+ "query": "let PaloXDRParser = (\n disabled: bool=false,\n pack: bool=false\n)\n{\n PaloAltoCortexXDR_Alerts_CL\n | where not(disabled)\n | where Source startswith 'XDR Analytics' //filter out custom IOCs\n | where AgentOSType != 'NO_HOST' //filter out firewall detections\n | project-rename\n EventUid = _ItemId,\n EventOriginalUid = ExternalId,\n EventProductVersion = AgentVersion,\n AlertName = Name,\n AlertDescription = Description,\n ThreatId = MatchingServiceRuleId,\n ThreatFirstReportedTime = DetectionTimestamp,\n ThreatLastReportedTime = LocalInsert,\n Username = UserName,\n DvcIpAddr = HostIp,\n DvcHostname = HostName,\n EventOriginalSeverity = Severity,\n DvcId = EndpointId,\n DvcOs = AgentOSType,\n DvcAction = ActionPretty,\n DvcOriginalAction = Action\n | mv-apply i = split(DvcIpAddr, ',') to typeof(string) on (\n extend InternalIP = (ipv4_is_private(i))\n | extend\n DvcIpAddr = iff(InternalIP == true, i, ''),\n ExternalIpAddr = iff(InternalIP == false, i, '')\n | summarize DvcIpAddr = take_anyif(DvcIpAddr, isnotempty(DvcIpAddr)), ExternalIpAddr = take_anyif(ExternalIpAddr, isnotempty(ExternalIpAddr)), AllImpactedIpAddr = make_set_if(DvcIpAddr, isnotempty(DvcIpAddr)) by EventOriginalUid\n )\n | extend\n AlertId = EventOriginalUid,\n DetectionMethod = 'EDR',\n ThreatCategory = case(\n EventType == 'Process Execution' and AlertName has 'user', 'Security Policy Violation',\n EventType == 'Network Connections' and AlertName has 'Domain', 'MaliciousUrl',\n 'Unknown'\n ),\n ThreatIsActive = (DvcAction !startswith 'Prevented'),\n AttackTactics = replace_regex(tostring(MitreTacticIdAndName), @'(TA\\d{4})\\s+-\\s+([\\w\\s]+)', @'\\2 (\\1)'),\n AttackTechniques = replace_regex(tostring(MitreTechniqueIdAndName), @'(T[\\d\\.]+)\\s+-\\s+([\\w\\s-:]+)', @'\\2 (\\1)'),\n User = tostring(split(Username, @'\\')[1]),\n UserType = case(\n Username has 'SYSTEM', 'System',\n Username has_any ('LOCAL SERVICE', 'NETWORK SERVICE'), 'Service',\n isempty(Username), '',\n 'Regular'\n ),\n UsernameType = case(\n Username has @'\\', 'Windows',\n Username has '@', 'UPN',\n 'Simple'\n ),\n Url = coalesce(tostring(MaliciousUrls), DstActionExternalHostname),\n DvcIdType = iff(isnotempty(DvcId), 'Other', '')\n | project-away\n MitreTacticIdAndName,\n MitreTechniqueIdAndName\n | project-rename\n ThreatOriginalCategory = EventType\n | extend\n ProcessId = tostring(coalesce(OsActorProcessOsPid, ActorProcessOsPid)),\n ProcessCommandLine = coalesce(ActionProcessImageCommandLine, ActorProcessCommandLine, CausalityActorProcessCommandLine),\n ProcessName = coalesce(ActionProcessImageName, ActorProcessImageName, CausalityActorProcessImageName),\n ProcessFileCompany = coalesce(ActionProcessSignatureVendor, ActorProcessSignatureVendor),\n FileName = coalesce(OsActorProcessImageName, ActionProcessImageName, ActorProcessImageName, CausalityActorProcessImageName),\n FilePath = coalesce(OsActorProcessImagePath, ActorProcessImagePath, CausalityActorProcessImagePath),\n FileSHA256 = coalesce(OsActorProcessImageSha256, ActorProcessImageSha256, CausalityActorProcessImageSha256),\n FileMD5 = coalesce(ActorProcessImageMd5, CausalityActorProcessImageMd5)\n | extend //Common