Skip to content

Commit 91e02b1

Browse files
oshezafoshezaf
committed
Fix validation issues
1 parent d5f42cc commit 91e02b1

File tree

2 files changed

+15
-15
lines changed

2 files changed

+15
-15
lines changed

‎articles/sentinel/authentication-normalization-schema.md

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -134,10 +134,10 @@ In the following tables, *Type* refers to a logical type. For more information,
134134
| Field | Class | Type | Description |
135135
|---------------|--------------|------------|-----------------|
136136
| <a name="actoruserid"></a>**ActorUserId** | Optional | String | A machine-readable, alphanumeric, unique representation of the Actor. For more information, and for alternative fields for additional IDs, see [The User entity](normalization-about-schemas.md#the-user-entity). <br><br>Example: `S-1-12-1-4141952679-1282074057-627758481-2916039507` |
137-
| **ActorUserIdType**| Optional | UserIdType | The type of the ID stored in the [ActorUserId](#actoruserid) field. For more information and list of allowed values, see [The User entity](normalization-about-schemas.md#the-user-entity). |
137+
| **ActorUserIdType**| Optional | UserIdType | The type of the ID stored in the [ActorUserId](#actoruserid) field. For more information and list of allowed values, see [UserIdType](normalization-about-schemas.md#useridtype) in the [Schema Overview article](normalization-about-schemas.md).|
138138
| <a name="actorusername"></a>**ActorUsername** | Optional | Username | The Actor’s username, including domain information when available. For more information, see [The User entity](normalization-about-schemas.md#the-user-entity).<br><br>Example: `AlbertE` |
139-
| **ActorUsernameType** | Optional | UsernameType | Specifies the type of the user name stored in the [ActorUsername](#actorusername) field. For more information, and list of allowed values, see [The User entity](normalization-about-schemas.md#usernametype). <br><br>Example: `Windows` |
140-
| **ActorUserType** | Optional | UserType | The type of the Actor. For more information, and list of allowed values, see [The User entity](normalization-about-schemas.md#the-user-entity).<br><br>For example: `Guest` |
139+
| **ActorUsernameType** | Optional | UsernameType | Specifies the type of the user name stored in the [ActorUsername](#actorusername) field. For more information, and list of allowed values, see [UsernameType](normalization-about-schemas.md#usernametype) in the [Schema Overview article](normalization-about-schemas.md). <br><br>Example: `Windows` |
140+
| **ActorUserType** | Optional | UserType | The type of the Actor. For more information, and list of allowed values, see [UserType](normalization-about-schemas.md#usertype) in the [Schema Overview article](normalization-about-schemas.md).<br><br>For example: `Guest` |
141141
| **ActorSessionId** | Optional | String | The unique ID of the sign-in session of the Actor. <br><br>Example: `102pTUgC3p8RIqHvzxLCHnFlg` |
142142
| | | | |
143143

@@ -147,7 +147,7 @@ In the following tables, *Type* refers to a logical type. For more information,
147147
|---------------|--------------|------------|-----------------|
148148
| **ActingAppId** | Optional | String | The ID of the application authorizing on behalf of the actor, including a process, browser, or service. <br><br>For example: `0x12ae8` |
149149
| **ActiveAppName** | Optional | String | The name of the application authorizing on behalf of the actor, including a process, browser, or service. <br><br>For example: `C:\Windows\System32\svchost.exe` |
150-
| **ActingAppType** | Optional | AppType | The type of acting application. For more information, and allowed list of values, see [The Application entity](normalization-about-schemas.md#the-application-entity). |
150+
| **ActingAppType** | Optional | AppType | The type of acting application. For more information, and allowed list of values, see [AppType](normalization-about-schemas.md#apptype) in the [Schema Overview article](normalization-about-schemas.md). |
151151
| **HttpUserAgent** | Optional | String | When authentication is performed over HTTP or HTTPS, this field's value is the user_agent HTTP header provided by the acting application when performing the authentication.<br><br>For example: `Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1` |
152152
| | | | |
153153

