Skip to content

Commit 6d20f5a

Browse files
yummyblablaDerrick Lee
yummyblabla
and
Derrick Lee
authored
[ASIM] Fixes to Cisco IOS Authentication parser (#14077)
* Cisco IOS fixes * Changelog update * Fix kql * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * More changes applied * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. --------- Co-authored-by: Derrick Lee <derricklee@microsoft.com> Co-authored-by: github-actions[bot] <>
1 parent d51c917 commit 6d20f5a

6 files changed

Lines changed: 32 additions & 16 deletions

File tree

‎Parsers/ASimAuthentication/ARM/ASimAuthenticationCiscoIOS/ASimAuthenticationCiscoIOS.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
"displayName": "Authentication ASIM parser for Cisco IOS Syslog Message",
2828
"category": "ASIM",
2929
"FunctionAlias": "ASimAuthenticationCiscoIOS",
30-
"query": "let parser = (disabled: bool = false) {\n let EventResultDetailsLookup = datatable(EventOriginalResultDetails: string, EventResultDetails: string)\n [\n \"Login Authentication Failed - BadUser\", \"No such user or password\",\n \"Login Authentication Failed\", \"Incorrect password\"\n ];\n let LoginSuccessIOS = (T: (SyslogMessage: string)) {\n T\n | where SyslogMessage has \"%SEC_LOGIN-5-LOGIN_SUCCESS\"\n | parse SyslogMessage with * \"%SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user:\" TargetUsername: string \"] [Source:\" SrcIpAddr: string \"] [localport: \" SrcPortNumber: string \"]\" *\n | extend EventType = \"Logon\", EventResult = \"Success\"\n };\n let LoginFailureIOS = (T: (SyslogMessage: string)) {\n T\n | where SyslogMessage has \"%SEC_LOGIN-4-LOGIN_FAILED\"\n | parse SyslogMessage with * \"%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user:\" TargetUsername: string \"] [Source:\" SrcIpAddr: string \"] [localport: \" SrcPortNumber: string \"] [Reason: \" EventOriginalResultDetails: string \"]\" *\n | extend EventType = \"Logon\", EventResult = \"Failure\"\n };\n let LogoutIOS = (T: (SyslogMessage: string)) {\n T\n | where SyslogMessage has \"%SYS-6-LOGOUT\"\n | parse SyslogMessage with * \"%SYS-6-LOGOUT: User \" TargetUsername: string \" \" * \"(\" SrcIpAddr: string \")\"\n | extend EventType = \"Logoff\", EventResult = \"Success\"\n };\n let SyslogLogs = Syslog\n | where not(disabled);\n union\n LoginSuccessIOS(SyslogLogs),\n LoginFailureIOS(SyslogLogs),\n LogoutIOS(SyslogLogs)\n | extend\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n EventVendor = \"Cisco\",\n EventProduct = \"IOS\",\n EventCount = int(1),\n EventStartTime = EventTime,\n EventEndTime = EventTime,\n Type = \"Syslog\"\n | project-rename\n DvcIpAddr = HostIP,\n TargetHostname = HostName,\n EventOriginalSeverity = SeverityLevel,\n EventMessage = SyslogMessage\n | lookup EventResultDetailsLookup on EventOriginalResultDetails\n | extend\n EventSeverity = _ASIM_LookupSyslogSeverityLevel(EventOriginalSeverity),\n SrcPortNumber = toint(SrcPortNumber),\n TargetUsernameType = iff(isnotempty(TargetUsername), \"Simple\", \"\")\n | extend\n Dvc = DvcIpAddr,\n Src = SrcIpAddr,\n IpAddr = SrcIpAddr\n | project\n TimeGenerated,\n Type,\n EventType,\n EventResult,\n EventSchema,\n EventSchemaVersion,\n EventVendor,\n EventProduct,\n EventCount,\n EventStartTime,\n EventEndTime,\n DvcIpAddr,\n TargetHostname,\n EventOriginalSeverity,\n EventSeverity,\n EventOriginalResultDetails,\n EventResultDetails,\n TargetUsername,\n TargetUsernameType,\n SrcIpAddr,\n SrcPortNumber,\n Dvc,\n Src,\n IpAddr\n};\nparser(disabled=disabled)",
