Merge pull request #225523 from oshezaf/asim/update-authentication

asim/update-authentication

Author: PMEds28

.openpublishing.redirection.json

@@ -16084,11 +16084,36 @@
             "redirect_url": "/azure/sentinel/normalization-schema-dns",
             "redirect_document_id": true
         },
+        {
+            "source_path_from_root": "/articles/sentinel/authentication-normalization-schema.md",
+            "redirect_url": "/azure/sentinel/normalization-schema-authentication",
+            "redirect_document_id": true
+        },
+        {
+            "source_path_from_root": "/articles/sentinel/dhcp-normalization-schema.md",
+            "redirect_url": "/azure/sentinel/normalization-schema-dhcp",
+            "redirect_document_id": true
+        },
+        {
+            "source_path_from_root": "/articles/sentinel/user-management-normalization-schema.md",
+            "redirect_url": "/azure/sentinel/normalization-schema-user-management",
+            "redirect_document_id": true
+        },
         {
             "source_path_from_root": "/articles/sentinel/file-event-normalization-schema.md",
             "redirect_url": "/azure/sentinel/normalization-schema-file-event",
             "redirect_document_id": true
         },
+        {
+            "source_path_from_root": "/articles/sentinel/registry-event-normalization-schema.md",
+            "redirect_url": "/azure/sentinel/normalization-schema-registry-event",
+            "redirect_document_id": true
+        },
+        {
+            "source_path_from_root": "/articles/sentinel/process-events-normalization-schema.md",
+            "redirect_url": "/azure/sentinel/normalization-schema-process-event",
+            "redirect_document_id": true
+        },
         {
             "source_path_from_root": "/articles/service-bus/index.md",
             "redirect_url": "/azure/service-bus-messaging/index",

articles/sentinel/TOC.yml

@@ -560,21 +560,21 @@
         - name: ASIM audit event schema
           href: normalization-schema-audit.md
         - name: ASIM authentication schema
-          href: authentication-normalization-schema.md
+          href: normalization-schema-authentication.md
         - name: ASIM DNS schema
           href: normalization-schema-dns.md
         - name: ASIM DHCP schema
-          href: dhcp-normalization-schema.md
+          href: normalization-schema-dhcp.md
         - name: ASIM file event schema
           href: normalization-schema-file-event.md
         - name: ASIM network session schema
           href: normalization-schema-network.md
         - name: ASIM process event schema
-          href: process-events-normalization-schema.md
+          href: normalization-schema-process-event.md
         - name: ASIM registry event schema
-          href: registry-event-normalization-schema.md
+          href: normalization-schema-registry-event.md
         - name: ASIM user management schema
-          href: user-management-normalization-schema.md
+          href: normalization-schema-user-management.md
         - name: ASIM web session schema
           href: normalization-schema-web.md
         - name: Legacy network normalization schema

articles/sentinel/normalization-about-parsers.md

@@ -62,7 +62,7 @@ When invoking the parser, always use available filtering parameters by adding on
 
 Each schema has a standard set of filtering parameters documented in the relevant schema documentation. Filtering parameters are entirely optional. The following schemas support filtering parameters:
 - [Audit Event](normalization-schema-audit.md)
-- [Authentication](authentication-normalization-schema.md)
+- [Authentication](normalization-schema-authentication.md)
 - [DNS](normalization-schema-dns.md#filtering-parser-parameters)
 - [Network Session](normalization-schema-network.md#filtering-parser-parameters)
 - [Web Session](normalization-schema-web.md#filtering-parser-parameters)

