[ASIM] Cisco FTD NetworkSession Parser

Author: Steve1145

ASIM/dev/ASimTester/ASimTester.csv

@@ -873,7 +873,7 @@ EventType,string,Mandatory,Common,Enumerated,Placeholder,,,
 EventType,string,Mandatory,DhcpEvent,Enumerated,Assign|Renew|Release|DNS Update|,,,
 EventType,string,Mandatory,Dns,Enumerated,Query|Status|Notify|Update|DNS Stateful Operations,,,
 EventType,string,Mandatory,FileEvent,Enumerated,FileAccessed|FileCreated|FileModified|FileDeleted|FileRenamed|FileCopied|FileMoved|FolderCreated|FolderDeleted|FolderMoved|FolderCopied|FolderModified|FileCreatedOrModified|FileAttributesUpdated|FolderAttributesAccessed,,,
-EventType,string,Mandatory,NetworkSession,Enumerated,NetworkSession|L2NetworkSession|EndpointNetworkSession|Flow,,,
+EventType,string,Mandatory,NetworkSession,Enumerated,NetworkSession|L2NetworkSession|EndpointNetworkSession|Flow|IDS,,,
 EventType,string,Mandatory,ProcessEvent,Enumerated,ProcessCreated|ProcessTerminated,,,
 EventType,string,Mandatory,RegistryEvent,Enumerated,RegistryKeyCreated|RegistryKeyDeleted|RegistryKeyRenamed|RegistryValueDeleted|RegistryValueSet,,,
 EventType,string,Mandatory,UserManagement,Enumerated,UserCreated|UserDeleted|UserModified|UserLocked|UserUnlocked|UserDisabled|UserEnabled|PasswordChanged|PasswordReset|GroupCreated|GroupDeleted|GroupModified|UserAddedToGroup|UserRemovedFromGroup|GroupEnumerated|UserRead|GroupRead,,,

