Skip to content

Commit d51c917

Browse files
yummyblablaDerrick Lee
yummyblabla
and
Derrick Lee
authored
[ASIM] Fixes to CIsco ISE parser Authentication parser (#14076)
* Fix to CIsco ISE parser * Update changelog * Update yaml versions * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * Additional changes * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. --------- Co-authored-by: Derrick Lee <derricklee@microsoft.com> Co-authored-by: github-actions[bot] <>
1 parent 2abc6fb commit d51c917

6 files changed

Lines changed: 41 additions & 19 deletions

File tree

‎Parsers/ASimAuthentication/ARM/ASimAuthenticationCiscoISEAdministrator/ASimAuthenticationCiscoISEAdministrator.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
"displayName": "Authentication ASIM parser for Cisco ISE Administrator events",
2828
"category": "ASIM",
2929
"FunctionAlias": "ASimAuthenticationCiscoISEAdministrator",
30-
"query": "let parser = (disabled: bool = false, pack: bool = false) {\nSyslog\n| where not(disabled) and ProcessName has \"CISE_Administrative_and_Operational_Audit\"\n| where SyslogMessage has \"Administrator-Login\"\n| extend\n EventVendor = \"Cisco\",\n EventProduct = \"ISE\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n EventCount = int(1),\n EventStartTime = TimeGenerated,\n EventEndTime = TimeGenerated,\n EventSeverity = \"Informational\",\n EventType = \"Logon\",\n Type = \"Syslog\"\n| project-rename\n SrcIpAddr = HostIP,\n SrcDvcId = HostName\n| extend\n SrcDvcIdType = \"Other\"\n| parse SyslogMessage with * \"Administrator-Login:\" * \", \" KeyValuePairs\n| parse-kv KeyValuePairs as (ConfigVersionId: string, AdminInterface: string, AdminIPAddress: string, OperationMessageText: string, Port: int, AcsInstance: string, AdminName: string) with (pair_delimiter=\",\", kv_delimiter=\"=\")\n| extend\n EventResult = iff(isnotempty(AdminName), \"Success\", \"Failure\"), // AdminName exists in Syslog if authentication was successful\n EventResultDetails = iff(isempty(AdminName), case(\n OperationMessageText has \"Failed password\", \"Incorrect password\",\n OperationMessageText has \"User unknown\", \"No such user\",\n \"Other\"\n ), \"\"),\n TargetUsername = coalesce(AdminName, \"\"),\n TargetUsernameType = iff(isnotempty(AdminName), \"Simple\", \"\")\n| project-rename\n TargetIpAddr = AdminIPAddress,\n EventOriginalResultDetails = OperationMessageText,\n TargetPortNumber = Port\n| extend AdditionalFields = iff(pack, bag_pack(\n \"AdminInterface\", AdminInterface,\n \"ConfigVersionId\", ConfigVersionId,\n \"AcsInstance\", AcsInstance,\n \"CollectorHostName\", CollectorHostName\n), dynamic([]))\n| extend\n IpAddr = SrcIpAddr,\n Dvc = SrcDvcId\n| project\n TimeGenerated,\n Type,\n EventVendor,\n EventProduct,\n EventCount,\n EventSchema,\n EventSchemaVersion,\n EventStartTime,\n EventEndTime,\n EventSeverity,\n EventType,\n SrcIpAddr,\n SrcDvcId,\n SrcDvcIdType,\n EventResult,\n EventResultDetails,\n TargetUsername,\n TargetUsernameType,\n TargetIpAddr,\n EventOriginalResultDetails,\n TargetPortNumber,\n AdditionalFields,\n IpAddr,\n Dvc\n};\nparser(disabled=disabled, pack=pack)",