articles/sentinel/normalization-about-schemas.md

@@ -18,15 +18,15 @@ Schema references outline the fields that comprise each schema. ASIM currently d
 | Schema | Version | Status |
 | ------ | ------- | ------ |
 | [Audit Event](normalization-schema-audit.md) | 0.1 | Preview |
-| [Authentication Event](authentication-normalization-schema.md) | 0.1.2 | Preview |
+| [Authentication Event](normalization-schema-authentication.md) | 0.1.3 | Preview |
 | [DNS Activity](normalization-schema-dns.md) | 0.1.6 | Preview |
-| [DHCP Activity](dhcp-normalization-schema.md) | 0.1 | Preview |
+| [DHCP Activity](normalization-schema-dhcp.md) | 0.1 | Preview |
 | [File Activity](normalization-schema-file-event.md) | 0.2 | Preview |
 | [Network Session](normalization-schema.md) | 0.2.5 | Preview |
-| [Process Event](process-events-normalization-schema.md) | 0.1.4 | Preview |
-| [Registry Event](registry-event-normalization-schema.md) | 0.1.2 | Preview |
-| [User Management](user-management-normalization-schema.md) | 0.1 | Preview |
-| [Web Session](normalization-schema-web.md) | 0.2.5 | Preview |
+| [Process Event](normalization-schema-process-event.md) | 0.1.4 | Preview |
+| [Registry Event](normalization-schema-registry-event.md) | 0.1.2 | Preview |
+| [User Management](normalization-schema-user-management.md) | 0.1 | Preview |
+| [Web Session](normalization-schema-web.md) | 0.2.6 | Preview |
 
 
 > [!IMPORTANT]
@@ -44,7 +44,7 @@ The following concepts help to understand the schema reference documents and ext
 |**Field class**     | Fields might have several classes, which define when the fields should be implemented by a parser: <br><br> - **Mandatory** fields must appear in every parser. If your source doesn't provide information for this value, or the data can't be otherwise added, it won't support most content items that reference the normalized schema.<br> -	**Recommended** fields should be normalized if available. However, they might not be available in every source. Any content item that references that normalized schema should take availability into account.<br> - **Optional** fields, if available, can be normalized or left in their original form. Typically, a minimal parser wouldn't normalize them for performance reasons.<br> - **Conditional** fields are mandatory if the field they follow is populated. Conditional fields are typically used to describe the value in another field. For example, the common field [DvcIdType](normalization-common-fields.md#dvcidtype) describes the value int the common field [DvcId](normalization-common-fields.md#dvcid) and is therefore mandatory if the latter is populated.<br>- **Alias** is a special type of a conditional field, and is mandatory if the aliased field is populated.   |
 |[**Common fields**](normalization-common-fields.md) | Some fields are common to all ASIM schemas. Each schema might add guidelines for using some of the common fields in the context of the specific schema. For example, permitted values for the **EventType** field might vary per schema, as might the value of the **EventSchemaVersion** field. |
 |**Entities**| Events evolve around entities, such as users, hosts, processes, or files. Each entity might require several fields to describe it. For example, a host might have a name and an IP address. <br><br>A single record might include multiple entities of the same type, such as both a source and destination host. <br><br>ASIM defines how to describe entities consistently, and entities allow for extending the schemas. <br><br>For example, while the Network Session schema doesn't include process information, some event sources do provide process information that can be added. For more information, see [Entities](#entities). |
-|**Aliases**| Aliases allow multiple names for a specified value. In some cases, different users expect a field to have different names. For example, in DNS terminology, you might expect a field named [DnsQuery](normalization-schema-dns.md#query), while more generally, it holds a domain name. The alias [Domain](normalization-schema-dns.md#domain) helps the user by allowing the use of both names. <br><br>In some cases, an alias can have the value of one of several fields, depending on which values are available in the event. For example, the [Dvc](normalization-common-fields.md#dvc) alias, aliases either the [DvcFQDN](normalization-common-fields.md#dvcfqdn), [DvcId](normalization-common-fields.md#dvcid), [DvcHostname](normalization-common-fields.md#dvchostname), or [DvcIpAddr](normalization-common-fields.md#dvcipaddr) , or [Event Product](normalization-common-fields.md#eventproduct) fields.<br><br>[Native normalized tables](normalization-ingest-time.md#ingest-time-parsing) do not include aliases, as those would imply duplicate data storage. Instead the [stub parsers](normalization-ingest-time.md#combining-ingest-time-and-query-time-normalization) add the aliases. To implement aliases in parsers, create a copy of the original value by using the `extend` operator.        |
+|**Aliases**| Aliases allow multiple names for a specified value. In some cases, different users expect a field to have different names. For example, in DNS terminology, you might expect a field named [DnsQuery](normalization-schema-dns.md#query), while more generally, it holds a domain name. The alias [Domain](normalization-schema-dns.md#domain) helps the user by allowing the use of both names. <br><br>In some cases, an alias can have the value of one of several fields, depending on which values are available in the event. For example, the [Dvc](normalization-common-fields.md#dvc) alias, aliases either the [DvcFQDN](normalization-common-fields.md#dvcfqdn), [DvcId](normalization-common-fields.md#dvcid), [DvcHostname](normalization-common-fields.md#dvchostname), or [DvcIpAddr](normalization-common-fields.md#dvcipaddr) , or [Event Product](normalization-common-fields.md#eventproduct) fields. When an alias can have several values, its type has to be a string to accommodate all possible aliased values. As a result, when assigning a value to such an alias, make sure to convert the type to string using the KQL function [tostring](/azure/data-explorer/kusto/query/tostringfunction).<br><br>[Native normalized tables](normalization-ingest-time.md#ingest-time-parsing) do not include aliases, as those would imply duplicate data storage. Instead the [stub parsers](normalization-ingest-time.md#combining-ingest-time-and-query-time-normalization) add the aliases. To implement aliases in parsers, create a copy of the original value by using the `extend` operator.        |
 
