Skip to content

Commit 10c7e2b

Browse files
yummyblablaDerrick Lee
yummyblabla
and
Derrick Lee
authored
[ASIM] Create Authentication parser for Cisco ISE administrator auth events (#13909)
* Create parser * Update changelog * Fix kql issues * Fix date * Rename EventProduct to ISE * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * Update dates * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * Include pack in unifying parser * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * Fix KQL validation? * Add pack to correct line * Remove test files * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * Update dates * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * Fix enum * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. --------- Co-authored-by: Derrick Lee <derricklee@microsoft.com> Co-authored-by: github-actions[bot] <>
1 parent 936f040 commit 10c7e2b

17 files changed

Lines changed: 445 additions & 8 deletions

‎Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
"displayName": "Authentication ASIM parser",
2828
"category": "ASIM",
2929
"FunctionAlias": "ASimAuthentication",
30-
"query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet ASimAuthenticationDisabled=toscalar('ExcludeASimAuthentication' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimAuthenticationEmpty, \n ASimAuthenticationAADManagedIdentitySignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADNonInteractiveUserSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADServicePrincipalSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAWSCloudTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAWSCloudTrail' in (DisabledParsers) )),\n ASimAuthenticationBarracudaWAF (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationBarracudaWAF' in (DisabledParsers) )),\n ASimAuthenticationCiscoASA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoASA' in (DisabledParsers) )), \n ASimAuthenticationCiscoIOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoIOS' in (DisabledParsers) )),\n ASimAuthenticationCiscoISE (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISE' in (DisabledParsers) )),\n ASimAuthenticationCiscoMeraki (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMeraki' in (DisabledParsers) )),\n ASimAuthenticationCiscoMerakiSyslog (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )),\n ASimAuthenticationFortinetFortigate (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationFortigate' in (DisabledParsers) )),\n ASimAuthenticationM365Defender (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationM365Defender' in (DisabledParsers) )),\n ASimAuthenticationMD4IoT (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMD4IoT' in (DisabledParsers) )),\n ASimAuthenticationMicrosoftWindowsEvent (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )),\n ASimAuthenticationOktaSSO (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSSO' in (DisabledParsers) )),\n ASimAuthenticationOktaV2(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaV2' in (DisabledParsers) )),\n ASimAuthenticationOktaSystemLogs(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSystemLogs' in (DisabledParsers) )),\n ASimAuthenticationPostgreSQL (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPostgreSQL' in (DisabledParsers) )),\n ASimAuthenticationSigninLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSigninLogs' in (DisabledParsers) )),\n ASimAuthenticationSshd (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSshd' in (DisabledParsers) )),\n ASimAuthenticationSu (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSu' in (DisabledParsers) )),\n ASimAuthenticationSudo (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSudo' in (DisabledParsers) )),\n ASimAuthenticationSalesforceSC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceSC' in (DisabledParsers) )),\n ASimAuthenticationVectraXDRAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVectraXDRAudit' in (DisabledParsers) )),\n ASimAuthenticationSentinelOne (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSentinelOne' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspace (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspace' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoCortexDataLake (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )),\n ASimAuthenticationVMwareCarbonBlackCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )),\n ASimAuthenticationVMwareVCenter (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareVCenter' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalcon' in (DisabledParsers) )),\n ASimAuthenticationIllumioSaaSCore (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationIllumioSaaS' in (DisabledParsers) )),\n ASimAuthenticationNative (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationNative' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoPanOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPanOS' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationPaloAltoGlobalProtect (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) ), pack=pack)\n",
30+
"query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAuthentication') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet ASimAuthenticationDisabled=toscalar('ExcludeASimAuthentication' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nunion isfuzzy=true\n vimAuthenticationEmpty, \n ASimAuthenticationAADManagedIdentitySignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADManagedIdentitySignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADNonInteractiveUserSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADNonInteractiveUserSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAADServicePrincipalSignInLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAADServicePrincipalSignInLogs' in (DisabledParsers) )),\n ASimAuthenticationAWSCloudTrail (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationAWSCloudTrail' in (DisabledParsers) )),\n ASimAuthenticationBarracudaWAF (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationBarracudaWAF' in (DisabledParsers) )),\n ASimAuthenticationCiscoASA (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoASA' in (DisabledParsers) )), \n ASimAuthenticationCiscoIOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoIOS' in (DisabledParsers) )),\n ASimAuthenticationCiscoISE (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISE' in (DisabledParsers) )),\n ASimAuthenticationCiscoISEAdministrator (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoISEAdministrator' in (DisabledParsers) ),pack=pack),\n ASimAuthenticationCiscoMeraki (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMeraki' in (DisabledParsers) )),\n ASimAuthenticationCiscoMerakiSyslog (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCiscoMerakiSyslog' in (DisabledParsers) )),\n ASimAuthenticationFortinetFortigate (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationFortigate' in (DisabledParsers) )),\n ASimAuthenticationM365Defender (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationM365Defender' in (DisabledParsers) )),\n ASimAuthenticationMD4IoT (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMD4IoT' in (DisabledParsers) )),\n ASimAuthenticationMicrosoftWindowsEvent (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationMicrosoftWindowsEvent' in (DisabledParsers) )),\n ASimAuthenticationOktaSSO (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSSO' in (DisabledParsers) )),\n ASimAuthenticationOktaV2(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaV2' in (DisabledParsers) )),\n ASimAuthenticationOktaSystemLogs(ASimAuthenticationDisabled or ('ExcludeASimAuthenticationOktaSystemLogs' in (DisabledParsers) )),\n ASimAuthenticationPostgreSQL (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPostgreSQL' in (DisabledParsers) )),\n ASimAuthenticationSigninLogs (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSigninLogs' in (DisabledParsers) )),\n ASimAuthenticationSshd (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSshd' in (DisabledParsers) )),\n ASimAuthenticationSu (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSu' in (DisabledParsers) )),\n ASimAuthenticationSudo (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSudo' in (DisabledParsers) )),\n ASimAuthenticationSalesforceSC (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSalesforceSC' in (DisabledParsers) )),\n ASimAuthenticationVectraXDRAudit (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVectraXDRAudit' in (DisabledParsers) )),\n ASimAuthenticationSentinelOne (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationSentinelOne' in (DisabledParsers) )),\n ASimAuthenticationGoogleWorkspace (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationGoogleWorkspace' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoCortexDataLake (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoCortexDataLake' in (DisabledParsers) )),\n ASimAuthenticationVMwareCarbonBlackCloud (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareCarbonBlackCloud' in (DisabledParsers) )),\n ASimAuthenticationVMwareVCenter (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationVMwareVCenter' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationCrowdStrikeFalconHost (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationCrowdStrikeFalcon' in (DisabledParsers) )),\n ASimAuthenticationIllumioSaaSCore (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationIllumioSaaS' in (DisabledParsers) )),\n ASimAuthenticationNative (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationNative' in (DisabledParsers) )),\n ASimAuthenticationPaloAltoPanOS (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoPanOS' in (DisabledParsers) ), pack=pack),\n ASimAuthenticationPaloAltoGlobalProtect (ASimAuthenticationDisabled or ('ExcludeASimAuthenticationPaloAltoGlobalProtect' in (DisabledParsers) ), pack=pack)\n",
3131
"version": 1,
3232
"functionParameters": "pack:bool=False"
3333
}