30+
"query": "let parser = (disabled: bool = false, pack: bool = false) {\nSyslog\n| where not(disabled) and ProcessName has \"CISE_Administrative_and_Operational_Audit\"\n| where SyslogMessage has \"Administrator-Login\"\n| extend\n EventVendor = \"Cisco\",\n EventProduct = \"ISE\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n EventCount = int(1),\n EventStartTime = TimeGenerated,\n EventEndTime = TimeGenerated,\n EventType = \"Logon\",\n Type = \"Syslog\"\n| project-rename\n TargetIpAddr = HostIP,\n SrcDvcId = HostName\n| extend\n SrcDvcIdType = \"Other\"\n| parse SyslogMessage with * \"Administrator-Login:\" * \", \" KeyValuePairs\n| parse-kv KeyValuePairs as (ConfigVersionId: string, AdminInterface: string, AdminIPAddress: string, OperationMessageText: string, Port: int, AcsInstance: string, AdminName: string) with (pair_delimiter=\",\", kv_delimiter=\"=\")\n| extend\n EventResult = iff(isnotempty(AdminName), \"Success\", \"Failure\"), // AdminName exists in Syslog if authentication was successful\n EventResultDetails = iff(isempty(AdminName), case(\n OperationMessageText has \"Failed password\", \"Incorrect password\",\n OperationMessageText has \"User unknown\", \"No such user\",\n \"Other\"\n ), \"\"),\n TargetUsername = coalesce(AdminName, \"\"),\n TargetUsernameType = iff(isnotempty(AdminName), \"Simple\", \"\")\n| project-rename\n SrcIpAddr = AdminIPAddress,\n EventOriginalResultDetails = OperationMessageText,\n TargetPortNumber = Port,\n EventOriginalSeverity = SeverityLevel\n| extend EventSeverity = _ASIM_LookupSyslogSeverityLevel(EventOriginalSeverity)\n| extend AdditionalFields = iff(pack, bag_pack(\n \"AdminInterface\", AdminInterface,\n \"ConfigVersionId\", ConfigVersionId,\n \"AcsInstance\", AcsInstance,\n \"CollectorHostName\", CollectorHostName\n), dynamic([]))\n| extend\n IpAddr = SrcIpAddr,\n Dvc = SrcDvcId,\n User = TargetUsername\n| project\n TimeGenerated,\n Type,\n EventVendor,\n EventProduct,\n EventCount,\n EventSchema,\n EventSchemaVersion,\n EventStartTime,\n EventEndTime,\n EventSeverity,\n EventOriginalSeverity,\n EventType,\n SrcIpAddr,\n SrcDvcId,\n SrcDvcIdType,\n EventResult,\n EventResultDetails,\n TargetUsername,\n TargetUsernameType,\n TargetIpAddr,\n EventOriginalResultDetails,\n TargetPortNumber,\n AdditionalFields,\n IpAddr,\n Dvc,\n User\n};\nparser(disabled=disabled, pack=pack)",
3131
"version": 1,
3232
"functionParameters": "disabled:bool=False,pack:bool=False"
3333
}