30+
"query": "let parser = (disabled: bool = false) {\n let EventResultDetailsLookup = datatable(EventOriginalResultDetails: string, EventResultDetails: string)\n [\n \"Login Authentication Failed - BadUser\", \"No such user or password\",\n \"Login Authentication Failed\", \"Incorrect password\"\n ];\n let LoginSuccessIOS = (T: (SyslogMessage: string)) {\n T\n | where SyslogMessage has \"%SEC_LOGIN-5-LOGIN_SUCCESS\"\n | parse SyslogMessage with * \"%SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user:\" TargetUsername: string \"] [Source:\" SrcIpAddr: string \"] [localport: \" SrcPortNumber: string \"]\" *\n | extend EventType = \"Logon\", EventResult = \"Success\"\n };\n let LoginFailureIOS = (T: (SyslogMessage: string)) {\n T\n | where SyslogMessage has \"%SEC_LOGIN-4-LOGIN_FAILED\"\n | parse SyslogMessage with * \"%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user:\" TargetUsername: string \"] [Source:\" SrcIpAddr: string \"] [localport: \" SrcPortNumber: string \"] [Reason: \" EventOriginalResultDetails: string \"]\" *\n | extend EventType = \"Logon\", EventResult = \"Failure\"\n };\n let LogoutIOS = (T: (SyslogMessage: string)) {\n T\n | where SyslogMessage has \"%SYS-6-LOGOUT\"\n | parse SyslogMessage with * \"%SYS-6-LOGOUT: User \" TargetUsername: string \" \" * \"(\" SrcIpAddr: string \")\"\n | extend EventType = \"Logoff\", EventResult = \"Success\"\n };\n let SyslogLogs = Syslog\n | where not(disabled);\n union\n LoginSuccessIOS(SyslogLogs),\n LoginFailureIOS(SyslogLogs),\n LogoutIOS(SyslogLogs)\n | extend\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n EventVendor = \"Cisco\",\n EventProduct = \"IOS\",\n EventCount = int(1),\n EventStartTime = EventTime,\n EventEndTime = EventTime,\n Type = \"Syslog\"\n | project-rename\n DvcIpAddr = HostIP,\n EventOriginalSeverity = SeverityLevel,\n EventMessage = SyslogMessage\n | lookup EventResultDetailsLookup on EventOriginalResultDetails\n | extend\n EventSeverity = _ASIM_LookupSyslogSeverityLevel(EventOriginalSeverity),\n SrcPortNumber = toint(SrcPortNumber),\n TargetUsernameType = iff(isnotempty(TargetUsername), \"Simple\", \"\"),\n TargetIpAddr = iff(ipv4_is_in_range(HostName, \"0.0.0.0/0\"), HostName, \"\")\n | extend\n Dvc = DvcIpAddr,\n Src = SrcIpAddr,\n IpAddr = SrcIpAddr,\n User = TargetUsername\n | project\n TimeGenerated,\n Type,\n EventType,\n EventResult,\n EventSchema,\n EventSchemaVersion,\n EventVendor,\n EventProduct,\n EventCount,\n EventStartTime,\n EventEndTime,\n DvcIpAddr,\n EventOriginalSeverity,\n EventSeverity,\n EventOriginalResultDetails,\n EventResultDetails,\n TargetUsername,\n TargetUsernameType,\n SrcIpAddr,\n SrcPortNumber,\n TargetIpAddr,\n Dvc,\n Src,\n IpAddr,\n User\n};\nparser(disabled=disabled)",
3131
"version": 1,
3232
"functionParameters": "disabled:bool=False"
3333
}