Parsers/ASimNetworkSession/ARM/ASimNetworkSession/ASimNetworkSession.json

@@ -27,7 +27,7 @@
         "displayName": "Network Session ASIM parser",
         "category": "ASIM",
         "FunctionAlias": "ASimNetworkSession",
-        "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimNetworkSession') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet ASimBuiltInDisabled=toscalar('ExcludeASimNetworkSession' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nlet NetworkSessionsGeneric=(pack:bool=false){\nunion isfuzzy=true\n  vimNetworkSessionEmpty\n  , ASimNetworkSessionLinuxSysmon                   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionLinuxSysmon'      in (DisabledParsers) ))\n  , ASimNetworkSessionMicrosoft365Defender          (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMicrosoft365Defender'      in (DisabledParsers) ))\n  , ASimNetworkSessionMD4IoTSensor                  (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMD4IoTSSensor'      in (DisabledParsers) ))\n  , ASimNetworkSessionMD4IoTAgent                   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMD4IoTAgent'      in (DisabledParsers) ))\n  , ASimNetworkSessionMicrosoftWindowsEventFirewall (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMicrosoftWindowsEventFirewall'      in (DisabledParsers) ))\n  , ASimNetworkSessionMicrosoftSecurityEventFirewall (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMicrosoftSecurityEventFirewall'      in (DisabledParsers) ))\n  , ASimNetworkSessionPaloAltoCEF                   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionPaloAltoCEF'      in (DisabledParsers) ))\n  , ASimNetworkSessionVMConnection                  (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionVMConnection'      in (DisabledParsers) ))\n  , ASimNetworkSessionAWSVPC                        (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionAWSVPC'      in (DisabledParsers) ))\n  , ASimNetworkSessionAzureFirewall                 (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionAzureFirewall'      in (DisabledParsers) ))\n  , ASimNetworkSessionAzureNSG                      (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionAzureNSG'      in (DisabledParsers) ))\n  , ASimNetworkSessionVectraAI                      (pack=pack, disabled=(ASimBuiltInDisabled or ('ExcludeASimNetworkSessionVectraAI' in (DisabledParsers) )))\n  , ASimNetworkSessionCiscoMeraki                   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoMeraki'      in (DisabledParsers) ))\n  , ASimNetworkSessionCiscoMerakiSyslog             (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoMerakiSyslog'      in (DisabledParsers) ))\n  , ASimNetworkSessionAppGateSDP                    (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionAppGateSDP'      in (DisabledParsers) ))\n  , ASimNetworkSessionFortinetFortiGate             (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionFortinetFortiGate'      in (DisabledParsers) ))\n  , ASimNetworkSessionCorelightZeek                 (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCorelightZeek'      in (DisabledParsers) ))\n  , ASimNetworkSessionCheckPointFirewall            (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCheckPointFirewall'      in (DisabledParsers) ))\n  , ASimNetworkSessionCiscoASA                      (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoASA'      in (DisabledParsers) ))\n  , ASimNetworkSessionWatchGuardFirewareOS          (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionWatchGuardFirewareOS'      in (DisabledParsers) ))\n  , ASimNetworkSessionMicrosoftSysmon               (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMicrosoftSysmon'      in (DisabledParsers) ))\n  , ASimNetworkSessionMicrosoftSysmonWindowsEvent   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMicrosoftSysmonWindowsEvent'      in (DisabledParsers) ))\n  , ASimNetworkSessionForcePointFirewall            (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionForcePointFirewall'      in (DisabledParsers) ))\n  , ASimNetworkSessionNative                        (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionNative'      in (DisabledParsers) ))\n  , ASimNetworkSessionSentinelOne                   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionSentinelOne'      in (DisabledParsers) ))\n  , ASimNetworkSessionCiscoMeraki                   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoMeraki'      in (DisabledParsers) ))\n  , ASimNetworkSessionCiscoISE                      (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoISE'      in (DisabledParsers) ))\n  , ASimNetworkSessionBarracudaWAF                  (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionBarracudaWAF'      in (DisabledParsers) ))\n  , ASimNetworkSessionBarracudaCEF                  (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionBarracudaCEF'      in (DisabledParsers) ))\n  , ASimNetworkSessionCiscoFirepower                (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoFirepower'      in (DisabledParsers) ))\n  , ASimNetworkSessionCrowdStrikeFalconHost         (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCrowdStrikeFalconHost'      in (DisabledParsers) ))\n  , ASimNetworkSessionVMwareCarbonBlackCloud        (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionVMwareCarbonBlackCloud'      in (DisabledParsers) ))\n  , ASimNetworkSessionPaloAltoCortexDataLake        (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionPaloAltoCortexDataLake'      in (DisabledParsers) ))\n  , ASimNetworkSessionSonicWallFirewall             (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionSonicWallFirewall'      in (DisabledParsers) ))\n  , ASimNetworkSessionIllumioSaaSCore               (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionIllumioSaaSCore'      in (DisabledParsers) ))\n  , ASimNetworkSessionNTANetAnalytics               (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionNTANetAnalytics'      in (DisabledParsers) ))\n  , ASimNetworkSessionCheckPointSmartDefense        (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCheckPointSmartDefense'      in (DisabledParsers) ), pack=pack)\n};\nNetworkSessionsGeneric (pack=pack)\n",
+        "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimNetworkSession') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser);\nlet ASimBuiltInDisabled=toscalar('ExcludeASimNetworkSession' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nlet NetworkSessionsGeneric=(pack:bool=false){\nunion isfuzzy=true\n  vimNetworkSessionEmpty\n  , ASimNetworkSessionLinuxSysmon                   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionLinuxSysmon'      in (DisabledParsers) ))\n  , ASimNetworkSessionMicrosoft365Defender          (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMicrosoft365Defender'      in (DisabledParsers) ))\n  , ASimNetworkSessionMD4IoTSensor                  (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMD4IoTSSensor'      in (DisabledParsers) ))\n  , ASimNetworkSessionMD4IoTAgent                   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMD4IoTAgent'      in (DisabledParsers) ))\n  , ASimNetworkSessionMicrosoftWindowsEventFirewall (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMicrosoftWindowsEventFirewall'      in (DisabledParsers) ))\n  , ASimNetworkSessionMicrosoftSecurityEventFirewall (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMicrosoftSecurityEventFirewall'      in (DisabledParsers) ))\n  , ASimNetworkSessionPaloAltoCEF                   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionPaloAltoCEF'      in (DisabledParsers) ))\n  , ASimNetworkSessionVMConnection                  (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionVMConnection'      in (DisabledParsers) ))\n  , ASimNetworkSessionAWSVPC                        (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionAWSVPC'      in (DisabledParsers) ))\n  , ASimNetworkSessionAzureFirewall                 (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionAzureFirewall'      in (DisabledParsers) ))\n  , ASimNetworkSessionAzureNSG                      (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionAzureNSG'      in (DisabledParsers) ))\n  , ASimNetworkSessionVectraAI                      (pack=pack, disabled=(ASimBuiltInDisabled or ('ExcludeASimNetworkSessionVectraAI' in (DisabledParsers) )))\n  , ASimNetworkSessionCiscoMeraki                   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoMeraki'      in (DisabledParsers) ))\n  , ASimNetworkSessionCiscoMerakiSyslog             (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoMerakiSyslog'      in (DisabledParsers) ))\n  , ASimNetworkSessionAppGateSDP                    (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionAppGateSDP'      in (DisabledParsers) ))\n  , ASimNetworkSessionFortinetFortiGate             (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionFortinetFortiGate'      in (DisabledParsers) ))\n  , ASimNetworkSessionCorelightZeek                 (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCorelightZeek'      in (DisabledParsers) ))\n  , ASimNetworkSessionCheckPointFirewall            (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCheckPointFirewall'      in (DisabledParsers) ))\n  , ASimNetworkSessionCiscoASA                      (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoASA'      in (DisabledParsers) ))\n  , ASimNetworkSessionWatchGuardFirewareOS          (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionWatchGuardFirewareOS'      in (DisabledParsers) ))\n  , ASimNetworkSessionMicrosoftSysmon               (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMicrosoftSysmon'      in (DisabledParsers) ))\n  , ASimNetworkSessionMicrosoftSysmonWindowsEvent   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionMicrosoftSysmonWindowsEvent'      in (DisabledParsers) ))\n  , ASimNetworkSessionForcePointFirewall            (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionForcePointFirewall'      in (DisabledParsers) ))\n  , ASimNetworkSessionNative                        (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionNative'      in (DisabledParsers) ))\n  , ASimNetworkSessionSentinelOne                   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionSentinelOne'      in (DisabledParsers) ))\n  , ASimNetworkSessionCiscoMeraki                   (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoMeraki'      in (DisabledParsers) ))\n  , ASimNetworkSessionCiscoISE                      (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoISE'      in (DisabledParsers) ))\n  , ASimNetworkSessionBarracudaWAF                  (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionBarracudaWAF'      in (DisabledParsers) ))\n  , ASimNetworkSessionBarracudaCEF                  (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionBarracudaCEF'      in (DisabledParsers) ))\n  , ASimNetworkSessionCiscoFirepower                (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoFirepower'      in (DisabledParsers) ))\n  , ASimNetworkSessionCrowdStrikeFalconHost         (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCrowdStrikeFalconHost'      in (DisabledParsers) ))\n  , ASimNetworkSessionVMwareCarbonBlackCloud        (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionVMwareCarbonBlackCloud'      in (DisabledParsers) ))\n  , ASimNetworkSessionPaloAltoCortexDataLake        (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionPaloAltoCortexDataLake'      in (DisabledParsers) ))\n  , ASimNetworkSessionSonicWallFirewall             (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionSonicWallFirewall'      in (DisabledParsers) ))\n  , ASimNetworkSessionIllumioSaaSCore               (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionIllumioSaaSCore'      in (DisabledParsers) ))\n  , ASimNetworkSessionNTANetAnalytics               (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionNTANetAnalytics'      in (DisabledParsers) ))\n  , ASimNetworkSessionCheckPointSmartDefense        (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCheckPointSmartDefense'      in (DisabledParsers) ), pack=pack)\n  , ASimNetworkSessionCiscoFTD                      (ASimBuiltInDisabled or ('ExcludeASimNetworkSessionCiscoFTD'      in (DisabledParsers) ), pack=pack)\n};\nNetworkSessionsGeneric (pack=pack)\n",
         "version": 1,
         "functionParameters": "pack:bool=False"
       }