‎Parsers/ASimAuthentication/ARM/vimAuthenticationCiscoISEAdministrator/vimAuthenticationCiscoISEAdministrator.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
"displayName": "Authentication ASIM filtering parser for Cisco ISE Administrator events",
2828
"category": "ASIM",
2929
"FunctionAlias": "vimAuthenticationCiscoISEAdministrator",
30-
"query": "let parser = (starttime: datetime=datetime(null), \n endtime: datetime=datetime(null), \n username_has_any: dynamic = dynamic([]),\n targetappname_has_any: dynamic = dynamic([]),\n srcipaddr_has_any_prefix: dynamic = dynamic([]),\n srchostname_has_any: dynamic = dynamic([]),\n eventtype_in: dynamic = dynamic([]),\n eventresultdetails_in: dynamic = dynamic([]),\n eventresult: string = '*',\n disabled: bool=false,\n pack: bool = false) {\nSyslog\n| where not(disabled) and ProcessName has \"CISE_Administrative_and_Operational_Audit\"\n| where (isnull(starttime) or TimeGenerated >= starttime)\n and (isnull(endtime) or TimeGenerated <= endtime)\n and (array_length(targetappname_has_any) == 0) // No Target app name\n and (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(HostIP, srcipaddr_has_any_prefix))\n and (array_length(srchostname_has_any) == 0 or HostName has_any (srchostname_has_any))\n and ((array_length(eventtype_in) == 0) or \"Logon\" in~ (eventtype_in))\n| where SyslogMessage has \"Administrator-Login\"\n| extend\n EventVendor = \"Cisco\",\n EventProduct = \"ISE\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n EventCount = int(1),\n EventStartTime = EventTime,\n EventEndTime = EventTime,\n EventSeverity = \"Informational\",\n EventType = \"Logon\",\n Type = \"Syslog\"\n| project-rename\n SrcIpAddr = HostIP,\n SrcDvcId = HostName\n| extend\n SrcDvcIdType = \"Other\"\n| parse SyslogMessage with * \"Administrator-Login:\" * \", \" KeyValuePairs\n| parse-kv KeyValuePairs as (ConfigVersionId: string, AdminInterface: string, AdminIPAddress: string, OperationMessageText: string, Port: int, AcsInstance: string, AdminName: string) with (pair_delimiter=\",\", kv_delimiter=\"=\")\n| extend\n EventResult = iff(isnotempty(AdminName), \"Success\", \"Failure\"), // AdminName exists in Syslog if authentication was successful\n EventResultDetails = iff(isempty(AdminName), case(\n OperationMessageText has \"Failed password\", \"Incorrect password\",\n OperationMessageText has \"User unknown\", \"No such user\",\n \"Other\"\n ), \"\"),\n TargetUsername = coalesce(AdminName, \"\"),\n TargetUsernameType = iff(isnotempty(AdminName), \"Simple\", \"\")\n| where (array_length(username_has_any) == 0) or TargetUsername has_any (username_has_any)\n| where (eventresult == '*' or eventresult =~ EventResult) and (array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in))\n| extend temp_isMatchTargetUsername = TargetUsername has_any(username_has_any)\n| extend ASimMatchingUsername = case(\n array_length(username_has_any) == 0, \"-\",\n temp_isMatchTargetUsername, \"TargetUsername\",\n \"No match\"\n)\n| project-rename\n TargetIpAddr = AdminIPAddress,\n EventOriginalResultDetails = OperationMessageText,\n TargetPortNumber = Port\n| extend AdditionalFields = iff(pack, bag_pack(\n \"AdminInterface\", AdminInterface,\n \"ConfigVersionId\", ConfigVersionId,\n \"AcsInstance\", AcsInstance,\n \"CollectorHostName\", CollectorHostName\n), dynamic([]))\n| extend\n IpAddr = SrcIpAddr,\n Dvc = SrcDvcId\n| project\n TimeGenerated,\n Type,\n EventVendor,\n EventProduct,\n EventCount,\n EventSchema,\n EventSchemaVersion,\n EventStartTime,\n EventEndTime,\n EventSeverity,\n EventType,\n SrcIpAddr,\n SrcDvcId,\n SrcDvcIdType,\n EventResult,\n EventResultDetails,\n TargetUsername,\n TargetUsernameType,\n ASimMatchingUsername,\n TargetIpAddr,\n EventOriginalResultDetails,\n TargetPortNumber,\n AdditionalFields,\n IpAddr,\n Dvc\n};\nparser(\n starttime=starttime,\n endtime=endtime,\n username_has_any=username_has_any,\n targetappname_has_any=targetappname_has_any,\n srcipaddr_has_any_prefix=srcipaddr_has_any_prefix,\n srchostname_has_any=srchostname_has_any,\n eventtype_in=eventtype_in,\n eventresultdetails_in=eventresultdetails_in,\n eventresult=eventresult,\n disabled=disabled,\n pack=pack)",
30+
