Skip to content

Commit 2abc6fb

Browse files
yummyblablaDerrick Lee
andauthored
[ASIM] Fixes to VMwareVcenter Authentication parser (#14075)
* Fixes to VMwareVcenter * Fix changelog * Update yaml version * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * Additional changes * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. --------- Co-authored-by: Derrick Lee <derricklee@microsoft.com> Co-authored-by: github-actions[bot] <>
1 parent 700c28c commit 2abc6fb

6 files changed

Lines changed: 50 additions & 20 deletions

File tree

Parsers/ASimAuthentication/ARM/ASimAuthenticationVMwareVCenter/ASimAuthenticationVMwareVCenter.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
"displayName": "ASIM Authentication parser for VMware vCenter",
2828
"category": "ASIM",
2929
"FunctionAlias": "ASimAuthenticationVMwareVCenter",
30-
"query": "let parser = (disabled: bool = false, pack: bool = false) {\n let EventSeverityLookup = datatable (EventOriginalSeverity: string, EventSeverity: string) [\n \"info\", \"Informational\"\n ];\n let EventTypeLookup = datatable (EventOriginalType: string, EventType: string) [\n \"vim.event.UserLoginSessionEvent\", \"Logon\",\n \"vim.event.UserLogoutSessionEvent\", \"LogOff\"\n ];\n let LoginEvents = (T: (Message: string), TableType: string) {\n T\n | where Message has \"UserLoginSessionEvent\"\n | extend Type = TableType\n | parse Message with * \"Event [\" EventOriginalUid:string \"] [1-1] [\" EventTime:datetime \"] [\" EventOriginalType:string \"] [\" EventOriginalSeverity:string \"]\" * \"[User \" ActorUsername:string \"@\" SrcIpAddr:string \" logged in as \" HttpUserAgent:string \"]\" *;\n };\n let LogoutEvents = (T: (Message: string), TableType: string) {\n T\n | where Message has \"UserLogoutSessionEvent\"\n | extend Type = TableType\n | parse Message with * \"Event [\" EventOriginalUid: string \"] [1-1] [\" EventTime: datetime \"] [\" EventOriginalType: string \"] [\" EventOriginalSeverity:string \"]\" * \"[User \" ActorUsername:string \"@\" SrcIpAddr \" logged out (login time:\" LoginTime: string \", number of API invocations: \" APIInvocationCount: string \", user agent:\" HttpUserAgent: string \")]\" *;\n };\n let vCenterLogs = vcenter_CL\n | where not(disabled);\n let AzureVCenterLogs = AVSVcSyslog\n | where not(disabled);\n union\n LoginEvents(vCenterLogs, \"vcenter_CL\"),\n LogoutEvents(vCenterLogs, \"vcenter_CL\"),\n LoginEvents(AzureVCenterLogs, \"AVSVcSyslog\"),\n LogoutEvents(AzureVCenterLogs, \"AVSVcSyslog\")\n | extend\n EventVendor = \"VMware\",\n EventProduct = \"vCenter\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n EventStartTime = EventTime,\n EventEndTime = EventTime,\n EventCount = coalesce(toint(APIInvocationCount), int(1)),\n ActorUsernameType = \"Simple\",\n EventResult = \"Success\"\n | lookup EventTypeLookup on EventOriginalType\n | lookup EventSeverityLookup on EventOriginalSeverity\n | project-rename\n EventOriginalResultDetails = Message\n | extend\n AdditionalFields = iff(pack, bag_pack(\"LoginTime\", LoginTime), dynamic([])),\n IpAddr = SrcIpAddr,\n Dvc = EventProduct\n | project\n TimeGenerated,\n Type,\n EventVendor,\n EventProduct,\n EventSchema,\n EventSchemaVersion,\n EventStartTime,\n EventEndTime,\n EventCount,\n ActorUsernameType,\n EventResult,\n EventOriginalType,\n EventType,\n EventOriginalSeverity,\n EventOriginalResultDetails,\n EventOriginalUid,\n ActorUsername,\n SrcIpAddr,\n HttpUserAgent,\n AdditionalFields,\n IpAddr,\n Dvc;\n};\nparser(disabled=disabled, pack=pack)\n",