 
 ## Logical types

articles/sentinel/normalization-common-fields.md

@@ -19,7 +19,6 @@ The following fields are generated by Log Analytics, in most cases, for each rec
 | Field         | Type     | Discussion      |
 | ------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
 | <a name="timegenerated"></a>**TimeGenerated** | datetime | The time the event was generated by the reporting device.|
-| **_ResourceId**   | String     | The Azure Resource ID of the reporting device or service, or the log forwarder resource ID for events forwarded by using Syslog, CEF, or WEF. **_ResourceId** is not generated for sources for that do not have a resource concept, such as Microsoft Defender for Endpoint and will be empty for events from these sources.   |
 | **Type** | String | The original table from which the record was fetched. This field is useful when the same event can be received through multiple channels to different tables, and have the same [EventVendor](#eventvendor) and [EventProduct](#eventproduct) values.<br><br>For example, a Sysmon event can be collected either to the `Event` table or to the `WindowsEvent` table. |
 
 
@@ -109,9 +108,11 @@ The currently supported list of vendors and products used in the [EventVendor](#
 | Corelight | Zeek | 
 | GCP | Cloud DNS | 
 | Infoblox | NIOS | 
-| Microsoft | - AAD<br> - Azure<br> - Azure Firewall<br> - Azure Blob Storage<br>    - Azure File Storage<br>    - Azure NSG flows<br> - Azure Queue Storage<br>  - Azure Table Storage <br>      -  DNS Server<br> - Microsoft 365 Defender for Endpoint<br> - Microsoft Defender for IoT<br> - Security Events<br>- SharePoint<br>- OneDrive<br>- Sysmon<br> - Sysmon for Linux<br> - VMConnection<br> - Windows Firewall<br> - WireData <br>
-| Okta | - Okta<BR> - Auth0<br> | 
-| Palo Alto | - PanOS<br> - CDL<br> |
+| Microsoft | - Microsoft Azure Active Directory (Azure AD)<br> - Azure<br> - Azure Firewall<br> - Azure Blob Storage<br>    - Azure File Storage<br>    - Azure NSG flows<br> - Azure Queue Storage<br>  - Azure Table Storage <br>      -  DNS Server<br> - Microsoft 365 Defender for Endpoint<br> - Microsoft Defender for IoT<br> - Security Events<br>- SharePoint<br>- OneDrive<br>- Sysmon<br> - Sysmon for Linux<br> - VMConnection<br> - Windows Firewall<br> - WireData
+| Linux | - su<br> - sudo |
+| Okta | - Okta<br> - Auth0 | 
+| OpenBSD | OpenSSH |
+| Palo Alto | - PanOS<br> - CDL |
 | PostgreSQL | PostgreSQL |
 | Squid | Squid Proxy | 
 | Vectra AI | Vectra Steam |