"query": "let parser = (starttime: datetime=datetime(null), \n endtime: datetime=datetime(null), \n username_has_any: dynamic = dynamic([]),\n targetappname_has_any: dynamic = dynamic([]),\n srcipaddr_has_any_prefix: dynamic = dynamic([]),\n srchostname_has_any: dynamic = dynamic([]),\n eventtype_in: dynamic = dynamic([]),\n eventresultdetails_in: dynamic = dynamic([]),\n eventresult: string = '*',\n disabled: bool=false,\n pack: bool = false) {\nSyslog\n| where not(disabled) and ProcessName has \"CISE_Administrative_and_Operational_Audit\"\n| where (isnull(starttime) or TimeGenerated >= starttime)\n and (isnull(endtime) or TimeGenerated <= endtime)\n and (array_length(targetappname_has_any) == 0) // No Target app name\n and (array_length(srchostname_has_any) == 0 or HostName has_any (srchostname_has_any))\n and ((array_length(eventtype_in) == 0) or \"Logon\" in~ (eventtype_in))\n| where SyslogMessage has \"Administrator-Login\"\n| extend\n EventVendor = \"Cisco\",\n EventProduct = \"ISE\",\n EventSchema = \"Authentication\",\n EventSchemaVersion = \"0.1.4\",\n EventCount = int(1),\n EventStartTime = EventTime,\n EventEndTime = EventTime,\n EventType = \"Logon\",\n Type = \"Syslog\"\n| project-rename\n TargetIpAddr = HostIP,\n SrcDvcId = HostName\n| extend\n SrcDvcIdType = \"Other\"\n| parse SyslogMessage with * \"Administrator-Login:\" * \", \" KeyValuePairs\n| parse-kv KeyValuePairs as (ConfigVersionId: string, AdminInterface: string, AdminIPAddress: string, OperationMessageText: string, Port: int, AcsInstance: string, AdminName: string) with (pair_delimiter=\",\", kv_delimiter=\"=\")\n| extend\n EventResult = iff(isnotempty(AdminName), \"Success\", \"Failure\"), // AdminName exists in Syslog if authentication was successful\n EventResultDetails = iff(isempty(AdminName), case(\n OperationMessageText has \"Failed password\", \"Incorrect password\",\n OperationMessageText has \"User unknown\", \"No such user\",\n \"Other\"\n ), \"\"),\n TargetUsername = coalesce(AdminName, \"\"),\n TargetUsernameType = iff(isnotempty(AdminName), \"Simple\", \"\")\n| where (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(AdminIPAddress, srcipaddr_has_any_prefix))\n| where (array_length(username_has_any) == 0) or TargetUsername has_any (username_has_any)\n| where (eventresult == '*' or eventresult =~ EventResult) and (array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in))\n| extend temp_isMatchTargetUsername = TargetUsername has_any(username_has_any)\n| extend ASimMatchingUsername = case(\n array_length(username_has_any) == 0, \"-\",\n temp_isMatchTargetUsername, \"TargetUsername\",\n \"No match\"\n)\n| project-rename\n SrcIpAddr = AdminIPAddress,\n EventOriginalResultDetails = OperationMessageText,\n TargetPortNumber = Port,\n EventOriginalSeverity = SeverityLevel\n| extend EventSeverity = _ASIM_LookupSyslogSeverityLevel(EventOriginalSeverity)\n| extend AdditionalFields = iff(pack, bag_pack(\n \"AdminInterface\", AdminInterface,\n \"ConfigVersionId\", ConfigVersionId,\n \"AcsInstance\", AcsInstance,\n \"CollectorHostName\", CollectorHostName\n), dynamic([]))\n| extend\n IpAddr = SrcIpAddr,\n Dvc = SrcDvcId,\n User = TargetUsername\n| project\n TimeGenerated,\n Type,\n EventVendor,\n EventProduct,\n EventCount,\n EventSchema,\n EventSchemaVersion,\n EventStartTime,\n EventEndTime,\n EventSeverity,\n EventOriginalSeverity,\n EventType,\n SrcIpAddr,\n SrcDvcId,\n SrcDvcIdType,\n EventResult,\n EventResultDetails,\n TargetUsername,\n TargetUsernameType,\n ASimMatchingUsername,\n TargetIpAddr,\n EventOriginalResultDetails,\n TargetPortNumber,\n AdditionalFields,\n IpAddr,\n Dvc,\n User\n};\nparser(\n starttime=starttime,\n endtime=endtime,\n username_has_any=username_has_any,\n targetappname_has_any=targetappname_has_any,\n srcipaddr_has_any_prefix=srcipaddr_has_any_prefix,\n srchostname_has_any=srchostname_has_any,\n eventtype_in=eventtype_in,\n eventresultdetails_in=eventresultdetails_in,\n eventresult=eventresult,\n disabled=disabled,\n pack=pack)",
3131
"version": 1,
3232
"functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),username_has_any:dynamic=dynamic([]),targetappname_has_any:dynamic=dynamic([]),srcipaddr_has_any_prefix:dynamic=dynamic([]),srchostname_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresultdetails_in:dynamic=dynamic([]),eventresult:string='*',disabled:bool=False,pack:bool=False"
3333
}

