You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/authentication-normalization-schema.md
+14-19Lines changed: 14 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,25 +25,15 @@ For more information about normalization in Microsoft Sentinel, see [Normalizati
25
25
26
26
## Parsers
27
27
28
-
Deploy ASIM parsers from the [Microsoft Sentinel GitHub repository](https://aka.ms/DeployASIM). For more information about ASIM parsers, see the articles [ASIM parsers overview](normalization-parsers-overview.md) and [Use ASIM parsers](normalization-about-parsers.md).
28
+
Deploy ASIM authentication parsers from the [Microsoft Sentinel GitHub repository](https://aka.ms/DeployASIM). For more information about ASIM parsers, see the articles [ASIM parsers overview](normalization-parsers-overview.md)..
29
29
30
30
### Unifying parsers
31
31
32
-
To use parsers that unify all ASIM out-of-the-box parsers, and ensure that your analysis runs across all the configured sources, use the `ImAuthentication` filtering parser or the `ASimAuthentication` parameter-less parser.
32
+
To use parsers that unify all ASIM out-of-the-box parsers, and ensure that your analysis runs across all the configured sources, use the `imAuthentication` filtering parser or the `ASimAuthentication` parameter-less parser.
33
33
34
-
## Source-specific parsers
34
+
###Source-specific parsers
35
35
36
-
Microsoft Sentinel provides the following built-in, product-specific authentication event parsers:
37
-
38
-
-**Windows sign-ins**
39
-
- Collected using the Log Analytics Agent or Azure Monitor Agent.
40
-
- Collected using either the Security Events connectors to the SecurityEvent table or using the WEF connector to the WindowsEvent table.
41
-
- Reported as Security Events (4624, 4625, 4634, and 4647).
42
-
-**Windows sign-ins** reported by Microsoft 365 Defender for Endpoint, collected using the Microsoft 365 Defender connector.
43
-
-**Linux Sign-ins** reported by Microsoft Defender to IoT Endpoint.
44
-
-**Azure Active Directory sign-ins**, collected using the Azure Active Directory connector. Separate parsers are provided for regular, Non-Interactive, Managed Identities and Service Principles Sign-ins.
45
-
-**AWS sign-ins**, collected using the AWS CloudTrail connector.
46
-
-**Okta authentication**, collected using the Okta connector.
36
+
For the list of authentication parsers Microsoft Sentinel provides refer to the [ASIM parsers list](normalization-parsers-list.md#authentication-parsers):
47
37
48
38
### Add your own normalized parsers
49
39
@@ -52,19 +42,19 @@ When implementing custom parsers for the Authentication information model, name
52
42
-`vimAuthentication<vendor><Product>` for filtering parsers
53
43
-`ASiAuthentication<vendor><Product>` for parameter-less parsers
54
44
55
-
For information on adding the your custom parsers to the unifying parser, refer to [Managing ASIM parsers](normalization-manage-parsers.md).
45
+
For information on adding your custom parsers to the unifying parser, refer to [Managing ASIM parsers](normalization-manage-parsers.md).
56
46
57
47
### Filtering parser parameters
58
48
59
-
The `im` and `vim*` parsers support [filtering parameters](normalization-about-parsers.md#optimized-parsers). While these parsers are optional, they can improve your query performance.
49
+
The `im` and `vim*` parsers support [filtering parameters](normalization-about-parsers.md#optimizing-parsing-using-parameters). While these parsers are optional, they can improve your query performance.
60
50
61
51
The following filtering parameters are available:
62
52
63
53
| Name | Type | Description |
64
54
|----------|-----------|-------------|
65
55
|**starttime**| datetime | Filter only authentication events that ran at or after this time. |
66
56
|**endtime**| datetime | Filter only authentication events that finished running at or before this time. |
67
-
|**targetusername_has**| string | Filter only authentication events that has any of the listed user names. |
57
+
|**targetusername_has**| string | Filter only authentication events that have any of the listed user names. |
68
58
69
59
70
60
For example, to filter only authentication events from the last day to a specific user, use:
> To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/azure/data-explorer/kusto/query/scalar-data-types/dynamic#dynamic-literals.md). For example: `dynamic(['192.168.','10.'])`.
69
+
>
70
+
71
+
77
72
## Normalized content
78
73
79
74
Normalized authentication analytic rules are unique as they detect attacks across sources. So, for example, if a user logged in to different, unrelated systems, from different countries, Microsoft Sentinel will now detect this threat.
@@ -135,7 +130,7 @@ Fields that appear in the table below are common to all ASIM schemas. Any guidel
| <aname="dst"></a>**Dst**| Recommended | String | A unique identifier of the authetication target. <br><br>This field may alias the [TargerDvcId](#targetdvcid), [TargetHostname](#targethostname), [TargetIpAddr](#targetipaddr), [TargetAppId](#targetappid), or [TargetAppName](#targetappname) fields. <br><br>Example: `192.168.12.1`|
211
+
| <aname="dst"></a>**Dst**| Recommended | String | A unique identifier of the authentication target. <br><br>This field may alias the [TargerDvcId](#targetdvcid), [TargetHostname](#targethostname), [TargetIpAddr](#targetipaddr), [TargetAppId](#targetappid), or [TargetAppName](#targetappname) fields. <br><br>Example: `192.168.12.1`|
217
212
| <aname="targetappid"></a>**TargetAppId**|Optional | String| The ID of the application to which the authorization is required, often assigned by the reporting device. <br><br>Example: `89162`|
218
213
|<aname="targetappname"></a>**TargetAppName**|Optional |String |The name of the application to which the authorization is required, including a service, a URL, or a SaaS application. <br><br>Example: `Saleforce`|
219
214
|**TargetAppType**|Optional |AppType |The type of the application authorizing on behalf of the Actor. For more information, and allowed list of values, see [AppType](normalization-about-schemas.md#apptype) in the [Schema Overview article](normalization-about-schemas.md).|
Copy file name to clipboardExpand all lines: articles/sentinel/connect-syslog.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -86,7 +86,7 @@ If the instructions on your data connector's page in Microsoft Sentinel indicate
86
86
87
87
Use the link in the data connector page to deploy your parsers, or follow the instructions from the [Microsoft Sentinel GitHub repository](https://github.com/Azure/Azure-Sentinel/tree/master/ASIM).
88
88
89
-
For more information, see [Advanced Security Information Model (ASIM) parsers](normalization-about-parsers.md).
89
+
For more information, see [Advanced Security Information Model (ASIM) parsers](normalization-parsers-overview.md).
0 commit comments