SentinelOne Singularity Alerts - ASIM Alert Event Parser

Parsers/ASimAlertEvent/ARM/ASimAlertEvent/ASimAlertEvent.json

@@ -27,7 +27,7 @@
         "displayName": "Alert Event ASIM parser",
         "category": "ASIM",
         "FunctionAlias": "ASimAlertEvent",
-        "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAlertEvent') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser| where isnotempty(SourceSpecificParser));\nlet ASimBuiltInDisabled=toscalar('ExcludeASimAlertEvent' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nlet parser=(pack:bool=false){\nunion isfuzzy=true\n  vimAlertEventEmpty,\n  ASimAlertEventBitdefenderGravityZone (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventBitdefenderGravityZone' in (DisabledParsers))), pack=pack),\n  ASimAlertEventMicrosoftDefenderXDR (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventMicrosoftDefenderXDR' in (DisabledParsers)))),\n  ASimAlertEventSentinelOneSingularity (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventSentinelOneSingularity' in (DisabledParsers)))),\n  ASimAlertEventCiscoSecureEndpoint (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventCiscoSecureEndpoint' in (DisabledParsers))), pack=pack),\n  ASimAlertEventPaloAltoXDR (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventPaloAltoXDR' in (DisabledParsers))), pack=pack),\n  ASimAlertEventNetskopeSecurityCloud (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventNetskopeSecurityCloud' in (DisabledParsers))), pack=pack),\n  ASimAlertEventCrowdStrikeFalcon (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventCrowdStrikeFalcon' in (DisabledParsers))), pack=pack),\n  ASimAlertEventGoogleSecOps (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventGoogleSecOps' in (DisabledParsers))), pack=pack),\n  ASimAlertEventGoogleThreatIntelligence (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventGoogleThreatIntelligence' in (DisabledParsers))), pack=pack)\n}; \nparser (pack=pack)\n",
+        "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAlertEvent') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser| where isnotempty(SourceSpecificParser));\nlet ASimBuiltInDisabled=toscalar('ExcludeASimAlertEvent' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nlet parser=(pack:bool=false){\nunion isfuzzy=true\n  vimAlertEventEmpty,\n  ASimAlertEventBitdefenderGravityZone (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventBitdefenderGravityZone' in (DisabledParsers))), pack=pack),\n  ASimAlertEventMicrosoftDefenderXDR (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventMicrosoftDefenderXDR' in (DisabledParsers)))),\n  ASimAlertEventSentinelOneSingularity (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventSentinelOneSingularity' in (DisabledParsers)))),\n  ASimAlertEventSentinelOneSingularityAlerts (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventSentinelOneSingularityAlerts' in (DisabledParsers)))),\n  ASimAlertEventCiscoSecureEndpoint (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventCiscoSecureEndpoint' in (DisabledParsers))), pack=pack),\n  ASimAlertEventPaloAltoXDR (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventPaloAltoXDR' in (DisabledParsers))), pack=pack),\n  ASimAlertEventNetskopeSecurityCloud (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventNetskopeSecurityCloud' in (DisabledParsers))), pack=pack),\n  ASimAlertEventCrowdStrikeFalcon (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventCrowdStrikeFalcon' in (DisabledParsers))), pack=pack),\n  ASimAlertEventGoogleSecOps (disabled=(ASimBuiltInDisabled or ('ExcludeASimAlertEventGoogleSecOps' in (DisabledParsers))), pack=pack)\n}; \nparser (pack=pack)\n",
         "version": 1,
         "functionParameters": "pack:bool=False"
       }

Parsers/ASimAlertEvent/ARM/ASimAlertEventSentinelOneSingularityAlerts/ASimAlertEventSentinelOneSingularityAlerts.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "Workspace": {
+      "type": "string",
+      "metadata": {
+        "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group."
+      }
+    },
+    "WorkspaceRegion": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "The region of the selected workspace. The default value will use the Region selection above."