@@ -156,10 +156,10 @@ In the following tables, *Type* refers to a logical type. For more information,
156156
| Field | Class | Type | Description |
157157
|---------------|--------------|------------|-----------------|
158158
|<a name="targetuserid"></a> **TargetUserId** | Optional | UserId | A machine-readable, alphanumeric, unique representation of the target user. For more information, and for alternative fields for additional IDs, see [The User entity](normalization-about-schemas.md#the-user-entity). <br><br> Example: `00urjk4znu3BcncfY0h7` |
159-
| **TargetUserIdType** | Optional | UserIdType | The type of the user ID stored in the [TargetUserId](#targetuserid) field. For more information and list of allowed values, see [The User entity](normalization-about-schemas.md#the-user-entity). <br><br> Example: `SID` |
159+
| **TargetUserIdType** | Optional | UserIdType | The type of the user ID stored in the [TargetUserId](#targetuserid) field. For more information and list of allowed values, see [UserIdType](normalization-about-schemas.md#useridtype) in the [Schema Overview article](normalization-about-schemas.md). <br><br> Example: `SID` |
160160
| <a name="targetusername"></a>**TargetUsername** | Optional | Username | The target user username, including domain information when available. For more information, see [The User entity](normalization-about-schemas.md#the-user-entity). <br><br>Example: `MarieC` |
161-
| **TargetUsernameType** |Optional | UsernameType | Specifies the type of the username stored in the [TargetUsername](#targetusername) field. For more information and list of allowed values, see [The User entity](normalization-about-schemas.md#the-user-entity). |
162-
| **TargetUserType** | Optional | UserType | The type of the Target user. For more information, and list of allowed values, see [The User entity](normalization-about-schemas.md#the-user-entity). <br><br>For example: `Member` |
161+
| **TargetUsernameType** |Optional | UsernameType | Specifies the type of the username stored in the [TargetUsername](#targetusername) field. For more information and list of allowed values, see [UsernameType](normalization-about-schemas.md#usernametype) in the [Schema Overview article](normalization-about-schemas.md). |
162+
| **TargetUserType** | Optional | UserType | The type of the Target user. For more information, and list of allowed values, see [UserType](normalization-about-schemas.md#usertype) in the [Schema Overview article](normalization-about-schemas.md). <br><br>For example: `Member` |
163163
| **TargetSessionId** | Optional | String | The sign-in session identifier of the TargetUser on the source device. |
164164
| **User** | Alias | Username | Alias to the [TargetUsername](#targetusername) or to the [TargetUserId](#targetuserid) if [TargetUsername](#targetusername) is not defined. <br><br>Example: `CONTOSO\dadmin` |
165165
| | | | |
@@ -170,10 +170,10 @@ In the following tables, *Type* refers to a logical type. For more information,
170170
|---------------|--------------|------------|-----------------|
171171
| <a name="src"></a>**Src** | Recommended | String | A unique identifier of the source device. <br><br>This field may alias the [SrcDvcId](#srcdvcid), [SrcHostname](#srchostname), or [SrcIpAddr](#srcipaddr) fields. <br><br>Example: `192.168.12.1` |
172172
| <a name="srcdvcid"></a>**SrcDvcId** | Optional | String | The ID of the source device as reported in the record. <br><br>For example: `ac7e9755-8eae-4ffc-8a02-50ed7a2216c3` |
173-
| **SrcDvcIdType** | Optional | DvcIdType | The type of [SrcDvcId](#srcdvcid). For more information, and list of allowed values, see [The User entity](normalization-about-schemas.md#the-device-entity).<br><br>**Note**: This field is required if [SrcDvcId](#srcdvcid) is used. |
173+
| **SrcDvcIdType** | Optional | DvcIdType | The type of [SrcDvcId](#srcdvcid). For more information, and list of allowed values, see [DvcIdType](normalization-about-schemas.md#dvcidtype) in the [Schema Overview article](normalization-about-schemas.md).<br><br>**Note**: This field is required if [SrcDvcId](#srcdvcid) is used. |
174174
| **SrcDeviceType** | Optional | DeviceType | The type of the source device. For more information, and list of allowed values, see [The Device entity](normalization-about-schemas.md#the-device-entity). |
175175
| <a name="srchostname"></a>**SrcHostname** |Optional | Hostname| The source device hostname, including domain information when available. For more information, see [The Device entity](normalization-about-schemas.md#the-device-entity). <br><br>Example: `Constoso\DESKTOP-1282V4D`|
176-
| **SrcHostnameType**|Optional | HostnameType |The type of [SrcDvcHostname](#srcdvchostname), if known. For more information and list of allowed values, see [The Device entity](normalization-about-schemas.md#the-device-entity). |
176+