‎Parsers/ASimAuthentication/ARM/ASimAuthenticationCiscoISEAdministrator/ASimAuthenticationCiscoISEAdministrator.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"Workspace": {
6+
"type": "string",
7+
"metadata": {
8+
"description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group."
9+
}
10+
},
11+
"WorkspaceRegion": {
12+
"type": "string",
13+
"defaultValue": "[resourceGroup().location]",
14+
"metadata": {
15+
"description": "The region of the selected workspace. The default value will use the Region selection above."
16+
}
17+
}
18+
},
19+
"resources": [
20+
{
21+
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
22+
"apiVersion": "2020-08-01",
23+
"name": "[concat(parameters('Workspace'), '/ASimAuthenticationCiscoISEAdministrator')]",
24+
"location": "[parameters('WorkspaceRegion')]",
25+
"properties": {
26+
"etag": "*",
27+
"displayName": "Authentication ASIM parser for Cisco ISE Administrator events",
28+
"category": "ASIM",
29+
"FunctionAlias": "ASimAuthenticationCiscoISEAdministrator",
30+
"query": "let parser = (disabled: bool = false, pack: bool = false) {\nSyslog\n| where not(disabled) and ProcessName has \"CISE_Administrative_and_Operational_Audit\"\n| where SyslogMessage has \"Administrator-Login\"\n| extend\n EventVendor = \"Cisco\",\n EventProduct = \"ISE\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n EventCount = int(1),\n EventStartTime = TimeGenerated,\n EventEndTime = TimeGenerated,\n EventSeverity = \"Informational\",\n EventType = \"Logon\",\n Type = \"Syslog\"\n| project-rename\n SrcIpAddr = HostIP,\n SrcDvcId = HostName\n| extend\n SrcDvcIdType = \"Other\"\n| parse SyslogMessage with * \"Administrator-Login:\" * \", \" KeyValuePairs\n| parse-kv KeyValuePairs as (ConfigVersionId: string, AdminInterface: string, AdminIPAddress: string, OperationMessageText: string, Port: int, AcsInstance: string, AdminName: string) with (pair_delimiter=\",\", kv_delimiter=\"=\")\n| extend\n EventResult = iff(isnotempty(AdminName), \"Success\", \"Failure\"), // AdminName exists in Syslog if authentication was successful\n EventResultDetails = iff(isempty(AdminName), case(\n OperationMessageText has \"Failed password\", \"Incorrect password\",\n OperationMessageText has \"User unknown\", \"No such user\",\n \"Other\"\n ), \"\"),\n TargetUsername = coalesce(AdminName, \"\"),\n TargetUsernameType = iff(isnotempty(AdminName), \"Simple\", \"\")\n| project-rename\n TargetIpAddr = AdminIPAddress,\n EventOriginalResultDetails = OperationMessageText,\n TargetPortNumber = Port\n| extend AdditionalFields = iff(pack, bag_pack(\n \"AdminInterface\", AdminInterface,\n \"ConfigVersionId\", ConfigVersionId,\n \"AcsInstance\", AcsInstance,\n \"CollectorHostName\", CollectorHostName\n), dynamic([]))\n| extend\n IpAddr = SrcIpAddr,\n Dvc = SrcDvcId\n| project\n TimeGenerated,\n Type,\n EventVendor,\n EventProduct,\n EventCount,\n EventSchema,\n EventSchemaVersion,\n EventStartTime,\n EventEndTime,\n EventSeverity,\n EventType,\n SrcIpAddr,\n SrcDvcId,\n SrcDvcIdType,\n EventResult,\n EventResultDetails,\n TargetUsername,\n TargetUsernameType,\n TargetIpAddr,\n EventOriginalResultDetails,\n TargetPortNumber,\n AdditionalFields,\n IpAddr,\n Dvc\n};\nparser(disabled=disabled, pack=pack)",
31+
"version": 1,
32+
"functionParameters": "disabled:bool=False,pack:bool=False"
33+
}
34+
}
35+
]
36+
}

