Skip to content

Commit 4262fc8

Browse files
Steve1145Steve1145
committed
Microsoft comments - updates
1 parent 74e5aad commit 4262fc8

File tree

4 files changed

+176
-84
lines changed

4 files changed

+176
-84
lines changed

‎Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEventCiscoSecureEndpoint.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Changelog for ASimAlertEventCiscoSecureEndpoint.yaml
2+
3+
## Version 0.1.0
4+
5+
- (2026-03-04) Cisco Secure Endpoint - AlertEvent ASIM Parser - [PR #13741](https://github.com/Azure/Azure-Sentinel/pull/13741)

‎Parsers/ASimAlertEvent/CHANGELOG/vimAlertEventCiscoSecureEndpoint.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Changelog for vimAlertEventCiscoSecureEndpoint.yaml
2+
3+
## Version 0.1.0
4+
5+
- (2026-03-04) Cisco Secure Endpoint - AlertEvent ASIM Parser - [PR #13741](https://github.com/Azure/Azure-Sentinel/pull/13741)

‎Parsers/ASimAlertEvent/Parsers/ASimAlertEventCiscoSecureEndpoint.yaml‎

Lines changed: 83 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,13 @@ ParserParams:
2222
- Name: disabled
2323
Type: bool
2424
Default: false
25+
- Name: pack
26+
Type: bool
27+
Default: false
2528
ParserQuery: |
2629
let CiscoSEParser = (
27-
disabled: bool=false
30+
disabled: bool=false,
31+
pack: bool=false
2832
)
2933
{
3034
CiscoSecureEndpointEventsV2_CL
@@ -125,20 +129,24 @@ ParserQuery: |
125129
EventSubType = 'Threat',
126130
EventCount = int(1),
127131
IndicatorType = 'File'
128-
| extend AdditionalFields = bag_pack(
129-
'ComputerExternalIp', ComputerExternalIp,
130-
'ComputerActive', ComputerActive,
131-
'ComputerNetworkAddresses', ComputerNetworkAddresses,
132-
'CloudIocShortDescription', CloudIocShortDescription,
133-
'BpDataRemediated', BpDataRemediated,
134-
'BpDataSilent', BpDataSilent,
135-
'BpDataType', BpDataType,
136-
'BpDataDetailsActions', BpDataDetailsActions,
137-
'BpDataDetailsSigId', BpDataDetailsSigId,
138-
'BpDataDetailsSigRev', BpDataDetailsSigRev,
139-
'BpDataDetailsSigSetVersion', BpDataDetailsSigSetVersion,
140-
'BpDataNormalizedObservablesAll', BpDataNormalizedObservablesAll,
141-
'BpDataDetailsMatchedActivityEvents', BpDataDetailsMatchedActivityEvents //full raw
132+
| extend AdditionalFields = iff (
133+
pack,
134+
bag_pack(
135+
'ComputerExternalIp', ComputerExternalIp,
136+
'ComputerActive', ComputerActive,
137+
'ComputerNetworkAddresses', ComputerNetworkAddresses,
138+
'CloudIocShortDescription', CloudIocShortDescription,