+      }
+    }
+  },
+  "resources": [
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+      "apiVersion": "2020-08-01",
+      "name": "[concat(parameters('Workspace'), '/ASimAlertEventSentinelOneSingularityAlerts')]",
+      "location": "[parameters('WorkspaceRegion')]",
+      "properties": {
+        "etag": "*",
+        "displayName": "Alert Event ASIM parser for SentinelOne Singularity Alerts via CCF",
+        "category": "ASIM",
+        "FunctionAlias": "ASimAlertEventSentinelOneSingularityAlerts",
+        "query": "let AnalystVerdictArray = dynamic([\n    \"true positive\",\n    \"false positive\",\n    \"benign positive\"\n]);\nlet EventSubTypeLookup = datatable(EventOriginalSubType: string, EventSubType: string)[\n    \"malicious\", \"Threat\",\n    \"suspicious\", \"Suspicious Activity\",\n    \"undefined\", \"Anomaly\"\n];\nlet AlertStatusLookup = datatable(AlertOriginalStatus: string, AlertStatus: string)[\n    \"unresolved\", \"Active\",\n    \"in progress\", \"Active\",\n    \"resolved\", \"Closed\"\n];\nlet SentinelOneAlertsParser = (\n    disabled: bool = false,\n    pack: bool = false\n)\n{\n    SentinelOneAlerts_CL\n    | where not(disabled)\n    | extend \n        SourceProcessInfoJson = parse_json(SourceProcessInfo),\n        TargetProcessInfoJson = parse_json(TargetProcessInfo),\n        SourceParentProcessInfoJson = parse_json(SourceParentProcessInfo),\n        KubernetesInfoJson = parse_json(KubernetesInfo),\n        ContainerInfoJson = parse_json(ContainerInfo),\n        AlertInfoJson = parse_json(AlertInfo),\n        RuleInfoJson = parse_json(RuleInfo),\n        AgentDetectionInfoJson = parse_json(AgentDetectionInfo)\n    //Early Extraction for Filter Columns\n    | extend\n        Username = \n            tostring(coalesce(\n                AlertInfoJson.loginsUserName,\n                SourceProcessInfoJson.effectiveUser,\n                SourceProcessInfoJson.loginUser,\n                SourceProcessInfoJson.realUser,\n                SourceProcessInfoJson.user,\n                SourceParentProcessInfoJson.effectiveUser,\n                SourceParentProcessInfoJson.loginUser,\n                SourceParentProcessInfoJson.realUser,\n                SourceParentProcessInfoJson.user\n            )),\n        AlertVerdict = iff(AlertInfoJson.analystVerdict in~ (AnalystVerdictArray), AlertInfoJson.analystVerdict, \"Unknown\"),\n        EventSeverity = iff(RuleInfoJson.severity=~\"Critical\",\"High\",tostring(RuleInfoJson.severity)),\n        AttackTactics = strcat_array(extract_all(@\">([\\S ]+) \\(TA0\\d{3}\\)<\",tostring(AlertInfoJson.indicatorDescription)),\", \"),\n        AttackTechniques = extract_all(@\">(T\\d{4}.\\d{3}?)<.*>(.*):<\",dynamic([2,1]),tostring(AlertInfoJson.indicatorDescription))\n    | extend\n        //Inspection Fields\n        AlertName = tostring(RuleInfoJson.name),\n        AlertOriginalStatus = tolower(AlertInfoJson.incidentStatus),\n        EventOriginalSubType = tolower(RuleInfoJson.treatAsThreat),\n        EventOriginalType = tostring(AlertInfoJson.eventType),\n        RuleNumber = toint(RuleInfoJson.id),\n        RuleName = tostring(RuleInfoJson.name),\n        RuleDescription = tostring(RuleInfoJson.description),\n        ThreatOriginalCategory = tostring(AlertInfoJson.indicatorName),\n        //User Fields\n        OriginalUserType = AlertInfoJson.loginType,\n        UsernameType = case(\n            Username contains \"@\", \"UPN\",\n            Username contains \"\\\\\", \"Windows\",\n            Username contains \"OU=\", \"DN\",\n            Username matches regex @\"^\\d{11}$\",\"AWSId\",\n            \"Simple\"\n        ),\n        //Device fields\n        DvcHostname = tostring(split(AgentDetectionInfoJson.name,\".