n    | extend AdditionalFields = bag_pack(\n                                \"AlertVerdictDate\",\n                                AlertVerdictDate_s,\n                                \"HttpUserAgent\",\n                                HttpUserAgent_s,\n                                \"GeoCity\",\n                                GeoCity_s,\n                                \"GeoCountry\",\n                                GeoCountry_s,\n                                \"GeoLatitude\",\n                                GeoLatitude_s,\n                                \"GeoLongitude\",\n                                GeoLongitude_s,\n                                \"GeoRegion\",\n                                GeoRegion_s,\n                                \"ParentProcessId\",\n                                ParentProcessId_s,\n                                \"ParentProcessCommandLine\",\n                                ParentProcessCommandLine_s,\n                                \"ParentProcessName\",\n                                ParentProcessName_s,\n                                \"ParentProcessSHA256\",\n                                ParentProcessSHA256_s,\n                                \"ParentProcessMD5\",\n                                ParentProcessMD5_s\n                            )\n    // Mapping common event fields\n    | extend\n        EventSubType = \"Threat\", // All events in AlertEvidence contains threat info\n        EventEndTime = TimeGenerated,\n        EventStartTime = TimeGenerated,\n        EventProduct = ServiceSource,\n        EventVendor = 'Microsoft',\n        EventSchema = 'AlertEvent',\n        EventSchemaVersion = '0.1',\n        EventType = 'Alert',\n        EventCount = int(1)\n    // MApping Alias\n    | extend \n        IpAddr = DvcIpAddr,\n        Hostname = DvcHostname,\n        User = Username\n    | project-away\n        Title,\n        Categories,\n        EntityType,\n        EvidenceRole,\n        DetectionSource,\n        ServiceSource,\n        ThreatFamily,\n        RemoteIP,\n        RemoteUrl,\n        AccountName,\n        AccountDomain,\n        DeviceName,\n        LocalIP,\n        AlertVerdict_Custom,\n        EvidenceDirection,\n        Account*,\n        ApplicationId,\n        Application,\n        *_s\n};\nparser(\n    disabled = disabled\n)",
+        "query": "let IndicatorTypeLookup = datatable (EntityType: string, IndicatorType: string)\n[\n\"User\", \"User\",\n\"Machine\", \"Host\",\n\"Process\", \"Process\",\n\"File\", \"File\",\n\"Ip\", \"Ip\",\n\"Url\", \"Url\",\n\"RegistryValue\", \"Registry\",\n\"CloudLogonSession\", \"LogonSession\",\n\"CloudApplication\", \"Application\",\n\"Mailbox\", \"Mailbox\",\n\"MailMessage\", \"Email\",\n\"CloudResource\", \"Cloud Resource\"\n];\nlet IndicatorAssociationLookup = datatable (EvidenceRole: string, IndicatorAssociation: string)\n    [\n    \"Related\", \"Associated\",\n    \"Impacted\", \"Targeted\"\n];\nlet RegistryValueTypeLookup = datatable (ValueType: string, RegistryValueType: string)\n    [\n    \"ExpandString\", \"Reg_Expand_Sz\"\n];\nlet AlertVerdictLookup = datatable (AlertVerdict_Custom: string, AlertVerdict: string)\n    [\n    \"Malicious\", \"True Positive\",\n    \"Suspicious\", \"True Positive\",\n    \"NoThreatsFound\", \"Benign Positive\"\n];\nlet AttackTacticSet = dynamic([\"Exfiltration\", \"PrivilegeEscalation\", \"Persistence\", \"LateralMovement\", \"Execution\", \"Discovery\", \"InitialAccess\", \"CredentialAccess\", \"DefenseEvasion\", \"CommandAndControl\", \"Impact\"]);\nlet ThreatCategorySet = dynamic([\"Malware\", \"Ransomware\", \"Trojan\", \"Virus\", \"Worm\", \"Adware\", \"Spyware\", \"Rootkit\", \"Cryptominor\", \"Phishing\", \"Spam\", \"MaliciousUrl\", \"Spoofing\", \"Security Policy Violation\", \"Unknown\", \"SuspiciousActivity\"]);\nlet parser = (\ndisabled: bool=false) {\nAlertEvidence\n| where not(disabled)\n// Mapping Inspection Fields\n| extend AdditionalFields = todynamic(AdditionalFields)\n| extend \n    EventUid = AlertId,\n    AlertName = Title,\n    AlertVerdict_Custom = tostring(AdditionalFields.ThreatAnalysisSummary[0].Verdict),\n    AlertVerdictDate_s = todatetime(AdditionalFields.ThreatAnalysisSummary[0].AnalysisDate),\n    AttackTactics = iff(Categories has_any (AttackTacticSet), replace_regex(Categories, @\"[\\[\\]\\\"\"]\", \"\"), \"\"),\n    AlertOriginalStatus = tostring(AdditionalFields.LastRemediationState),\n    AlertStatus = iif(isnotempty(AdditionalFields.LastRemediationState), iif(AdditionalFields.LastRemediationState == \"Active\", \"Active\", \"Closed\"), \"\"),\n    DetectionMethod = DetectionSource\n| lookup AlertVerdictLookup on AlertVerdict_Custom\n| lookup IndicatorTypeLookup on EntityType\n| lookup IndicatorAssociationLookup on EvidenceRole\n// Mapping Threat Fields\n| extend\n    ThreatCategory = iif(Categories has_any (ThreatCategorySet), replace_regex(Categories, @\"[\\[\\]\\\"\"]\", \"\"), \"\")\n// Mapping User Entity\n| extend \n    UserId = coalesce(AccountObjectId, tostring(AdditionalFields.Account.AadUserId)),\n    UserSid = coalesce(AccountSid, tostring(AdditionalFields.Account.Sid)),\n    Username = coalesce(AccountName, tostring(AdditionalFields.Account.UserPrincipalName)),\n    UserSessionId = tostring(AdditionalFields.SessionId),\n    UserScopeId = tostring(AdditionalFields.AadTenantId),\n    HttpUserAgent_s = tostring(AdditionalFields.UserAgent)\n| extend\n    UserIdType = iif(isnotempty(UserId), \"EntraUserID\", iif(isnotempty(UserSid), \"SID\", \"\")),\n    UserId = coalesce(UserId, UserSid),\n    UserType = _ASIM_GetUserType(Username, UserSid),\n    UsernameType = _ASIM_GetUsernameType(Username)\n// Mapping Device Entity\n| extend \n    DvcId = coalesce(DeviceId, tostring(AdditionalFields.Host.MachineId)),\n    DvcIpAddr = coalesce(LocalIP, tostring(AdditionalFields.Host.IpInterfaces[0].Address), RemoteIP),\n    DvcOs = tostring(coalesce(AdditionalFields.OSFamily, AdditionalFields.Host.OSFamily)),\n    DvcOsVersion = tostring(coalesce(AdditionalFields.OSVersion, AdditionalFields.Host.OSVersion)),\n    DeviceName = coalesce(DeviceName, tostring(AdditionalFields.Host.NetBiosName)),\n    DvcScopeId = coalesce(tostring(split(AdditionalFields.AzureID, \"/\")[2]), (tostring(split(AdditionalFields.ResourceId, \"/\")[2])))\n| extend DvcIdType = iif(isnotempty(DvcId), \"MDEid\", \"\")\n| invoke _ASIM_ResolveDvcFQDN(\"DeviceName\")\n// Mapping Additional Fields\n| extend\n    GeoCity_s = AdditionalFields.Location.City,\n    GeoCountry_s = AdditionalFields.Location.CountryCode,\n    GeoLatitude_s = AdditionalFields.Location.Latitude,\n    GeoLongitude_s = AdditionalFields.Location.Longitude,\n    GeoRegion_s = AdditionalFields.Location.State\n// Mapping Process Entity\n| extend \n    ProcessId = tostring(AdditionalFields.ProcessId),\n    ProcessCommandLine,\n    ProcessName = iif(IndicatorType == \"Process\", iif(isnotempty(FolderPath) and isnotempty(FileName), strcat(FolderPath, '\\\\', FileName), FileName), \"\"),\n    ProcessFileCompany = tostring(AdditionalFields.Publisher),\n    // Parent Process Fields\n    ParentProcessId_s = AdditionalFields.ParentProcess.ProcessId,\n    ParentProcessCommandLine_s = AdditionalFields.ParentProcess.CommandLine,\n    ParentProcessName_s = iif(IndicatorType == \"Process\", iif(isnotempty(AdditionalFields.ParentProcess.ImageFile.Directory) and isnotempty(AdditionalFields.ParentProcess.ImageFile.Name), strcat (AdditionalFields.ParentProcess.ImageFile.Directory, \"\\\\\", AdditionalFields.ParentProcess.ImageFile.Name), coalesce(AdditionalFields.ParentProcess.ImageFile.Name, AdditionalFields.ParentProcess.FriendlyName)), \"\"),\n    ParentProcessSHA1_s = AdditionalFields.ParentProcess.ImageFile[0].SHA1,\n    ParentProcessSHA256_s = AdditionalFields.ParentProcess.ImageFile[2].SHA256,\n    ParentProcessMD5_s = AdditionalFields.ParentProcess.ImageFile[1].MD5\n// Mapping File Entity\n| extend \n    FileName,\n    