139+
'BpDataRemediated', BpDataRemediated,
140+
'BpDataSilent', BpDataSilent,
141+
'BpDataType', BpDataType,
142+
'BpDataDetailsActions', BpDataDetailsActions,
143+
'BpDataDetailsSigId', BpDataDetailsSigId,
144+
'BpDataDetailsSigRev', BpDataDetailsSigRev,
145+
'BpDataDetailsSigSetVersion', BpDataDetailsSigSetVersion,
146+
'BpDataNormalizedObservablesAll', BpDataNormalizedObservablesAll,
147+
'BpDataDetailsMatchedActivityEvents', BpDataDetailsMatchedActivityEvents //full raw
148+
),
149+
dynamic([])
142150
)
143151
| extend
144152
AlertId = EventUid,
@@ -147,34 +155,67 @@ ParserQuery: |
147155
Hostname = DvcHostname,
148156
IpAddr = DvcIpAddr,
149157
User = Username
150-
| project-away
151-
Techniques,
152-
Tactics,
153-
Timestamp,
154-
TimestampNanoseconds,
155-
BpDataDetailsEngVer,
156-
ComputerUser,
157-
Detection*,
158-
Start*,
159-
FileFile*,
160-
FileDisposition,
161-
BpData*,
162-
CommandLineArguments,
163-
FileIdentity*,
164-
FileParent*,
165-
ConnectorGuid,
166-
ComputerHostname,
167-
ComputerConnectorGuid,
168-
ComputerLinksComputer,
158+
| project
159+
EventUid,
160+
EventOriginalType,
161+
EventOriginalSeverity,
162+
EventEndTime,
169163
EventReportUrl,
170-
ComputerLinksGroup,
171-
CloudIocDescription,
172-
GroupGuids,
173-
CloudIocShortDescription,
174-
ComputerNetworkAddresses,
175-
ComputerActive,
176-
ComputerExternalIp
164+
AlertName,
165+
EventMessage,
166+
EventProductVersion,
167+
EventStartTime,
168+
EventOriginalUid,
169+
EventSeverity,
170+
DvcOriginalAction,
171+
DvcId,
172+
DvcOs,
173+
DvcOsVersion,
174+
DvcDescription,
175+
RuleName,
176+
ThreatId,
177+
Hostname,
178+
DvcIdType,
179+
DvcIpAddr,
180+
DvcMacAddr,
181+
DvcDomain,
182+
Username,
183+
UserId,
184+
FileName,
185+
FilePath,
186+
ParentFileName,
187+
ParentFilePath,
188+
ProcessCommandLine,
189+
FileSHA256,
190+
FileSize,
191+
ParentFileSHA256,
192+
ProcessId,
193+
ParentProcessId,
194+
UserIdType,
195+
DvcAction,
196+
FileSHA1,
197+
FileMD5,
198+
ParentFileSHA1,
199+
ParentFileMD5,
200+
UsernameType,
201+
AttackTechniques,
202+
AttackTactics,
203+
EventProduct,
204+
EventVendor,
205+
EventSchema,
206+
EventSchemaVersion,
207+
EventType,
208+
EventSubType,
209+
EventCount,
210+
IndicatorType,
211+
AdditionalFields,
212+
AlertId,
213+
AlertDescription,
214+
Rule,
215+
IpAddr,
216+
User
177217
};
178218
CiscoSEParser(
179-
disabled = disabled
219+
disabled = disabled,
220+
pack = pack
180221
)