‎Parsers/ASimAuthentication/ARM/vimAuthenticationCiscoIOS/vimAuthenticationCiscoIOS.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
"displayName": "Authentication ASIM filtering parser for Cisco IOS Syslog Message",
2828
"category": "ASIM",
2929
"FunctionAlias": "vimAuthenticationCiscoIOS",
30-
"query": "let parser = (starttime: datetime=datetime(null), \n endtime: datetime=datetime(null), \n username_has_any: dynamic = dynamic([]),\n targetappname_has_any: dynamic = dynamic([]),\n srcipaddr_has_any_prefix: dynamic = dynamic([]),\n srchostname_has_any: dynamic = dynamic([]),\n eventtype_in: dynamic = dynamic([]),\n eventresultdetails_in: dynamic = dynamic([]),\n eventresult: string = '*',\n disabled: bool = false) {\n let EventResultDetailsLookup = datatable(EventOriginalResultDetails: string, EventResultDetails: string)\n [\n \"Login Authentication Failed - BadUser\", \"No such user or password\",\n \"Login Authentication Failed\", \"Incorrect password\"\n ];\n let LoginSuccessIOS = (T: (SyslogMessage: string)) {\n T\n | where SyslogMessage has \"%SEC_LOGIN-5-LOGIN_SUCCESS\"\n | parse SyslogMessage with * \"%SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user:\" TargetUsername: string \"] [Source:\" SrcIpAddr: string \"] [localport: \" SrcPortNumber: string \"]\" *\n | extend EventType = \"Logon\", EventResult = \"Success\"\n };\n let LoginFailureIOS = (T: (SyslogMessage: string)) {\n T\n | where SyslogMessage has \"%SEC_LOGIN-4-LOGIN_FAILED\"\n | parse SyslogMessage with * \"%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user:\" TargetUsername: string \"] [Source:\" SrcIpAddr: string \"] [localport: \" SrcPortNumber: string \"] [Reason: \" EventOriginalResultDetails: string \"]\" *\n | extend EventType = \"Logon\", EventResult = \"Failure\"\n };\n let LogoutIOS = (T: (SyslogMessage: string)) {\n T\n | where SyslogMessage has \"%SYS-6-LOGOUT\"\n | parse SyslogMessage with * \"%SYS-6-LOGOUT: User \" TargetUsername: string \" \" * \"(\" SrcIpAddr: string \")\"\n | extend EventType = \"Logoff\", EventResult = \"Success\"\n };\n let SyslogLogs = Syslog\n | where not(disabled);\n union\n LoginSuccessIOS(SyslogLogs),\n LoginFailureIOS(SyslogLogs),\n LogoutIOS(SyslogLogs)\n | extend\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n EventVendor = \"Cisco\",\n EventProduct = \"IOS\",\n EventCount = int(1),\n EventStartTime = EventTime,\n EventEndTime = EventTime,\n Type = \"Syslog\"\n | project-rename\n DvcIpAddr = HostIP,\n TargetHostname = HostName,\n EventOriginalSeverity = SeverityLevel,\n EventMessage = SyslogMessage\n | lookup EventResultDetailsLookup on EventOriginalResultDetails\n | extend\n EventSeverity = _ASIM_LookupSyslogSeverityLevel(EventOriginalSeverity),\n SrcPortNumber = toint(SrcPortNumber),\n TargetUsernameType = iff(isnotempty(TargetUsername), \"Simple\", \"\")\n | extend\n Dvc = DvcIpAddr,\n Src = SrcIpAddr,\n IpAddr = SrcIpAddr\n | project\n TimeGenerated,\n Type,\n EventType,\n EventResult,\n EventSchema,\n EventSchemaVersion,\n EventVendor,\n EventProduct,\n EventCount,\n EventStartTime,\n EventEndTime,\n DvcIpAddr,\n TargetHostname,\n EventOriginalSeverity,\n EventSeverity,\n EventOriginalResultDetails,\n EventResultDetails,\n TargetUsername,\n TargetUsernameType,\n SrcIpAddr,\n SrcPortNumber,\n Dvc,\n Src,\n IpAddr\n};\nparser(starttime=starttime,\n endtime=endtime,\n username_has_any=username_has_any,\n targetappname_has_any=targetappname_has_any,\n srcipaddr_has_any_prefix=srcipaddr_has_any_prefix,\n srchostname_has_any=srchostname_has_any,\n eventtype_in=eventtype_in,\n eventresultdetails_in=eventresultdetails_in,\n eventresult=eventresult,\n disabled=disabled)",
30+