| **SrcHostnameType**|Optional | HostnameType |The type of [SrcHostname](#srchostname), if known. For more information and list of allowed values, see [HostnameType](normalization-about-schemas.md#hostnametype) in the [Schema Overview article](normalization-about-schemas.md). |
177177
|<a name="srcipaddr"></a>**SrcIpAddr**|Recommended |IP Address |The IP address of the source device. <br><br>Example: `185.175.35.214` |
178178
| **SrcDvcOs**|Optional |String |The OS of the source device. <br><br>Example: `Windows 10` |
179179
|**SrcIsp** | Optional|String |The Internet Service Provider (ISP) used by the source device to connect to the internet. <br><br>Example: `corpconnect` |
@@ -192,14 +192,14 @@ In the following tables, *Type* refers to a logical type. For more information,
192192
| <a name="dst"></a>**Src** | Recommended | String | A unique identifier of the authetication target. <br><br>This field may alias the [SrcDvcId](#srcdvcid), [SrcHostname](#srchostname), [SrcIpAddr](#srcipaddr), [TargetAppId](#targetappid), or [TargetAppName](#targetappname) fields. <br><br>Example: `192.168.12.1` |
193193
| <a name="targetappid"></a>**TargetAppId** |Optional | String| The ID of the application to which the authorization is required, often assigned by the reporting device. <br><br>Example: `89162` |
194194
|<a name="targetappname"></a>**TargetAppName** |Optional |String |The name of the application to which the authorization is required, including a service, a URL, or a SaaS application. <br><br>Example: `Saleforce` |
195-
| **TargetAppType**|Optional |AppType |The type of the application authorizing on behalf of the Actor. For more information, and allowed list of values, see [The Application entity](normalization-about-schemas.md#the-application-entity).|
195+
| **TargetAppType**|Optional |AppType |The type of the application authorizing on behalf of the Actor. For more information, and allowed list of values, see [AppType](normalization-about-schemas.md#apptype) in the [Schema Overview article](normalization-about-schemas.md).|
196196
| <a name="targeturl"></a>**TargetUrl** |Optional |URL |The URL associated with the target application. <br><br>Example: `https://console.aws.amazon.com/console/home?fromtb=true&hashArgs=%23&isauthcode=true&nc2=h_ct&src=header-signin&state=hashArgsFromTB_us-east-1_7596bc16c83d260b` |
197-
|**LogonTarget**| Alias| |Alias to either [TargetAppName](#targetappname), [TargetUrl](#targeturl), or [TargetHostname](#targetdvchostname), whichever field best describes the authentication target. |
198-
|**TargetDvcId** |Optional | String|The ID of the target device as reported in the record. <br><br> Example: `2739` |
197+
|**LogonTarget**| Alias| |Alias to either [TargetAppName](#targetappname), [TargetUrl](#targeturl), or [TargetHostname](#targethostname), whichever field best describes the authentication target. |
198+
| <a name="targetdvcid"></a>**TargetDvcId** |Optional | String|The ID of the target device as reported in the record. <br><br> Example: `2739` |
199199
| **TargetDvcIdType** | Optional | DvcIdType | The type of [TargetDvcId](#srcdvcid). For more information, and list of allowed values, see [The Device Entity](normalization-about-schemas.md#the-device-entity).<br><br>**Note**: This field is required if [TargetDvcId](#targetdvcid) is used. |
200200
|<a name="targethostname"></a>**TargetHostname** | Recommended| Hostname |The target device hostname, including domain information when available. For more information, see [The Device entity](normalization-about-schemas.md#the-device-entity). |
201-
| **TargetHostnameType**|Recommended | HostnameType |The type of [TargetDvcHostname](#targetdvchostname). For more information and list of allowed values, see [The Device entity](normalization-about-schemas.md#the-device-entity). |
202-
| **TargetDeviceType** |Optional | Enumerated|The type of the target device. For more information and list of allowed values, see [The Device entity](normalization-about-schemas.md#the-device-entity). |
201+
| **TargetHostnameType**|Recommended | HostnameType |The type of [TargetHostname](#targethostname). For more information and list of allowed values, see [HostnameType](normalization-about-schemas.md#hostnametype) in the [Schema Overview article](normalization-about-schemas.md). |
202+
| **TargetDeviceType** |Optional | Enumerated|The type of the target device. For more information and list of allowed values, see [DeviceType](normalization-about-schemas.md#devicetype) in the [Schema Overview article](normalization-about-schemas.md). |
203203
|<a name="targetdvcipaddr"></a>**TargetDvcIpAddr** |Optional | IP Address|The IP address of the target device. <br><br>Example: `2.2.2.2` |
204204
| **TargetDvcOs**| Optional| String| The OS of the target device. <br><br>Example: `Windows 10`|
205205
| **TargetPortNumber** |Optional |Integer |The port of the target device.|