‎Parsers/ASimAlertEvent/Parsers/vimAlertEventCiscoSecureEndpoint.yaml‎

Lines changed: 83 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,9 @@ ParserParams:
5252
- Name: disabled
5353
Type: bool
5454
Default: false
55+
- Name: pack
56+
Type: bool
57+
Default: false
5558
ParserQuery: |
5659
let CiscoSEParser = (
5760
starttime: datetime=datetime(null),
@@ -64,7 +67,8 @@ ParserQuery: |
6467
threatcategory_has_any: dynamic=dynamic([]),
6568
alertverdict_has_any: dynamic=dynamic([]),
6669
eventseverity_has_any: dynamic=dynamic([]),
67-
disabled:bool=false
70+
disabled: bool=false,
71+
pack: bool=false
6872
)
6973
{
7074
CiscoSecureEndpointEventsV2_CL
@@ -182,20 +186,24 @@ ParserQuery: |
182186
EventSubType = 'Threat',
183187
EventCount = int(1),
184188
IndicatorType = 'File'
185-
| extend AdditionalFields = bag_pack(
186-
'ComputerExternalIp', ComputerExternalIp,
187-
'ComputerActive', ComputerActive,
188-
'ComputerNetworkAddresses', ComputerNetworkAddresses,
189-
'CloudIocShortDescription', CloudIocShortDescription,
190-
'BpDataRemediated', BpDataRemediated,
191-
'BpDataSilent', BpDataSilent,
192-
'BpDataType', BpDataType,
193-
'BpDataDetailsActions', BpDataDetailsActions,
194-
'BpDataDetailsSigId', BpDataDetailsSigId,
195-
'BpDataDetailsSigRev', BpDataDetailsSigRev,
196-
'BpDataDetailsSigSetVersion', BpDataDetailsSigSetVersion,
197-
'BpDataNormalizedObservablesAll', BpDataNormalizedObservablesAll,
198-
'BpDataDetailsMatchedActivityEvents', BpDataDetailsMatchedActivityEvents //full raw
189+
| extend AdditionalFields = iff (
190+
pack,
191+
bag_pack(
192+
'ComputerExternalIp', ComputerExternalIp,
193+
'ComputerActive', ComputerActive,
194+
'ComputerNetworkAddresses', ComputerNetworkAddresses,
195+
'CloudIocShortDescription', CloudIocShortDescription,
196+
'BpDataRemediated', BpDataRemediated,
197+
'BpDataSilent', BpDataSilent,
198+
'BpDataType', BpDataType,
199+
'BpDataDetailsActions', BpDataDetailsActions,
200+
'BpDataDetailsSigId', BpDataDetailsSigId,
201+
'BpDataDetailsSigRev', BpDataDetailsSigRev,
202+
'BpDataDetailsSigSetVersion', BpDataDetailsSigSetVersion,
203+
'BpDataNormalizedObservablesAll', BpDataNormalizedObservablesAll,
204+
'BpDataDetailsMatchedActivityEvents', BpDataDetailsMatchedActivityEvents //full raw
205+
),
206+
dynamic([])
199207
)
200208
| extend
201209
AlertId = EventUid,
@@ -204,33 +212,65 @@ ParserQuery: |
204212
Hostname = DvcHostname,
205213
IpAddr = DvcIpAddr,
206214
User = Username
207-
| project-away
208-
Techniques,
209-
Tactics,
210-
Timestamp,
211-
TimestampNanoseconds,
212-
BpDataDetailsEngVer,
213-
ComputerUser,
214-
Detection*,
215-
Start*,
216-
FileFile*,
217-
FileDisposition,
218-
BpData*,
219-
CommandLineArguments,
220-
FileIdentity*,
221-
FileParent*,
222-
ConnectorGuid,
223-
ComputerHostname,
224-
ComputerConnectorGuid,
225-
ComputerLinksComputer,
215+
| project
216+
EventUid,
217+
EventOriginalType,
218+
EventOriginalSeverity,
219+
EventEndTime,
226220
EventReportUrl,
227-
ComputerLinksGroup,
228-
CloudIocDescription,
229-
GroupGuids,
230-
CloudIocShortDescription,
231-
ComputerNetworkAddresses,
232-
ComputerActive,
233-
ComputerExternalIp
221+
AlertName,
222+
EventMessage,
223+
EventProductVersion,
224+
EventStartTime,
225+
EventOriginalUid,
226+
EventSeverity,
227+
DvcOriginalAction,
228+
DvcId,
229+
DvcOs,
230+
DvcOsVersion,
231+
DvcDescription,
232+
RuleName,
233+
ThreatId,
234+
Hostname,
235+
DvcIdType,
236+
DvcIpAddr,
237+
DvcMacAddr,
238+
DvcDomain,
239+
Username,
240+
UserId,
241+
FileName,
242+
FilePath,
243+
ParentFileName,
244+
ParentFilePath,
245+
ProcessCommandLine,
246+
FileSHA256,
247+
FileSize,
248+
ParentFileSHA256,
249+
ProcessId,
250+
ParentProcessId,
251+
UserIdType,
252+
DvcAction,
253+
FileSHA1,
254+
FileMD5,
255+
ParentFileSHA1,
256+
ParentFileMD5,
257+
UsernameType,
258+
AttackTechniques,
259+
AttackTactics,
260+
EventProduct,
261+
EventVendor,
262+
EventSchema,
263+
EventSchemaVersion,
264+
EventType,
265+
EventSubType,
266+
EventCount,
267+
IndicatorType,
268+
AdditionalFields,
269+
AlertId,
270+
AlertDescription,
271+
Rule,
272+
IpAddr,
273+
User
234274
};
235275
CiscoSEParser(
236276
starttime = starttime,
@@ -243,5 +283,6 @@ ParserQuery: |
243283
threatcategory_has_any = threatcategory_has_any,
244284
alertverdict_has_any = alertverdict_has_any,
245285
eventseverity_has_any = eventseverity_has_any,
246-
disabled = disabled
286+
disabled = disabled,
287+
pack = pack
247288
)

0 commit comments

Comments
 (0)