Fields\n EventCount = toint(1),\n EventStartTime = ThreatFirstReportedTime,\n EventEndTime = ThreatLastReportedTime,\n EventType = 'Alert',\n EventSubType = 'Threat',\n EventMessage = AlertDescription,\n IpAddr = DvcIpAddr,\n Hostname = DvcHostname,\n Dvc = DvcHostname,\n EventSchema = 'AlertEvent',\n EventSchemaVersion = '0.1',\n EventSeverity = case(\n EventOriginalSeverity == 'high', 'High',\n EventOriginalSeverity == 'medium', 'Medium',\n EventOriginalSeverity == 'low', 'Low',\n 'Informational'\n ),\n EventProduct = 'Cortex XDR',\n EventVendor = 'Palo Alto'\n | extend AdditionalFields = iff (\n pack,\n bag_pack(\n 'MatchingStatus', MatchingStatus,\n 'AttemptCounter', AttemptCounter,\n 'Whitelisted', Whitelisted,\n 'Starred', Starred,\n 'Category', Category,\n 'CausalityActorCausalityId', CausalityActorCausalityId,\n 'ActorProcessSignatureStatus', ActorProcessSignatureStatus,\n 'CausalityActorProcessCommandLine', CausalityActorProcessCommandLine,\n 'CausalityActorProcessImageName', CausalityActorProcessImageName,\n 'CausalityActorProcessImagePath', CausalityActorProcessImagePath,\n 'CausalityActorProcessSignatureStatus', CausalityActorProcessSignatureStatus,\n 'ActionCountry', ActionCountry,\n 'ActorProcessImageName', ActorProcessImageName,\n 'ActorProcessCommandLine', ActorProcessCommandLine,\n 'ActionLocalIp', ActionLocalIp,\n 'ActionRemoteIp', ActionRemoteIp,\n 'ActionLocalPort', ActionLocalPort,\n 'ActionRemotePort', ActionRemotePort,\n 'OsActorProcessCommandLine', OsActorProcessCommandLine,\n 'OsActorProcessImageName', OsActorProcessImageName,\n 'OsActorProcessImagePath', OsActorProcessImagePath,\n 'ProcessInstanceId', tostring(coalesce(ActorProcessInstanceId, ActorProcessCausalityId, ActorCausalityId, OsActorProcessCausalityId)),\n 'IdentityType', tostring(coalesce(IdentityType, \"\")),\n 'FwEmailRecipient', tostring(coalesce(FwEmailRecipient, \"\")),\n 'FwEmailSender', tostring(coalesce(FwEmailSender, \"\")),\n 'FwEmailSubject', tostring(coalesce(FwEmailSubject, \"\")),\n 'DnsQueryName', tostring(coalesce(DnsQueryName, \"\")),\n 'ExternalIpAddr', tostring(coalesce(columnifexists(\"ExternalIpAddr\", \"\"), \"\")),\n 'AllImpactedIpAddr', tostring(coalesce(columnifexists(\"AllImpactedIpAddr\", \"\"), \"\"))\n ),\n dynamic([])\n )\n | project\n TimeGenerated,\n Type,\n EventUid,\n EventOriginalUid,\n EventProductVersion,\n AlertName,\n AlertDescription,\n ThreatId,\n ThreatFirstReportedTime,\n ThreatLastReportedTime,\n Username,\n UsernameType,\n DvcIpAddr,\n DvcHostname,\n EventOriginalSeverity,\n DvcId,\n DvcIdType,\n DvcOs,\n DvcAction,\n DvcOriginalAction,\n Url,\n AlertId,\n DetectionMethod,\n ThreatCategory,\n ThreatIsActive,\n AttackTactics,\n AttackTechniques,\n User,\n ThreatOriginalCategory,\n UserType,\n ProcessId,\n ProcessCommandLine,\n ProcessName,\n ProcessFileCompany,\n FileName,\n FilePath,\n FileSHA256,\n FileMD5,\n EventCount,\n EventStartTime,\n EventEndTime,\n EventType,\n EventSubType,\n EventMessage,\n IpAddr,\n Hostname,\n Dvc,\n EventSchema,\n EventSchemaVersion,\n EventSeverity,\n EventProduct,\n EventVendor,\n AdditionalFields\n};\nPaloXDRParser(\n disabled = disabled,\n pack = pack\n)",
0 commit comments