30+
"query": "let parser = (disabled: bool = false, pack: bool = false) {\n let EventSeverityLookup = datatable (EventOriginalSeverity: string, EventSeverity: string) [\n \"info\", \"Informational\"\n ];\n let EventTypeLookup = datatable (EventOriginalType: string, EventType: string) [\n \"vim.event.UserLoginSessionEvent\", \"Logon\",\n \"vim.event.UserLogoutSessionEvent\", \"LogOff\"\n ];\n let LoginEvents = (T: (Message: string), TableType: string) {\n T\n | where Message has \"UserLoginSessionEvent\"\n | extend Type = TableType\n | parse Message with PreEventString \"Event [\" EventOriginalUid:string \"] [1-1] [\" EventTime:datetime \"] [\" EventOriginalType:string \"] [\" EventOriginalSeverity:string \"]\" * \"[User \" TargetUsername:string \"@\" SrcIpAddr:string \" logged in as \" HttpUserAgent:string \"]\" *\n | extend DvcId = split(PreEventString, \" \")[3];\n };\n let LogoutEvents = (T: (Message: string), TableType: string) {\n T\n | where Message has \"UserLogoutSessionEvent\"\n | extend Type = TableType\n | parse Message with PreEventString \"Event [\" EventOriginalUid: string \"] [1-1] [\" EventTime: datetime \"] [\" EventOriginalType: string \"] [\" EventOriginalSeverity:string \"]\" * \"[User \" TargetUsername:string \"@\" SrcIpAddr \" logged out (login time:\" LoginTime: string \", number of API invocations: \" APIInvocationCount: string \", user agent:\" HttpUserAgent: string \")]\" *\n | extend DvcId = split(PreEventString, \" \")[3];\n };\n let vCenterLogs = vcenter_CL\n | where not(disabled);\n let AzureVCenterLogs = AVSVcSyslog\n | where not(disabled);\n union\n LoginEvents(vCenterLogs, \"vcenter_CL\"),\n LogoutEvents(vCenterLogs, \"vcenter_CL\"),\n LoginEvents(AzureVCenterLogs, \"AVSVcSyslog\"),\n LogoutEvents(AzureVCenterLogs, \"AVSVcSyslog\")\n | extend\n EventVendor = \"VMware\",\n EventProduct = \"vCenter\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n EventStartTime = EventTime,\n EventEndTime = EventTime,\n EventCount = coalesce(toint(APIInvocationCount), int(1)),\n TargetUsernameType = \"Simple\",\n EventResult = \"Success\"\n | lookup EventTypeLookup on EventOriginalType\n | lookup EventSeverityLookup on EventOriginalSeverity\n | project-rename\n EventOriginalResultDetails = Message\n | extend\n AdditionalFields = iff(pack, bag_pack(\"LoginTime\", LoginTime), dynamic([])),\n IpAddr = SrcIpAddr,\n User = TargetUsername,\n Dvc = DvcId\n | project\n TimeGenerated,\n Type,\n EventVendor,\n EventProduct,\n EventSchema,\n EventSchemaVersion,\n EventStartTime,\n EventEndTime,\n EventCount,\n TargetUsernameType,\n EventResult,\n EventOriginalType,\n EventType,\n EventSeverity,\n EventOriginalSeverity,\n EventOriginalResultDetails,\n EventOriginalUid,\n TargetUsername,\n SrcIpAddr,\n HttpUserAgent,\n AdditionalFields,\n IpAddr,\n Dvc,\n DvcId,\n User;\n};\nparser(disabled=disabled, pack=pack)\n",
3131
"version": 1,
3232
"functionParameters": "disabled:bool=False,pack:bool=False"
3333
}