‎Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationCiscoISEAdministrator.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
# Changelog for ASimAuthenticationCiscoISEAdministrator.yaml
22

3+
## Version 0.1.1
4+
5+
- (2026-04-14) Fix mapping HostIP to TargetIpAddr - [PR #14076](https://github.com/Azure/Azure-Sentinel/pull/14076)
6+
- Fix mapping of AdminIPAddress to SrcIpAddr
7+
- Add User alias to TargetUsername
8+
- Map EventSeverity based on SeverityLevel
9+
310
## Version 0.1.0
411

512
- (2026-04-07) Create parser for Cisco ISE Administrator authentication events from Syslog by AMA ingestion - [PR #13909](https://github.com/Azure/Azure-Sentinel/pull/13909)

‎Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationCiscoISEAdministrator.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
# Changelog for vimAuthenticationCiscoISEAdministrator.yaml
22

3+
## Version 0.1.1
4+
5+
- (2026-04-14) Fix mapping HostIP to TargetIpAddr - [PR #14076](https://github.com/Azure/Azure-Sentinel/pull/14076)
6+
- Fix mapping of AdminIPAddress to SrcIpAddr
7+
- Add User alias to TargetUsername
8+
- Map EventSeverity based on SeverityLevel
9+
310
## Version 0.1.0
411

512
- (2026-04-07) Create parser for Cisco ISE Administrator authentication events from Syslog by AMA ingestion - [PR #13909](https://github.com/Azure/Azure-Sentinel/pull/13909)

‎Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoISEAdministrator.yaml‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Parser:
22
Title: Authentication ASIM parser for Cisco ISE Administrator events
3-
Version: '0.1.0'
4-
LastUpdated: Apr 09, 2026
3+
Version: '0.1.1'
4+
LastUpdated: Apr 14, 2026
55
Product:
66
Name: Cisco ISE Administrator
77
Normalization:
@@ -38,11 +38,10 @@ ParserQuery: |
3838
EventCount = int(1),
3939
EventStartTime = TimeGenerated,
4040
EventEndTime = TimeGenerated,
41-
EventSeverity = "Informational",
4241
EventType = "Logon",
4342
Type = "Syslog"
4443
| project-rename
45-
SrcIpAddr = HostIP,
44+
TargetIpAddr = HostIP,
4645
SrcDvcId = HostName
4746
| extend
4847
SrcDvcIdType = "Other"
@@ -58,9 +57,11 @@ ParserQuery: |
5857
TargetUsername = coalesce(AdminName, ""),
5958
TargetUsernameType = iff(isnotempty(AdminName), "Simple", "")
6059
| project-rename
61-
TargetIpAddr = AdminIPAddress,
60+
SrcIpAddr = AdminIPAddress,
6261
EventOriginalResultDetails = OperationMessageText,
63-
TargetPortNumber = Port
62+
TargetPortNumber = Port,
63+
EventOriginalSeverity = SeverityLevel
64+
| extend EventSeverity = _ASIM_LookupSyslogSeverityLevel(EventOriginalSeverity)
6465
| extend AdditionalFields = iff(pack, bag_pack(
6566
"AdminInterface", AdminInterface,
6667
"ConfigVersionId", ConfigVersionId,
@@ -69,7 +70,8 @@ ParserQuery: |
6970
), dynamic([]))
7071
| extend
7172
IpAddr = SrcIpAddr,
72-
Dvc = SrcDvcId
73+
Dvc = SrcDvcId,
74+
User = TargetUsername
7375
| project
7476
TimeGenerated,
7577
Type,
@@ -81,6 +83,7 @@ ParserQuery: |
8183
EventStartTime,
8284
EventEndTime,
8385
EventSeverity,
86+
EventOriginalSeverity,
8487
EventType,
8588
SrcIpAddr,
8689
SrcDvcId,
@@ -94,6 +97,7 @@ ParserQuery: |
9497
TargetPortNumber,
9598
AdditionalFields,
9699
IpAddr,
97-
Dvc
100+
Dvc,
101+
User
98102
};
99103
parser(disabled=disabled, pack=pack)