‎Parsers/ASimAuthentication/ARM/ASimAuthenticationCiscoISEAdministrator/README.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Cisco ISE Administrator ASIM Authentication Normalization Parser
2+
3+
ARM template for ASIM Authentication schema parser for Cisco ISE Administrator.
4+
5+
This ASIM parser supports normalizing Cisco ISE administrator login events ingested into Microsoft Sentinel by the AMA agent to the ASIM Authentication schema.
6+
7+
8+
The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
9+
10+
For more information, see:
11+
12+
- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
13+
- [Deploy all of ASIM](https://aka.ms/DeployASIM)
14+
- [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc)
15+
16+
For the changelog, see:
17+
- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCiscoISEAdministrator.md)
18+
19+
<br>
20+
21+
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationCiscoISEAdministrator%2FASimAuthenticationCiscoISEAdministrator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FASimAuthenticationCiscoISEAdministrator%2FASimAuthenticationCiscoISEAdministrator.json)

‎Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,26 @@
218218
}
219219
}
220220
},
221+
{
222+
"type": "Microsoft.Resources/deployments",
223+
"apiVersion": "2020-10-01",
224+
"name": "linkedASimAuthenticationCiscoISEAdministrator",
225+
"properties": {
226+
"mode": "Incremental",
227+
"templateLink": {
228+
"uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/ASimAuthenticationCiscoISEAdministrator/ASimAuthenticationCiscoISEAdministrator.json",
229+
"contentVersion": "1.0.0.0"
230+
},
231+
"parameters": {
232+
"Workspace": {
233+
"value": "[parameters('Workspace')]"
234+
},
235+
"WorkspaceRegion": {
236+
"value": "[parameters('WorkspaceRegion')]"
237+
}
238+
}
239+
}
240+
},
221241
{
222242
"type": "Microsoft.Resources/deployments",
223243
"apiVersion": "2020-10-01",
@@ -918,6 +938,26 @@
918938
}
919939
}
920940
},
941+
{
942+
"type": "Microsoft.Resources/deployments",
943+
"apiVersion": "2020-10-01",
944+
"name": "linkedvimAuthenticationCiscoISEAdministrator",
945+
"properties": {
946+
"mode": "Incremental",
947+
"templateLink": {
948+
"uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuthentication/ARM/vimAuthenticationCiscoISEAdministrator/vimAuthenticationCiscoISEAdministrator.json",
949+
"contentVersion": "1.0.0.0"
950+
},
951+
"parameters": {
952+
"Workspace": {
953+
"value": "[parameters('Workspace')]"
954+
},
955+
"WorkspaceRegion": {
956+
"value": "[parameters('WorkspaceRegion')]"
957+
}
958+
}
959+
}
960+
},
921961
{
922962
"type": "Microsoft.Resources/deployments",
923963
"apiVersion": "2020-10-01",

‎Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎Parsers/ASimAuthentication/ARM/vimAuthenticationCiscoISEAdministrator/README.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Cisco ISE Administrator ASIM Authentication Normalization Parser
2+
3+
ARM template for ASIM Authentication schema parser for Cisco ISE Administrator.
4+
5+
This ASIM parser supports normalizing Cisco ISE administrator login events ingested into Microsoft Sentinel by the AMA agent to the ASIM Authentication schema.
6+
7+
8+
The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
9+
10+
For more information, see:
11+
12+
- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
13+
- [Deploy all of ASIM](https://aka.ms/DeployASIM)
14+
- [ASIM Authentication normalization schema reference](https://aka.ms/ASimAuthenticationDoc)
15+
16+
For the changelog, see:
17+
- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCiscoISEAdministrator.md)
18+
19+
<br>
20+
21+
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationCiscoISEAdministrator%2FvimAuthenticationCiscoISEAdministrator.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuthentication%2FARM%2FvimAuthenticationCiscoISEAdministrator%2FvimAuthenticationCiscoISEAdministrator.json)

0 commit comments

Comments
 (0)