Parsers/ASimAuthentication/ARM/vimAuthenticationVMwareVCenter/vimAuthenticationVMwareVCenter.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
"displayName": "ASIM Authentication filtering parser for VMware vCenter",
2828
"category": "ASIM",
2929
"FunctionAlias": "vimAuthenticationVMwareVCenter",
30-
"query": "let parser = (starttime: datetime=datetime(null), \n endtime: datetime=datetime(null), \n username_has_any: dynamic = dynamic([]),\n targetappname_has_any: dynamic = dynamic([]),\n srcipaddr_has_any_prefix: dynamic = dynamic([]),\n srchostname_has_any: dynamic = dynamic([]),\n eventtype_in: dynamic = dynamic([]),\n eventresultdetails_in: dynamic = dynamic([]),\n eventresult: string = '*',\n disabled: bool=false,\n pack:bool = false) {\n let EventSeverityLookup = datatable (EventOriginalSeverity: string, EventSeverity: string) [\n \"info\", \"Informational\"\n ];\n let EventTypeLookup = datatable (EventOriginalType: string, EventType: string) [\n \"vim.event.UserLoginSessionEvent\", \"Logon\",\n \"vim.event.UserLogoutSessionEvent\", \"LogOff\"\n ];\n let LoginEvents = (T: (Message: string), TableType: string) {\n T\n | where Message has \"UserLoginSessionEvent\"\n | extend Type = TableType\n | parse Message with * \"Event [\" EventOriginalUid:string \"] [1-1] [\" EventTime:datetime \"] [\" EventOriginalType:string \"] [\" EventOriginalSeverity:string \"]\" * \"[User \" ActorUsername:string \"@\" SrcIpAddr:string \" logged in as \" HttpUserAgent:string \"]\" *;\n };\n let LogoutEvents = (T: (Message: string), TableType: string) {\n T\n | where Message has \"UserLogoutSessionEvent\"\n | extend Type = TableType\n | parse Message with * \"Event [\" EventOriginalUid: string \"] [1-1] [\" EventTime: datetime \"] [\" EventOriginalType: string \"] [\" EventOriginalSeverity:string \"]\" * \"[User \" ActorUsername:string \"@\" SrcIpAddr \" logged out (login time:\" LoginTime: string \", number of API invocations: \" APIInvocationCount: string \", user agent:\" HttpUserAgent: string \")]\" *;\n };\n let vCenterLogs = vcenter_CL\n | where not(disabled)\n and (isnull(starttime) or TimeGenerated >= starttime) \n and (isnull(endtime) or TimeGenerated <= endtime)\n and ((array_length(username_has_any) == 0) or Message has_any (username_has_any))\n and (array_length(targetappname_has_any) == 0) // TargetAppName not available in source\n and (array_length(srchostname_has_any) == 0) // SrcHostName not availabine in source\n and (array_length(eventresultdetails_in) == 0) // EventResultDetails not available in source\n and (eventresult == \"*\" or (eventresult == \"Success\")); \n let AzureVCenterLogs = AVSVcSyslog\n | where not(disabled)\n and (isnull(starttime) or TimeGenerated >= starttime) \n and (isnull(endtime) or TimeGenerated <= endtime)\n and ((array_length(username_has_any) == 0) or Message has_any (username_has_any))\n and (array_length(targetappname_has_any) == 0) // TargetAppName not available in source\n and (array_length(srchostname_has_any) == 0) // SrcHostName not availabine in source\n and (array_length(eventresultdetails_in) == 0) // EventResultDetails not available in source\n and (eventresult == \"*\" or (eventresult == \"Success\"));\n union\n LoginEvents(vCenterLogs, \"vcenter_CL\"),\n LogoutEvents(vCenterLogs, \"vcenter_CL\"),\n LoginEvents(AzureVCenterLogs, \"AVSVcSyslog\"),\n LogoutEvents(AzureVCenterLogs, \"AVSVcSyslog\")\n | where ((array_length(srcipaddr_has_any_prefix) == 0) or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix))\n | extend\n EventVendor = \"VMware\",\n EventProduct = \"vCenter\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n Type = \"vcenter_CL\",\n EventStartTime = EventTime,\n EventEndTime = EventTime,\n EventCount = coalesce(toint(APIInvocationCount), int(1)),\n ActorUsernameType = \"Simple\",\n EventResult = \"Success\"\n | lookup EventTypeLookup on EventOriginalType\n | where (array_length(eventtype_in) == 0) or EventType in~ (eventtype_in)\n | lookup EventSeverityLookup on EventOriginalSeverity\n | project-rename\n EventOriginalResultDetails = Message\n | extend\n AdditionalFields = iff(pack, bag_pack(\"LoginTime\", LoginTime), dynamic([])),\n IpAddr = SrcIpAddr,\n Dvc = EventProduct\n | project\n TimeGenerated,\n Type,\n EventVendor,\n EventProduct,\n EventSchema,\n EventSchemaVersion,\n EventStartTime,\n EventEndTime,\n EventCount,\n ActorUsernameType,\n EventResult,\n EventOriginalType,\n EventType,\n EventOriginalSeverity,\n EventOriginalResultDetails,\n EventOriginalUid,\n ActorUsername,\n SrcIpAddr,\n HttpUserAgent,\n AdditionalFields,\n IpAddr,\n Dvc;\n};\nparser(\n starttime=starttime,\n endtime=endtime,\n username_has_any=username_has_any,\n targetappname_has_any=targetappname_has_any,\n srcipaddr_has_any_prefix=srcipaddr_has_any_prefix,\n srchostname_has_any=srchostname_has_any,\n eventtype_in=eventtype_in,\n eventresultdetails_in=eventresultdetails_in,\n eventresult=eventresult,\n disabled=disabled,\n pack=pack\n)\n",
30+