‎Parsers/ASimAuthentication/Parsers/vimAuthenticationCiscoISEAdministrator.yaml‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Parser:
22
Title: Authentication ASIM filtering parser for Cisco ISE Administrator events
3-
Version: '0.1.0'
4-
LastUpdated: Apr 09, 2026
3+
Version: '0.1.1'
4+
LastUpdated: Apr 14, 2026
55
Product:
66
Name: Cisco ISE Administrator
77
Normalization:
@@ -69,7 +69,6 @@ ParserQuery: |
6969
| where (isnull(starttime) or TimeGenerated >= starttime)
7070
and (isnull(endtime) or TimeGenerated <= endtime)
7171
and (array_length(targetappname_has_any) == 0) // No Target app name
72-
and (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(HostIP, srcipaddr_has_any_prefix))
7372
and (array_length(srchostname_has_any) == 0 or HostName has_any (srchostname_has_any))
7473
and ((array_length(eventtype_in) == 0) or "Logon" in~ (eventtype_in))
7574
| where SyslogMessage has "Administrator-Login"
@@ -81,11 +80,10 @@ ParserQuery: |
8180
EventCount = int(1),
8281
EventStartTime = EventTime,
8382
EventEndTime = EventTime,
84-
EventSeverity = "Informational",
8583
EventType = "Logon",
8684
Type = "Syslog"
8785
| project-rename
88-
SrcIpAddr = HostIP,
86+
TargetIpAddr = HostIP,
8987
SrcDvcId = HostName
9088
| extend
9189
SrcDvcIdType = "Other"
@@ -100,6 +98,7 @@ ParserQuery: |
10098
), ""),
10199
TargetUsername = coalesce(AdminName, ""),
102100
TargetUsernameType = iff(isnotempty(AdminName), "Simple", "")
101+
| where (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(AdminIPAddress, srcipaddr_has_any_prefix))
103102
| where (array_length(username_has_any) == 0) or TargetUsername has_any (username_has_any)
104103
| where (eventresult == '*' or eventresult =~ EventResult) and (array_length(eventresultdetails_in) == 0 or EventResultDetails in~ (eventresultdetails_in))
105104
| extend temp_isMatchTargetUsername = TargetUsername has_any(username_has_any)
@@ -109,9 +108,11 @@ ParserQuery: |
109108
"No match"
110109
)
111110
| project-rename
112-
TargetIpAddr = AdminIPAddress,
111+
SrcIpAddr = AdminIPAddress,
113112
EventOriginalResultDetails = OperationMessageText,
114-
TargetPortNumber = Port
113+
TargetPortNumber = Port,
114+
EventOriginalSeverity = SeverityLevel
115+
| extend EventSeverity = _ASIM_LookupSyslogSeverityLevel(EventOriginalSeverity)
115116
| extend AdditionalFields = iff(pack, bag_pack(
116117
"AdminInterface", AdminInterface,
117118
"ConfigVersionId", ConfigVersionId,
@@ -120,7 +121,8 @@ ParserQuery: |
120121
), dynamic([]))
121122
| extend
122123
IpAddr = SrcIpAddr,
123-
Dvc = SrcDvcId
124+
Dvc = SrcDvcId,
125+
User = TargetUsername
124126
| project
125127
TimeGenerated,
126128
Type,
@@ -132,6 +134,7 @@ ParserQuery: |
132134
EventStartTime,
133135
EventEndTime,
134136
EventSeverity,
137+
EventOriginalSeverity,
135138
EventType,
136139
SrcIpAddr,
137140
SrcDvcId,
@@ -146,7 +149,8 @@ ParserQuery: |
146149
TargetPortNumber,
147150
AdditionalFields,
148151
IpAddr,
149-
Dvc
152+
Dvc,
153+
User
150154
};
151155
parser(
152156
starttime=starttime,

0 commit comments

Comments
 (0)