Parsers/ASimNetworkSession/ARM/ASimNetworkSessionCiscoFTD/ASimNetworkSessionCiscoFTD.json

@@ -0,0 +1,21 @@
+# Cisco FTD ASIM NetworkSession Normalization Parser
+
+ARM template for ASIM NetworkSession schema parser for Cisco FTD.
+
+This ASIM parser supports the normalization of Cisco FTD logs via AMA to the ASIM Network Session schema.
+
+
+The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
+
+For more information, see:
+
+- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
+- [Deploy all of ASIM](https://aka.ms/DeployASIM)
+- [ASIM NetworkSession normalization schema reference](https://aka.ms/ASimNetworkSessionDoc)
+
+For the changelog, see:
+- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimNetworkSession/CHANGELOG/ASimNetworkSessionCiscoFTD.md)
+
+<br>
+
+[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimNetworkSession%2FARM%2FASimNetworkSessionCiscoFTD%2FASimNetworkSessionCiscoFTD.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimNetworkSession%2FARM%2FASimNetworkSessionCiscoFTD%2FASimNetworkSessionCiscoFTD.json)

Parsers/ASimNetworkSession/ARM/ASimNetworkSessionCiscoFTD/README.md

@@ -218,6 +218,26 @@
         }
       }
     },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "linkedASimNetworkSessionCiscoFTD",
+      "properties": {
+        "mode": "Incremental",
+        "templateLink": {
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimNetworkSession/ARM/ASimNetworkSessionCiscoFTD/ASimNetworkSessionCiscoFTD.json",
+          "contentVersion": "1.0.0.0"
+        },
+        "parameters": {
+          "Workspace": {
+            "value": "[parameters('Workspace')]"
+          },
+          "WorkspaceRegion": {
+            "value": "[parameters('WorkspaceRegion')]"
+          }
+        }
+      }
+    },
     {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2020-10-01",
@@ -978,6 +998,26 @@
         }
       }
     },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "linkedvimNetworkSessionCiscoFTD",
+      "properties": {
+        "mode": "Incremental",
+        "templateLink": {
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimNetworkSession/ARM/vimNetworkSessionCiscoFTD/vimNetworkSessionCiscoFTD.json",
+          "contentVersion": "1.0.0.0"
+        },
+        "parameters": {
+          "Workspace": {
+            "value": "[parameters('Workspace')]"
+          },
+          "WorkspaceRegion": {
+            "value": "[parameters('WorkspaceRegion')]"
+          }
+        }
+      }
+    },
     {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2020-10-01",