\")[0]),\n        DvcDescription = tostring(AgentDetectionInfoJson.machineType),\n        DvcIpAddr = tostring(coalesce(AlertInfoJson.srcIp,AlertInfoJson.srcMachineIp)),\n        DvcOs = tostring(AgentDetectionInfoJson.osFamily),\n        DvcOsVersion = tostring(AgentDetectionInfoJson.osName),\n        DvcId = tostring(AgentDetectionInfoJson.uuid),\n        DvcIdType = \"Other\",\n        //Common ASIM Fields\n        EventUid = tostring(AlertInfoJson.alertId),\n        EventType = \"Alert\",\n        EventCount = int(1),\n        EventStartTime = todatetime(AlertInfoJson.createdAt),\n        EventEndTime = todatetime(AlertInfoJson.createdAt),\n        EventProduct = \"Singularity\",\n        EventVendor = \"SentinelOne\",\n        EventResult = \"Success\",\n        EventSchema = \"AlertEvent\",\n        EventSchemaVersion=\"0.1\",\n        EventOriginalSeverity = tostring(RuleInfoJson.severity),\n        EventMessage = \n            case(\n                isnotempty(AlertInfoJson.indicatorDescription),\n                  extract(@\"(.*)\\n?\",1,tostring(AlertInfoJson.indicatorDescription)),\n                AlertInfoJson.eventType =~ \"WINLOGONATTEMPT\" and AlertInfoJson.loginIsSuccessful =~ \"false\",\n                  strcat(AlertInfoJson.loginType, \" logon failed user - \", AlertInfoJson.loginsUserName),\n                AlertInfoJson.eventType =~ \"WINLOGONATTEMPT\" and AlertInfoJson.loginIsSuccessful =~ \"true\",\n                  strcat(AlertInfoJson.loginType, \" logon successful user - \", AlertInfoJson.loginsUserName),\n                AlertInfoJson.eventType =~ \"DNS\",\n                  strcat(\"DNS request for \", AlertInfoJson.dnsRequest , \" returned \", AlertInfoJson.dnsResponse),\n                AlertInfoJson.eventType =~ \"REGVALUEMODIFIED\",\n                  strcat(\"A registry value has been modified\\n\",\"RegistryKey: \",AlertInfoJson.registryKeyPath, \"\\nRegistryOldValue: \",AlertInfoJson.registryOldValue, \"\\nRegistryNewValue: \",AlertInfoJson.registryValue),\n                tostring(RuleInfoJson.description)\n            )\n    //Normalize Mitre Format\n    | mv-apply AttackTechniques on \n    (\n        extend Technique = iff (isnotempty(AttackTechniques),strcat(AttackTechniques[0],\" (\",AttackTechniques[1],\")\"),\"\") \n        | summarize AttackTechniques = strcat_array(make_set_if(Technique,isnotempty(Technique)),\", \")\n    )\n    | lookup AlertStatusLookup on AlertOriginalStatus\n    | lookup EventSubTypeLookup on EventOriginalSubType\n    | extend\n    //Process Fields\n        ProcessId = tostring(SourceProcessInfoJson.pid),\n        ProcessCommandLine = tostring(SourceProcessInfoJson.commandline),\n        ProcessName = tostring(SourceProcessInfoJson.filePath),\n        ProcessFileCompany = tostring(SourceProcessInfoJson.fileSignerIdentity),\n    //File Fields\n        FileName = tostring(SourceProcessInfoJson.name),\n        FilePath = tostring(SourceProcessInfoJson.filePath),\n        FileSHA1 = tostring(SourceProcessInfoJson.fileHashSha1),\n        FileSHA256 = tostring(SourceProcessInfoJson.fileHashSha256),\n        FileMD5 = tostring(SourceProcessInfoJson.fileHashMd5),\n    //Registry Fields\n        RegistryKey = tostring(AlertInfoJson.registryPath),\n        RegistryValue = tostring(split(AlertInfoJson.registryPath,\"\\\\\")[-1]),\n        RegistryValueData = tostring(AlertInfoJson.registryValue)\n    //Alias\n    | extend \n        IpAddr = DvcIpAddr,\n        Hostname = DvcHostname,\n        Dvc = DvcHostname,\n        AlertId = EventUid,\n        AlertDescription = EventMessage,\n        Rule = RuleName,\n        User = Username\n    //AdditionalFields\n    | extend\n        DstIpAddr = tostring(AlertInfoJson.dstIp),\n        DstPortNumber = tostring(AlertInfoJson.dstPort),\n        SrcIpAddr = tostring(AlertInfoJson.srcIp),\n        SrcMachineIp = tostring(AlertInfoJson.srcMachineIp),\n        SrcPortNumber = tostring(AlertInfoJson.srcPort),\n        LoginAccountDomain = tostring(AlertInfoJson.loginAccountDomain),\n        LoginAccountSid = tostring(AlertInfoJson.loginAccountSid),\n        LoginIsAdministratorEquivalent = tostring(AlertInfoJson.loginIsAdministratorEquivalent),\n        ModulePath = tostring(AlertInfoJson.modulePath),\n        ModuleSha1 = tostring(AlertInfoJson.moduleSha1),\n        NetEventDirection = tostring(AlertInfoJson.netEventDirection),\n        RegistryKeyPath = tostring(AlertInfoJson.registryKeyPath),\n        RegistryOldValue = tostring(AlertInfoJson.registryOldValue),\n        RegistryOldValueType = tostring(AlertInfoJson.registryOldValueType),\n        TiIndicatorComparisonMethod = tostring(AlertInfoJson.tiIndicatorComparisonMethod),\n        TiIndicatorSource = tostring(AlertInfoJson.tiIndicatorSource),\n        TiIndicatorType = tostring(AlertInfoJson.tiIndicatorType),\n        TiIndicatorValue = tostring(AlertInfoJson.tiIndicatorValue),\n        Source = tostring(AlertInfoJson.source),\n        ReportedAt = tostring(AlertInfoJson.reportedAt),\n        UpdatedAt = tostring(AlertInfoJson.updatedAt),\n        S1ql = tostring(RuleInfoJson.s1ql)\n    | extend AdditionalFields = \n        iff(pack == true,\n            bag_pack(\n                \"SourceProcessInfo\", SourceProcessInfo,\n                \"SourceParentProcessInfo\", SourceParentProcessInfo,\n                \"TargetProcessInfo\", TargetProcessInfo,\n                \"ContainerInfo\", ContainerInfo,\n                \"KubernetesInfo\", KubernetesInfo,\n                \"DstIpAddr\", DstIpAddr,\n                \"DstPortNumber\", DstPortNumber,\n                \"SrcIpAddr\", SrcIpAddr,\n                \"SrcMachineIp\", SrcMachineIp,\n                \"SrcPortNumber\", SrcPortNumber,\n                \"LoginAccountDomain\", LoginAccountDomain,\n                \"LoginAccountSid\", LoginAccountSid,\n                \"LoginIsAdministratorEquivalent\", LoginIsAdministratorEquivalent,\n                \"ModulePath\", ModulePath,\n                \"ModuleSha1\", ModuleSha1,\n                \"NetEventDirection\", NetEventDirection,\n                \"RegistryKeyPath\", RegistryKeyPath,\n                \"RegistryOldValue\", RegistryOldValue,\n                \"RegistryOldValueType\", RegistryOldValueType,\n                \"TiIndicatorComparisonMethod\", TiIndicatorComparisonMethod,\n                \"TiIndicatorSource\", TiIndicatorSource,\n                \"TiIndicatorType\", TiIndicatorType,\n                \"TiIndicatorValue\", TiIndicatorValue,\n                \"Source\", Source,\n                \"ReportedAt\", ReportedAt,\n                \"UpdatedAt\", UpdatedAt,\n                \"S1ql\", S1ql\n            ),\n            dynamic({}))\n    | project\n        TimeGenerated,\n        AlertId,\n        AlertName,\n        AlertDescription,\n        AlertVerdict,\n        AlertStatus,\n        AlertOriginalStatus,\n        Dvc,\n        DvcDescription,\n        DvcIpAddr,\n        DvcId,\n        DvcIdType,\n        DvcOs,\n        DvcOsVersion,\n        User,\n        ProcessName,\n        ProcessId,\n        ProcessCommandLine,\n        ProcessFileCompany,\n        FileName,\n        FilePath,\n        FileSHA1,\n        FileSHA256,\n        FileMD5,\n        //Url,\n        RegistryKey,\n        RegistryValue,\n        RegistryValueData,\n        //Email,\n        EventUid,\n        EventType,\n        EventCount,\n        EventSeverity,\n        EventOriginalSeverity,\n        EventMessage,\n        EventOriginalType,\n        EventSubType,\n        EventOriginalSubType,\n        EventStartTime,\n        EventEndTime,\n        EventProduct,\n        EventVendor,\n        EventResult,\n        EventSchema,\n        EventSchemaVersion,\n        IpAddr,\n        Username,\n        UsernameType,\n        Rule,\n        RuleNumber,\n        RuleName,\n        RuleDescription,\n        DvcHostname,\n        Hostname,\n        ThreatOriginalCategory,\n        AttackTactics,\n        AttackTechniques,\n        Type,\n        AdditionalFields\n};\nSentinelOneAlertsParser\n(\n    disabled = disabled,\n    pack = pack\n)",
+        "version": 1,
+        "functionParameters": "disabled:bool=False,pack:bool=False"
+      }
+    }
+  ]
+}

Parsers/ASimAlertEvent/ARM/ASimAlertEventSentinelOneSingularityAlerts/README.md

@@ -0,0 +1,21 @@
+# SentinelOne ASIM AlertEvent Normalization Parser
+
+ARM template for ASIM AlertEvent schema parser for SentinelOne.
+
+This ASIM parser supports normalizing the SentinelOne Singularity Alerts ingested in SentinelOneAlerts_CL table (via Codeless Connector Framework) to the ASIM Alert normalized schema.
+
+
+The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
+
+For more information, see:
+
+- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
+- [Deploy all of ASIM](https://aka.ms/DeployASIM)
+- [ASIM AlertEvent normalization schema reference](https://aka.ms/ASimAlertEventDoc)
+
+For the changelog, see:
+- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEventSentinelOneSingularityAlerts.md)
+
+<br>
+
+[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAlertEvent%2FARM%2FASimAlertEventSentinelOneSingularityAlerts%2FASimAlertEventSentinelOneSingularityAlerts.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAlertEvent%2FARM%2FASimAlertEventSentinelOneSingularityAlerts%2FASimAlertEventSentinelOneSingularityAlerts.json)

Parsers/ASimAlertEvent/ARM/FullDeploymentAlertEvent.json

@@ -218,6 +218,26 @@
         }
       }
     },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "linkedASimAlertEventSentinelOneSingularityAlerts",
+      "properties": {
+        "mode": "Incremental",
+        "templateLink": {
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAlertEvent/ARM/ASimAlertEventSentinelOneSingularityAlerts/ASimAlertEventSentinelOneSingularityAlerts.json",
+          "contentVersion": "1.0.0.0"
+        },
+        "parameters": {
+          "Workspace": {
+            "value": "[parameters('Workspace')]"
+          },
+          "WorkspaceRegion": {
+            "value": "[parameters('WorkspaceRegion')]"
+          }
+        }
+      }
+    },
     {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2020-10-01",
@@ -437,6 +457,26 @@
           }
         }
       }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "linkedvimAlertEventSentinelOneSingularityAlerts",
+      "properties": {
+        "mode": "Incremental",
+        "templateLink": {
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAlertEvent/ARM/vimAlertEventSentinelOneSingularityAlerts/vimAlertEventSentinelOneSingularityAlerts.json",
+          "contentVersion": "1.0.0.0"
+        },
+        "parameters": {
+          "Workspace": {
+            "value": "[parameters('Workspace')]"
+          },
+          "WorkspaceRegion": {
+            "value": "[parameters('WorkspaceRegion')]"
+          }
+        }
+      }
     }
   ],
   "outputs": {}