"query": "let parser = (starttime: datetime=datetime(null), \n endtime: datetime=datetime(null), \n username_has_any: dynamic = dynamic([]),\n targetappname_has_any: dynamic = dynamic([]),\n srcipaddr_has_any_prefix: dynamic = dynamic([]),\n srchostname_has_any: dynamic = dynamic([]),\n eventtype_in: dynamic = dynamic([]),\n eventresultdetails_in: dynamic = dynamic([]),\n eventresult: string = '*',\n disabled: bool = false) {\n let EventResultDetailsLookup = datatable(EventOriginalResultDetails: string, EventResultDetails: string)\n [\n \"Login Authentication Failed - BadUser\", \"No such user or password\",\n \"Login Authentication Failed\", \"Incorrect password\"\n ];\n let LoginSuccessIOS = (T: (SyslogMessage: string)) {\n T\n | where SyslogMessage has \"%SEC_LOGIN-5-LOGIN_SUCCESS\"\n | parse SyslogMessage with * \"%SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user:\" TargetUsername: string \"] [Source:\" SrcIpAddr: string \"] [localport: \" SrcPortNumber: string \"]\" *\n | extend EventType = \"Logon\", EventResult = \"Success\"\n };\n let LoginFailureIOS = (T: (SyslogMessage: string)) {\n T\n | where SyslogMessage has \"%SEC_LOGIN-4-LOGIN_FAILED\"\n | parse SyslogMessage with * \"%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user:\" TargetUsername: string \"] [Source:\" SrcIpAddr: string \"] [localport: \" SrcPortNumber: string \"] [Reason: \" EventOriginalResultDetails: string \"]\" *\n | extend EventType = \"Logon\", EventResult = \"Failure\"\n };\n let LogoutIOS = (T: (SyslogMessage: string)) {\n T\n | where SyslogMessage has \"%SYS-6-LOGOUT\"\n | parse SyslogMessage with * \"%SYS-6-LOGOUT: User \" TargetUsername: string \" \" * \"(\" SrcIpAddr: string \")\"\n | extend EventType = \"Logoff\", EventResult = \"Success\"\n };\n let SyslogLogs = Syslog\n | where not(disabled);\n union\n LoginSuccessIOS(SyslogLogs),\n LoginFailureIOS(SyslogLogs),\n LogoutIOS(SyslogLogs)\n | extend\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n EventVendor = \"Cisco\",\n EventProduct = \"IOS\",\n EventCount = int(1),\n EventStartTime = EventTime,\n EventEndTime = EventTime,\n Type = \"Syslog\"\n | project-rename\n DvcIpAddr = HostIP,\n EventOriginalSeverity = SeverityLevel,\n EventMessage = SyslogMessage\n | lookup EventResultDetailsLookup on EventOriginalResultDetails\n | extend\n EventSeverity = _ASIM_LookupSyslogSeverityLevel(EventOriginalSeverity),\n SrcPortNumber = toint(SrcPortNumber),\n TargetUsernameType = iff(isnotempty(TargetUsername), \"Simple\", \"\"),\n TargetIpAddr = iff(ipv4_is_in_range(HostName, \"0.0.0.0/0\"), HostName, \"\")\n | extend\n Dvc = DvcIpAddr,\n Src = SrcIpAddr,\n IpAddr = SrcIpAddr,\n User = TargetUsername\n | project\n TimeGenerated,\n Type,\n EventType,\n EventResult,\n EventSchema,\n EventSchemaVersion,\n EventVendor,\n EventProduct,\n EventCount,\n EventStartTime,\n EventEndTime,\n DvcIpAddr,\n EventOriginalSeverity,\n EventSeverity,\n EventOriginalResultDetails,\n EventResultDetails,\n TargetUsername,\n TargetUsernameType,\n SrcIpAddr,\n SrcPortNumber,\n TargetIpAddr,\n Dvc,\n Src,\n IpAddr,\n User\n};\nparser(starttime=starttime,\n endtime=endtime,\n username_has_any=username_has_any,\n targetappname_has_any=targetappname_has_any,\n srcipaddr_has_any_prefix=srcipaddr_has_any_prefix,\n srchostname_has_any=srchostname_has_any,\n eventtype_in=eventtype_in,\n eventresultdetails_in=eventresultdetails_in,\n eventresult=eventresult,\n disabled=disabled)",
3131
"version": 1,
3232
"functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),username_has_any:dynamic=dynamic([]),targetappname_has_any:dynamic=dynamic([]),srcipaddr_has_any_prefix:dynamic=dynamic([]),srchostname_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresultdetails_in:dynamic=dynamic([]),eventresult:string='*',disabled:bool=False"
3333
}

