CSIEM Content Notes 2025-01-14

Author: jc-sumo

blog-cse/2025/01-14.md

@@ -0,0 +1,41 @@
+### January 14, 2025 - Content Release
+
+This content release includes:
+- Parsing and mapping support for Azure DevOps Auditing via EventHubs, and Pfsense Firewall,
+- Parsing and mapping additions and updates for Cisco ISE, Cloudflare, Check Point Firewall, and Linux OS Syslog
+
+* Note: In ~2 weeks MATCH-S00604 "OneLogin - API Credentials - Key Used from Untrusted Location" will be deleted from OOTB Cloud SIEM Rules due to unmanageable deny list logic and low adoption. To retain this rule, a duplicate must be made prior to the deletion.
+
+## Log Mappers
+- [New] Azure DevOps Auditing Catch All
+- [New] Check Point Application Control URL Filtering
+- [New] Cisco ISE Radius Diagnostics
+- [New] Linux OS Syslog - KRB5 Child - Authentication Failure
+- [New] Linux OS Syslog - Process systemd - Systemd Session
+- [New] Linux OS Syslog - Process systemd - Systemd Session Scope
+- [New] Linux OS Syslog - Process systemd - session logout
+- [New] Pfsense Firewall filterlog
+- [New] Pfsense Firewall nginx
+- [New] Pfsense Firewall openvpn Authentication
+- [New] Pfsense Firewall openvpn_peer_info|openvpn_error|php_log|sshguard|sshd_log
+- [New] Pfsense Firewall openvpn_server_connected|openvpn_server_disconnected|cron_log
+- [Updated] Cisco ISE Authentication Failure
+    - Adds normalizedSeverity mapping
+- [Updated] Cisco ISE Authentication Success
+    - Adds normalizedSeverity mapping
+- [Updated] Cloudflare - Logpush
+    - Adds mapping for dns_query, http_hostname,http_response_contentLength, http_response_contentType, and an alternative value for ipProtocol.
+- [Updated] Linux OS Syslog - Process sshd - SSH Session Closed|disconnect
+    - Adds mapping for normalizedAction
+- [Updated] Linux OS Syslog - Process systemd - Systemd Session Start and Systemd File Configuration
+    - Added support for additional events and mapping of file_path
+
+## Parsers
+- [New] /Parsers/System/Pfsense/Pfsense Firewall
+- [Updated] /Parsers/System/Check Point/Check Point Firewall JSON
+- [Updated] /Parsers/System/Cisco/Cisco ISE
+- [Updated] /Parsers/System/Cloudflare/Cloudflare Logpush
+- [Updated] /Parsers/System/Linux/Linux OS Syslog
+- [Updated] /Parsers/System/Linux/Shared/Linux Shared Syslog Headers
+
+- [Updated] /Parsers/System/Linux/Shared/Linux Shared Syslog Headers