‎articles/sentinel/normalization-about-schemas.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ The following fields are defined by ASIM for all schemas:
106106
| **EventStartTime** | Mandatory | Date/time | If the source supports aggregation and the record represents multiple events, this field specifies the time that the first event was generated. <br><br>Otherwise, this field aliases the [TimeGenerated](#timegenerated) field. |
107107
| **EventEndTime** | Mandatory | Alias | Alias to the [TimeGenerated](#timegenerated) field. |
108108
| <a name="eventtype"></a>**EventType** | Mandatory | Enumerated | Describes the operation reported by the record. Each schema documents the list of values valid for this field. The original, source specific, value is stored in the [EventOriginalType](#eventoriginaltype) field. |
109-
| **EventSubType** | Optional | Enumerated | Describes a subdivision of the operation reported in the [EventType](#eventtype) field. Each schema documents the list of values valid for this field. The original, source specific, value is stored in the [EventOriginalSubType](#eventoriginalsubtype) field. |
109+
| <a name="eventsubtype"></a>**EventSubType** | Optional | Enumerated | Describes a subdivision of the operation reported in the [EventType](#eventtype) field. Each schema documents the list of values valid for this field. The original, source specific, value is stored in the [EventOriginalSubType](#eventoriginalsubtype) field. |
110110
| <a name="eventresult"></a>**EventResult** | Mandatory | Enumerated | One of the following values: **Success**, **Partial**, **Failure**, **NA** (Not Applicable).<br> <br>The value might be provided in the source record by using different terms, which should be normalized to these values. Alternatively, the source might provide only the [EventResultDetails](#eventresultdetails) field, which should be analyzed to derive the EventResult value.<br><br>Example: `Success`|
111111
| <a name="eventresultdetails"></a>**EventResultDetails** | Mandatory | Enumerated | Reason or details for the result reported in the [EventResult](#eventresult) field. Each schema documents the list of values valid for this field. The original, source specific, value is stored in the [EventOriginalResultDetails](#eventoriginalresultdetails) field.<br><br>Example: `NXDOMAIN`|
112112
| **EventOriginalUid** | Optional | String | A unique ID of the original record, if provided by the source.<br><br>Example: `69f37748-ddcd-4331-bf0f-b137f1ea83b`|

0 commit comments

Comments
 (0)