"query": "let parser = (starttime: datetime=datetime(null), \n endtime: datetime=datetime(null), \n username_has_any: dynamic = dynamic([]),\n targetappname_has_any: dynamic = dynamic([]),\n srcipaddr_has_any_prefix: dynamic = dynamic([]),\n srchostname_has_any: dynamic = dynamic([]),\n eventtype_in: dynamic = dynamic([]),\n eventresultdetails_in: dynamic = dynamic([]),\n eventresult: string = '*',\n disabled: bool=false,\n pack:bool = false) {\n let EventSeverityLookup = datatable (EventOriginalSeverity: string, EventSeverity: string) [\n \"info\", \"Informational\"\n ];\n let EventTypeLookup = datatable (EventOriginalType: string, EventType: string) [\n \"vim.event.UserLoginSessionEvent\", \"Logon\",\n \"vim.event.UserLogoutSessionEvent\", \"LogOff\"\n ];\n let LoginEvents = (T: (Message: string), TableType: string) {\n T\n | where Message has \"UserLoginSessionEvent\"\n | extend Type = TableType\n | parse Message with PreEventString \"Event [\" EventOriginalUid:string \"] [1-1] [\" EventTime:datetime \"] [\" EventOriginalType:string \"] [\" EventOriginalSeverity:string \"]\" * \"[User \" TargetUsername:string \"@\" SrcIpAddr:string \" logged in as \" HttpUserAgent:string \"]\" *\n | extend DvcId = split(PreEventString, \" \")[3];\n };\n let LogoutEvents = (T: (Message: string), TableType: string) {\n T\n | where Message has \"UserLogoutSessionEvent\"\n | extend Type = TableType\n | parse Message with PreEventString \"Event [\" EventOriginalUid: string \"] [1-1] [\" EventTime: datetime \"] [\" EventOriginalType: string \"] [\" EventOriginalSeverity:string \"]\" * \"[User \" TargetUsername:string \"@\" SrcIpAddr \" logged out (login time:\" LoginTime: string \", number of API invocations: \" APIInvocationCount: string \", user agent:\" HttpUserAgent: string \")]\" *\n | extend DvcId = split(PreEventString, \" \")[3];\n };\n let vCenterLogs = vcenter_CL\n | where not(disabled)\n and (isnull(starttime) or TimeGenerated >= starttime) \n and (isnull(endtime) or TimeGenerated <= endtime)\n and ((array_length(username_has_any) == 0) or Message has_any (username_has_any))\n and (array_length(targetappname_has_any) == 0) // TargetAppName not available in source\n and (array_length(srchostname_has_any) == 0) // SrcHostName not availabine in source\n and (array_length(eventresultdetails_in) == 0) // EventResultDetails not available in source\n and (eventresult == \"*\" or (eventresult == \"Success\")); \n let AzureVCenterLogs = AVSVcSyslog\n | where not(disabled)\n and (isnull(starttime) or TimeGenerated >= starttime) \n and (isnull(endtime) or TimeGenerated <= endtime)\n and ((array_length(username_has_any) == 0) or Message has_any (username_has_any))\n and (array_length(targetappname_has_any) == 0) // TargetAppName not available in source\n and (array_length(srchostname_has_any) == 0) // SrcHostName not availabine in source\n and (array_length(eventresultdetails_in) == 0) // EventResultDetails not available in source\n and (eventresult == \"*\" or (eventresult == \"Success\"));\n union\n LoginEvents(vCenterLogs, \"vcenter_CL\"),\n LogoutEvents(vCenterLogs, \"vcenter_CL\"),\n LoginEvents(AzureVCenterLogs, \"AVSVcSyslog\"),\n LogoutEvents(AzureVCenterLogs, \"AVSVcSyslog\")\n | where ((array_length(srcipaddr_has_any_prefix) == 0) or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix))\n | where ((array_length(username_has_any) == 0) or TargetUsername has_any (username_has_any))\n | extend\n EventVendor = \"VMware\",\n EventProduct = \"vCenter\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n Type = \"vcenter_CL\",\n EventStartTime = EventTime,\n EventEndTime = EventTime,\n EventCount = coalesce(toint(APIInvocationCount), int(1)),\n TargetUsernameType = \"Simple\",\n EventResult = \"Success\"\n | lookup EventTypeLookup on EventOriginalType\n | where (array_length(eventtype_in) == 0) or EventType in~ (eventtype_in)\n | lookup EventSeverityLookup on EventOriginalSeverity\n | project-rename\n EventOriginalResultDetails = Message\n | extend\n AdditionalFields = iff(pack, bag_pack(\"LoginTime\", LoginTime), dynamic([])),\n IpAddr = SrcIpAddr,\n User = TargetUsername,\n Dvc = DvcId\n | project\n TimeGenerated,\n Type,\n EventVendor,\n EventProduct,\n EventSchema,\n EventSchemaVersion,\n EventStartTime,\n EventEndTime,\n EventCount,\n TargetUsernameType,\n EventResult,\n EventOriginalType,\n EventType,\n EventSeverity,\n EventOriginalSeverity,\n EventOriginalResultDetails,\n EventOriginalUid,\n TargetUsername,\n SrcIpAddr,\n HttpUserAgent,\n AdditionalFields,\n IpAddr,\n Dvc,\n DvcId,\n User;\n};\nparser(\n starttime=starttime,\n endtime=endtime,\n username_has_any=username_has_any,\n targetappname_has_any=targetappname_has_any,\n srcipaddr_has_any_prefix=srcipaddr_has_any_prefix,\n srchostname_has_any=srchostname_has_any,\n eventtype_in=eventtype_in,\n eventresultdetails_in=eventresultdetails_in,\n eventresult=eventresult,\n disabled=disabled,\n pack=pack\n)\n",
3131
"version": 1,
3232
"functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),username_has_any:dynamic=dynamic([]),targetappname_has_any:dynamic=dynamic([]),srcipaddr_has_any_prefix:dynamic=dynamic([]),srchostname_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresultdetails_in:dynamic=dynamic([]),eventresult:string='*',disabled:bool=False,pack:bool=False"
3333
}

Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationVMwareVCenter.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
# Changelog for ASimAuthenticationVMwareVCenter.yaml
22

3+
## Version 0.1.1
4+
5+
- (2026-04-14) Add missing column EventSeverity - [PR #14075](https://github.com/Azure/Azure-Sentinel/pull/14075)
6+
- Rename ActorUsername to TargetUsername
7+
- Add alias User, which maps to TargetUsername
8+
- Extract DvcId from Message
9+
- Add alias Dvc, which maps to DvcId
10+
311
## Version 0.1.0
412

513
- (2026-04-07) Create parser for VMware VCenter. Logs can come from on-premise VMs or Azure VMware instances. - [PR #13929](https://github.com/Azure/Azure-Sentinel/pull/13929)

Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationVMwareVCenter.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,14 @@
11
# Changelog for vimAuthenticationVMwareVCenter.yaml
22

3+
## Version 0.1.1
4+
5+
- (2026-04-14) Add missing column EventSeverity - [PR #14075](https://github.com/Azure/Azure-Sentinel/pull/14075)
6+
- Rename ActorUsername to TargetUsername
7+
- Add alias User, which maps to TargetUsername
8+
- Add post-filtering of TargetUsername
9+
- Extract DvcId from Message
10+
- Add alias Dvc, which maps to DvcId
11+
312
## Version 0.1.0
413

514
- (2026-04-07) Create parser for VMware VCenter. Logs can come from on-premise VMs or Azure VMware instances. - [PR #13929](https://github.com/Azure/Azure-Sentinel/pull/13929)

0 commit comments

Comments
 (0)