FileDirectory = FolderPath,\n    FilePath = iff(isnotempty(FolderPath) and isnotempty(FileName), strcat(FolderPath, '\\\\', FileName), FileName),\n    FileSHA1 = SHA1,\n    FileSHA256 = SHA256,\n    FileMD5 = tostring(AdditionalFields.FileHashes[1].Value),\n    FileSize = FileSize\n// Mapping Url Entity\n| extend \n    Url = RemoteUrl\n// Mapping Registry Entity\n| extend \n    RegistryKey,\n    RegistryValue = RegistryValueName,\n    RegistryValueData,\n    ValueType = tostring(AdditionalFields.ValueType)\n| lookup RegistryValueTypeLookup on ValueType\n// Mapping Application Entity\n| extend \n    AppId_s = ApplicationId,\n    AppName_s = Application\n// Mapping Email Entity\n| extend \n    EmailMessageId = NetworkMessageId,\n    EmailSubject\n| extend AdditionalFields = bag_pack(\n                            \"AlertVerdictDate\",\n                            AlertVerdictDate_s,\n                            \"HttpUserAgent\",\n                            HttpUserAgent_s,\n                            \"GeoCity\",\n                            GeoCity_s,\n                            \"GeoCountry\",\n                            GeoCountry_s,\n                            \"GeoLatitude\",\n                            GeoLatitude_s,\n                            \"GeoLongitude\",\n                            GeoLongitude_s,\n                            \"GeoRegion\",\n                            GeoRegion_s,\n                            \"ParentProcessId\",\n                            ParentProcessId_s,\n                            \"ParentProcessCommandLine\",\n                            ParentProcessCommandLine_s,\n                            \"ParentProcessName\",\n                            ParentProcessName_s,\n                            \"ParentProcessSHA256\",\n                            ParentProcessSHA256_s,\n                            \"ParentProcessMD5\",\n                            ParentProcessMD5_s,\n                            \"AppId\",\n                            AppId_s,\n                            \"AppName\",\n                            AppName_s,\n                            \"FileDirectory\",\n                            FileDirectory\n                        )\n// Mapping common event fields\n| extend\n    Type = \"AlertEvidence\",\n    EventSubType = \"Threat\", // All events in AlertEvidence contains threat info\n    TimeGenerated = Timestamp,\n    EventEndTime = Timestamp,\n    EventStartTime = Timestamp,\n    EventProduct = ServiceSource,\n    EventVendor = 'Microsoft',\n    EventSchema = 'AlertEvent',\n    EventSchemaVersion = '0.1',\n    EventType = 'Alert',\n    EventCount = int(1)\n// Mapping Alias\n| extend \n    IpAddr = DvcIpAddr,\n    Hostname = DvcHostname,\n    User = Username,\n    AlertId = EventUid\n| project\n    TimeGenerated,\n    Type,\n    AlertId,\n    EventUid,\n    AlertName,\n    AttackTactics,\n    AlertOriginalStatus,\n    AlertStatus,\n    DetectionMethod,\n    AlertVerdict,\n    IndicatorType,\n    IndicatorAssociation,\n    ThreatCategory,\n    UserId,\n    Username,\n    UserSessionId,\n    UserIdType,\n    UserType,\n    UsernameType,\n    DvcId,\n    DvcIpAddr,\n    DvcOs,\n    DvcOsVersion,\n    DvcScopeId,\n    DvcIdType,\n    DvcHostname,\n    DvcDomain,\n    DvcFQDN,\n    DvcDomainType,\n    ProcessId,\n    ProcessCommandLine,\n    ProcessName,\n    ProcessFileCompany,\n    FileName,\n    FilePath,\n    FileSHA1,\n    FileSHA256,\n    FileMD5,\n    FileSize,\n    Url,\n    RegistryKey,\n    RegistryValue,\n    RegistryValueData,\n    RegistryValueType,\n    EmailMessageId,\n    EmailSubject,\n    AdditionalFields,\n    EventSubType,\n    EventEndTime,\n    EventStartTime,\n    EventProduct,\n    EventVendor,\n    EventSchema,\n    EventSchemaVersion,\n    EventType,\n    EventCount,\n    IpAddr,\n    Hostname,\n    User\n};\nparser(\n    disabled = disabled\n)",
         "version": 1,
         "functionParameters": "disabled:bool=False"
       }