‎Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCiscoIOS.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Changelog for ASimAuthenticationCiscoIOS.yaml
22

3+
## Version 0.1.1
4+
5+
- (2026-04-14) Add mapping of HostName to TargetIpAddr if HostName is an IPv4 address - [PR #14077](https://github.com/Azure/Azure-Sentinel/pull/14077)
6+
- Add User alias
7+
- Remove TargetHostname mapping from HostName
8+
39
## Version 0.1.0
410

511
- (2026-04-06) Create parser for Cisco IOS logs from Syslog - [PR #13966](https://github.com/Azure/Azure-Sentinel/pull/13966)

‎Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCiscoIOS.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Changelog for vimAuthenticationCiscoIOS.yaml
22

3+
## Version 0.1.1
4+
5+
- (2026-04-14) Add mapping of HostName to TargetIpAddr if HostName is an IPv4 address - [PR #14077](https://github.com/Azure/Azure-Sentinel/pull/14077)
6+
- Add User alias
7+
- Remove TargetHostname mapping from HostName
8+
39
## Version 0.1.0
410

511
- (2026-04-06) Create parser for Cisco IOS logs from Syslog - [PR #13966](https://github.com/Azure/Azure-Sentinel/pull/13966)

‎Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoIOS.yaml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Parser:
22
Title: Authentication ASIM parser for Cisco IOS Syslog Message
3-
Version: '0.1.0'
4-
LastUpdated: Apr 01, 2026
3+
Version: '0.1.1'
4+
LastUpdated: Apr 14, 2026
55
Product:
66
Name: Cisco IOS
77
Normalization:
@@ -64,18 +64,19 @@ ParserQuery: |
6464
Type = "Syslog"
6565
| project-rename
6666
DvcIpAddr = HostIP,
67-
TargetHostname = HostName,
6867
EventOriginalSeverity = SeverityLevel,
6968
EventMessage = SyslogMessage
7069
| lookup EventResultDetailsLookup on EventOriginalResultDetails
7170
| extend
7271
EventSeverity = _ASIM_LookupSyslogSeverityLevel(EventOriginalSeverity),
7372
SrcPortNumber = toint(SrcPortNumber),
74-
TargetUsernameType = iff(isnotempty(TargetUsername), "Simple", "")
73+
TargetUsernameType = iff(isnotempty(TargetUsername), "Simple", ""),
74+
TargetIpAddr = iff(ipv4_is_in_range(HostName, "0.0.0.0/0"), HostName, "")
7575
| extend
7676
Dvc = DvcIpAddr,
7777
Src = SrcIpAddr,
78-
IpAddr = SrcIpAddr
78+
IpAddr = SrcIpAddr,
79+
User = TargetUsername
7980
| project
8081
TimeGenerated,
8182
Type,
@@ -89,7 +90,6 @@ ParserQuery: |
8990
EventStartTime,
9091
EventEndTime,
9192
DvcIpAddr,
92-
TargetHostname,
9393
EventOriginalSeverity,
9494
EventSeverity,
9595
EventOriginalResultDetails,
@@ -98,8 +98,10 @@ ParserQuery: |
9898
TargetUsernameType,
9999
SrcIpAddr,
100100
SrcPortNumber,
101+
TargetIpAddr,
101102
Dvc,
102103
Src,
103-
IpAddr
104+
IpAddr,
105+
User
104106
};
105107
parser(disabled=disabled)

‎Parsers/ASimAuthentication/Parsers/vimAuthenticationCiscoIOS.yaml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Parser:
22
Title: Authentication ASIM filtering parser for Cisco IOS Syslog Message
3-
Version: '0.1.0'
4-
LastUpdated: Apr 01, 2026
3+
Version: '0.1.1'
4+
LastUpdated: Apr 14, 2026
55
Product:
66
Name: Cisco IOS
77
Normalization:
@@ -100,18 +100,19 @@ ParserQuery: |
100100
Type = "Syslog"
101101
| project-rename
102102
DvcIpAddr = HostIP,
103-
TargetHostname = HostName,
104103
EventOriginalSeverity = SeverityLevel,
105104
EventMessage = SyslogMessage
106105
| lookup EventResultDetailsLookup on EventOriginalResultDetails
107106
| extend
108107
EventSeverity = _ASIM_LookupSyslogSeverityLevel(EventOriginalSeverity),
109108
SrcPortNumber = toint(SrcPortNumber),
110-
TargetUsernameType = iff(isnotempty(TargetUsername), "Simple", "")
109+
TargetUsernameType = iff(isnotempty(TargetUsername), "Simple", ""),
110+
TargetIpAddr = iff(ipv4_is_in_range(HostName, "0.0.0.0/0"), HostName, "")
111111
| extend
112112
Dvc = DvcIpAddr,
113113
Src = SrcIpAddr,
114-
IpAddr = SrcIpAddr
114+
IpAddr = SrcIpAddr,
115+
User = TargetUsername
115116
| project
116117
TimeGenerated,
117118
Type,
@@ -125,7 +126,6 @@ ParserQuery: |
125126
EventStartTime,
126127
EventEndTime,
127128
DvcIpAddr,
128-
TargetHostname,
129129
EventOriginalSeverity,
130130
EventSeverity,
131131
EventOriginalResultDetails,
@@ -134,9 +134,11 @@ ParserQuery: |
134134
TargetUsernameType,
135135
SrcIpAddr,
136136
SrcPortNumber,
137+
TargetIpAddr,
137138
Dvc,
138139
Src,
139-
IpAddr
140+
IpAddr,
141+
User
140142
};
141143
parser(starttime=starttime,
142144
endtime=endtime,

0 commit comments

Comments
 (0)