You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/authentication-normalization-schema.md
+10-15Lines changed: 10 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,25 +25,15 @@ For more information about normalization in Microsoft Sentinel, see [Normalizati
25
25
26
26
## Parsers
27
27
28
-
Deploy ASIM parsers from the [Microsoft Sentinel GitHub repository](https://aka.ms/DeployASIM). For more information about ASIM parsers, see the articles [ASIM parsers overview](normalization-parsers-overview.md) and [Use ASIM parsers](normalization-about-parsers.md).
28
+
Deploy ASIM authentication parsers from the [Microsoft Sentinel GitHub repository](https://aka.ms/DeployASIM). For more information about ASIM parsers, see the articles [ASIM parsers overview](normalization-parsers-overview.md)..
29
29
30
30
### Unifying parsers
31
31
32
-
To use parsers that unify all ASIM out-of-the-box parsers, and ensure that your analysis runs across all the configured sources, use the `ImAuthentication` filtering parser or the `ASimAuthentication` parameter-less parser.
32
+
To use parsers that unify all ASIM out-of-the-box parsers, and ensure that your analysis runs across all the configured sources, use the `imAuthentication` filtering parser or the `ASimAuthentication` parameter-less parser.
33
33
34
-
## Source-specific parsers
34
+
###Source-specific parsers
35
35
36
-
Microsoft Sentinel provides the following built-in, product-specific authentication event parsers:
37
-
38
-
-**Windows sign-ins**
39
-
- Collected using the Log Analytics Agent or Azure Monitor Agent.
40
-
- Collected using either the Security Events connectors to the SecurityEvent table or using the WEF connector to the WindowsEvent table.
41
-
- Reported as Security Events (4624, 4625, 4634, and 4647).
42
-
-**Windows sign-ins** reported by Microsoft 365 Defender for Endpoint, collected using the Microsoft 365 Defender connector.
43
-
-**Linux Sign-ins** reported by Microsoft Defender to IoT Endpoint.
44
-
-**Azure Active Directory sign-ins**, collected using the Azure Active Directory connector. Separate parsers are provided for regular, Non-Interactive, Managed Identities and Service Principles Sign-ins.
45
-
-**AWS sign-ins**, collected using the AWS CloudTrail connector.
46
-
-**Okta authentication**, collected using the Okta connector.
36
+
For the list of authentication parsers Microsoft Sentinel provides refer to the [ASIM parsers list](normalization-parsers-list.md#authentication-parsers):
> To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/azure/data-explorer/kusto/query/scalar-data-types/dynamic#dynamic-literals.md). For example: `dynamic(['192.168.','10.'])`.
69
+
>
70
+
71
+
77
72
## Normalized content
78
73
79
74
Normalized authentication analytic rules are unique as they detect attacks across sources. So, for example, if a user logged in to different, unrelated systems, from different countries, Microsoft Sentinel will now detect this threat.
@@ -135,7 +130,7 @@ Fields that appear in the table below are common to all ASIM schemas. Any guidel
Copy file name to clipboardExpand all lines: articles/sentinel/connect-syslog.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -86,7 +86,7 @@ If the instructions on your data connector's page in Microsoft Sentinel indicate
86
86
87
87
Use the link in the data connector page to deploy your parsers, or follow the instructions from the [Microsoft Sentinel GitHub repository](https://github.com/Azure/Azure-Sentinel/tree/master/ASIM).
88
88
89
-
For more information, see [Advanced Security Information Model (ASIM) parsers](normalization-about-parsers.md).
89
+
For more information, see [Advanced Security Information Model (ASIM) parsers](normalization-parsers-overview.md).
Copy file name to clipboardExpand all lines: articles/sentinel/dns-normalization-schema.md
+4-20Lines changed: 4 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -63,31 +63,15 @@ _Im_DNS | where SrcIpAddr != "127.0.0.1" and EventSubType == "response"
63
63
64
64
## Parsers
65
65
66
-
For more information about ASIM parsers, see the [ASIM parsers overview](normalization-parsers-overview.md) and [Use ASIM parsers](normalization-about-parsers.md).
66
+
For more information about ASIM parsers, see the [ASIM parsers overview](normalization-parsers-overview.md).
67
67
68
68
### Unifying parsers
69
69
70
-
To use parsers that unify all ASIM out-of-the-box parsers, and ensure that your analysis runs across all the configured sources, use the `_Im_Dns` filtering parser or the `_ASim_Dns` parameter-less parser. You can also use workspace deployed `ImDns` and `ASimDns` parsers. Deploy workspace parsers from the [Microsoft Sentinel GitHub repository](https://aka.ms/DeployASIM). For more information, see [built-in ASIM parsers and workspace-deployed parsers](normalization-parsers-overview.md#built-in-asim-parsers-and-workspace-deployed-parsers).
70
+
To use parsers that unify all ASIM out-of-the-box parsers, and ensure that your analysis runs across all the configured sources, use the `_Im_Dns` filtering parser or the `_ASim_Dns` parameter-less parser. You can also use workspace deployed `ImDns` and `ASimDns` parsers.
71
71
72
72
### Out-of-the-box, source-specific parsers
73
73
74
-
Microsoft Sentinel provides the following out-of-the-box, product-specific DNS parsers:
|**Microsoft DNS Server**<br>Collected by the DNS connector<br> and the Log Analytics Agent |`_ASim_Dns_MicrosoftOMS` (regular) <br> `_Im_Dns_MicrosoftOMS` (filtering) <br><br> |`ASimDnsMicrosoftOMS` (regular) <br>`vimDnsMicrosoftOMS` (filtering) <br><br> |
79
-
|**Microsoft DNS Server**<br>Collected by NXlog|`_ASim_Dns_MicrosoftNXlog` (regular)<br>`_Im_Dns_MicrosoftNXlog` (filtering)|`ASimDnsMicrosoftNXlog` (regular)<br> `vimDnsMicrosoftNXlog` (filtering)|
|**Sysmon for Windows** (event 22)<br> Collected by the Log Analytics Agent<br> or the Azure Monitor Agent,<br>supporting both the<br> `Event` and `WindowsEvent` tables |`_ASim_Dns_MicrosoftSysmon` (regular)<br> `_Im_Dns_MicrosoftSysmon` (filtering) |`ASimDnsMicrosoftSysmon` (regular)<br> `vimDnsMicrosoftSysmon` (filtering) |
0 commit comments